Conversation

Notices

1. Embed this notice
   Rui Seabra (ruiseabra@mastodon.social)'s status on Saturday, 15-Apr-2023 22:51:59 JST Rui Seabra

   • w4tsn ~> :idle:

   @w4tsn hi, inspired by the Fedora Magazine article and since I found out that the udev rules for locking the screen didn't work very wel with pam_yubico I wrote a gnome-shell extension that locks the screen on smart card removal: https://extensions.gnome.org/extension/5901/smartcard-lock/ I would post a comment on the article, but they're closed. I hope it's useful for you too.

   • Embed this notice
     Rui Seabra (ruiseabra@mastodon.social)'s status on Sunday, 16-Apr-2023 00:26:44 JST Rui Seabra

     in reply to

     • w4tsn ~> :idle:

     @w4tsn well, in fact what it does is subscribe to org.gnome.SettingsDaemon.Smartcard and follows the removal of any token identified by the system as used for login. I don't know yet how it does that... I have pam_yubico in gdm and it seems to detect it like that, so any method that results in dbus being used in a way that GNOME detects it will work. In the code there is zero references to brands.

   • Embed this notice
     w4tsn ~> :idle: (w4tsn@darmstadt.social)'s status on Sunday, 16-Apr-2023 00:26:45 JST w4tsn ~> :idle:

     in reply to

     @RuiSeabra nice! That is really helpful. Is it compatible with arbitrary u2f/fido keys? In that case I might mention it in the next article on pam_u2f :)

   • Embed this notice
     Rui Seabra (ruiseabra@mastodon.social)'s status on Sunday, 16-Apr-2023 00:28:28 JST Rui Seabra

     in reply to

     • w4tsn ~> :idle:

     @w4tsn oh, I didn't know that exists, maybe I'll be able to try that and check whether pam_u2f would be recognized as such...

   • Embed this notice
     Rui Seabra (ruiseabra@mastodon.social)'s status on Sunday, 16-Apr-2023 00:31:10 JST Rui Seabra

     in reply to

     • w4tsn ~> :idle:

     @w4tsn But in my case using udev rules and pam_yubico in sudo resulted in immediate lock anytime I used sudo :( but I really liked the idea and had already wondered how hard it would be to do so, udev was easy to try but it was unusable with my setup, so I digged around until I found a way that worked.