diff options
| author | makefu <github@syntax-fehler.de> | 2017-06-30 23:49:05 +0200 |
|---|---|---|
| committer | makefu <github@syntax-fehler.de> | 2017-06-30 23:49:05 +0200 |
| commit | 7cd2ff2679b688e8fa0c98bc9ecf1d99602c0421 (patch) | |
| tree | ed545eb1c08d53bad29fa08ea66369494d3c1f1e | |
| parent | d9cc50653d0c7998052284cfb66b2229e0ce849b (diff) | |
ma 2fa: init and enable for gum
| -rw-r--r-- | makefu/1systems/gum.nix | 3 | ||||
| -rw-r--r-- | makefu/2configs/sshd-totp.nix | 18 |
2 files changed, 21 insertions, 0 deletions
diff --git a/makefu/1systems/gum.nix b/makefu/1systems/gum.nix index 519313f57..6e57d1404 100644 --- a/makefu/1systems/gum.nix +++ b/makefu/1systems/gum.nix @@ -26,6 +26,9 @@ in { ../2configs/tinc/retiolum.nix ../2configs/urlwatch.nix + # Security + ../2configs/sshd-totp.nix + # Tools ../2configs/tools/core.nix ../2configs/tools/dev.nix diff --git a/makefu/2configs/sshd-totp.nix b/makefu/2configs/sshd-totp.nix new file mode 100644 index 000000000..f9984e245 --- /dev/null +++ b/makefu/2configs/sshd-totp.nix @@ -0,0 +1,18 @@ +{ pkgs, ... }: +# Enables second factor for ssh password login + +## Usage: +# gen-oath-safe <username> totp +## scan the qrcode with google authenticator (or FreeOTP) +## copy last line into secrets/<host>/users.oath (chmod 700) +{ + security.pam.oath = { + # enabling it will make it a requisite of `all` services + # enable = true; + digits = 6; + # TODO assert existing + usersFile = (toString <secrets>) + "/users.oath"; + }; + # I want TFA only active for sshd with password-auth + security.pam.services.sshd.oathAuth = true; +} |