Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix syntax errors #229

Merged
merged 7 commits into from
Apr 8, 2024
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 0 additions & 2 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -23,8 +23,6 @@

- Relative paths (also included and double included) are always evaluated from the path of the final including page. Images within pages that are included elsewhere must therefore always be specified with an absolute path starting with `/` which stands for the root directory of the document.

- add the ToC for local headings in `/$product/$platform/*.rst` with `.. include:: ./product_platform_heading.rst`

- After each commit, the CI pushes translations automatically. Therefore always do `git pull` before `git commit ...`

- More information about RST:
Expand Down
2 changes: 1 addition & 1 deletion conf.py
Original file line number Diff line number Diff line change
Expand Up @@ -72,7 +72,7 @@
# List of patterns, relative to source directory, that match files and
# directories to ignore when looking for source files.
# This pattern also affects html_static_path and html_extra_path.
exclude_patterns = ['venv/*', 'nethsm/_*.rst', '*/*/product_platform_heading.rst', 'to-be-integrated.rst']
exclude_patterns = ['venv/*', 'nethsm/_*.rst', 'to-be-integrated.rst']

# The name of the Pygments (syntax highlighting) style to use.
#pygments_style = "solarizeddark"
Expand Down
2 changes: 0 additions & 2 deletions fido2/2fa-odoo.rst.inc
Original file line number Diff line number Diff line change
@@ -1,8 +1,6 @@
Two-Factor Authentication For ERP Software Odoo
===============================================

.. include:: ./product_platform_heading.rst

.. only:: comment

.. contents:: :local:
Expand Down
211 changes: 106 additions & 105 deletions fido2/linux/desktop-login.rst
Original file line number Diff line number Diff line change
@@ -1,8 +1,6 @@
Desktop Login And Linux User Authentication
===========================================

.. include:: ./product_platform_heading.rst

.. contents:: :local:

Introduction
Expand Down Expand Up @@ -30,207 +28,210 @@ GUI Method

1. **In the lower left corner click on** ``Show Applications`` **and type settings in the search bar as following:**

.. figure:: /fido2/linux/images/fidou2f-1.png
:alt: img1
.. figure:: /fido2/linux/images/fidou2f-1.png
:alt: img1

2. **Scroll down in the right bar to** ``Users``

.. figure:: /fido2/linux/images/fidou2f-2.png
:alt: img2
.. figure:: /fido2/linux/images/fidou2f-2.png
:alt: img2

3. **In the left corner click on** ``Unlock`` **and that would prompt for your
password**

.. figure:: /fido2/linux/images/fidou2f-3.png
:alt: img3
.. figure:: /fido2/linux/images/fidou2f-3.png
:alt: img3

4. **Select** ``Administrator`` **and enter the user name and password of your
choice**

.. figure:: /fido2/linux/images/fidou2f-4.png
:alt: img4
.. figure:: /fido2/linux/images/fidou2f-4.png
:alt: img4

5. **Once you finish Step 4 you should be done**

.. figure:: /fido2/linux/images/fidou2f-5.png
:alt: img5
.. figure:: /fido2/linux/images/fidou2f-5.png
:alt: img5

CLI Method
''''''''''

1. **Create a backup user and give it root privileges**

You can do so by using these commands:
You can do so by using these commands:

.. code-block:: bash
.. rstcheck: ignore-next-code-block
.. code-block:: bash

$ sudo adduser <backup_user>
$ sudo usermod -aG sudo <backup_user>
$ sudo adduser <backup_user>
$ sudo usermod -aG sudo <backup_user>

In case you prefer to setup U2F for a single user, and are locked out of your
user session, you would still be able to login with the ``<backup_user>``, and
proceed with the maintenance.
In case you prefer to setup U2F for a single user, and are locked out of your
user session, you would still be able to login with the ``<backup_user>``, and
proceed with the maintenance.

.. warning::
.. warning::

The following guide can potentially lock you out of your computer.
You should be aware of these risks, as it is recommended to first use
the instructions below on a secondary computer, or after a full
backup.
The following guide can potentially lock you out of your computer.
You should be aware of these risks, as it is recommended to first use
the instructions below on a secondary computer, or after a full
backup.

You might lose access to your data after configuring `PAM
modules <https://www.man7.org/linux/man-pages/man8/pam.8.html>`__.
You might lose access to your data after configuring `PAM
modules <https://www.man7.org/linux/man-pages/man8/pam.8.html>`__.


2. **Set up the** ``rules`` **to recognize the Nitrokey FIDO2**

Under ``/etc/udev/rules.d`` download ``41-nitrokey.rules``
Under ``/etc/udev/rules.d`` download ``41-nitrokey.rules``

.. code-block:: bash
.. code-block:: bash

$ cd /etc/udev/rules.d/
$ sudo wget https://raw.githubusercontent.com/Nitrokey/libnitrokey/master/data/41-nitrokey.rules
$ cd /etc/udev/rules.d/
$ sudo wget https://raw.githubusercontent.com/Nitrokey/libnitrokey/master/data/41-nitrokey.rules

And restart ``udev`` service
And restart ``udev`` service

.. code-block:: bash
.. code-block:: bash

$ sudo systemctl restart udev
$ sudo systemctl restart udev

3. **Install** ``libpam-u2f``

On Ubuntu 20.04 it is possible to download directly ``libpam-u2f`` from the official repos
On Ubuntu 20.04 it is possible to download directly ``libpam-u2f`` from the official repos

.. code-block:: bash
.. code-block:: bash

$ sudo apt install libpam-u2f
$ sudo apt install libpam-u2f

.. note::
.. note::

Click for more options
Click for more options

- Alternatively you can build ``libpam-u2f`` from
`Git <https://github.com/phoeagon/pam-u2f>`__.
- Alternatively you can build ``libpam-u2f`` from
`Git <https://github.com/phoeagon/pam-u2f>`__.

- To verify that the library is properly installed enter the
following command:
- To verify that the library is properly installed enter the
following command:

.. code-block:: bash
.. code-block:: bash

$ file /lib/x86_64-linux-gnu/security/pam_u2f.so
$ file /lib/x86_64-linux-gnu/security/pam_u2f.so

The Output should be something like the following:
The Output should be something like the following:

.. code-block:: bash
.. rstcheck: ignore-next-code-block
.. code-block:: bash

/lib/x86_64-linux-gnu/security/pam_u2f.so: \ ELF 64-bit LSB shared object, x86-64, version 1 (SYSV),\ dynamically linked, BuildID[sha1]=1d55e1b11a97be2038c6a139579f6c0d91caedb1, stripped
/lib/x86_64-linux-gnu/security/pam_u2f.so: \ ELF 64-bit LSB shared object, x86-64, version 1 (SYSV),\ dynamically linked, BuildID[sha1]=1d55e1b11a97be2038c6a139579f6c0d91caedb1, stripped

4. **Prepare the Directory**

Create ``.config/Nitrokey/`` under your home directory
Create ``.config/Nitrokey/`` under your home directory

.. code-block:: bash
.. code-block:: bash

$ mkdir ~/.config/Nitrokey
$ mkdir ~/.config/Nitrokey

And plug your Nitrokey FIDO2.
And plug your Nitrokey FIDO2.

Once done with the preparation, we can start to configure the computer to use the Nitrokey FIDO2 for 2nd factor authentication at login and ``sudo``.
Once done with the preparation, we can start to configure the computer to use the Nitrokey FIDO2 for 2nd factor authentication at login and ``sudo``.

5. **Generate the U2F config file**

To generate the configuration file we will use the ``pamu2fcfg`` utility that comes with the ``libpam-u2f``. For convenience, we will directly write the output of the utility to the ``u2f_keys`` file under ``.config/Nitrokey``. First plug your Nitrokey FIDO2 (if you did not already), and enter the following command:
To generate the configuration file we will use the ``pamu2fcfg`` utility that comes with the ``libpam-u2f``. For convenience, we will directly write the output of the utility to the ``u2f_keys`` file under ``.config/Nitrokey``. First plug your Nitrokey FIDO2 (if you did not already), and enter the following command:

.. code-block:: bash
.. code-block:: bash

$ pamu2fcfg > ~/.config/Nitrokey/u2f_keys
$ pamu2fcfg > ~/.config/Nitrokey/u2f_keys

Once you run the command above, you will need to touch the key while it flashes. Once done, ``pamu2fcfg`` will append its output the ``u2f_keys`` in the following format:
Once you run the command above, you will need to touch the key while it flashes. Once done, ``pamu2fcfg`` will append its output the ``u2f_keys`` in the following format:

.. code-block:: bash
.. code-block:: bash

<username>:Zx...mw,04...0a
<username>:Zx...mw,04...0a

Note, the output will be much longer, but sensitive parts have been removed here. For better security, and once the config file generated, we will move the ``.config/Nitrokey`` directory under the ``etc/``
directory with this command:
Note, the output will be much longer, but sensitive parts have been removed here. For better security, and once the config file generated, we will move the ``.config/Nitrokey`` directory under the ``etc/``
directory with this command:

.. code-block:: bash
.. code-block:: bash

$ sudo mv ~/.config/Nitrokey /etc
$ sudo mv ~/.config/Nitrokey /etc

.. tip::
.. tip::

- The file under ``.config/Nitrokey`` must be named ``u2f_keys``
- The file under ``.config/Nitrokey`` must be named ``u2f_keys``

- It is recommended to first test the instructions with a single
user. For this purpose the previous command takes the ``-u``
option, to specify a user, like in the example below:
- It is recommended to first test the instructions with a single
user. For this purpose the previous command takes the ``-u``
option, to specify a user, like in the example below:

.. code-block:: bash
.. rstcheck: ignore-next-code-block
.. code-block:: bash

$ pamu2fcfg -u <username> > ~/.config/Nitrokey/u2f_keys
$ pamu2fcfg -u <username> > ~/.config/Nitrokey/u2f_keys

- For individual user configuration you should point to the home
directory in the next step, or not include the ``authfile`` option
in the PAM configuration.
- For individual user configuration you should point to the home
directory in the next step, or not include the ``authfile`` option
in the PAM configuration.

6. **Backup**

This step is optional, however it is advised to have a backup Nitrokey in the case of loss, theft or destruction of your Nitrokey FIDO.
This step is optional, however it is advised to have a backup Nitrokey in the case of loss, theft or destruction of your Nitrokey FIDO.

To set up a backup key, repeat the procedure above, and use ``pamu2fcfg -n``. This will omit the ``<username>`` field, and the output can be appended to the line with your ``<username>`` like this:
To set up a backup key, repeat the procedure above, and use ``pamu2fcfg -n``. This will omit the ``<username>`` field, and the output can be appended to the line with your ``<username>`` like this:

.. code-block:: bash
.. code-block:: bash

<username>:Zx...mw,04...0a:xB...fw,04...3f
<username>:Zx...mw,04...0a:xB...fw,04...3f

7. **Modify the Pluggable Authentication Module** ``PAM``

The final step is configure the PAM module files under ``/etc/pam.d/``. In this guide we will modify the ``common-auth`` file as it handles the authentication settings which are common to all services, but other options are possible. You can modify the file with the following command:
The final step is configure the PAM module files under ``/etc/pam.d/``. In this guide we will modify the ``common-auth`` file as it handles the authentication settings which are common to all services, but other options are possible. You can modify the file with the following command:

.. code-block:: bash
.. code-block:: bash

$ cd /etc/pam.d
$ sudo $editor common-auth
$ cd /etc/pam.d
$ sudo $editor common-auth

And add the following lines:
And add the following lines:

.. code-block:: bash
.. code-block:: bash

#Nitrokey FIDO2 config
auth sufficient pam_u2f.so authfile=/etc/Nitrokey/u2f_keys cue prompt nouserok
#Nitrokey FIDO2 config
auth sufficient pam_u2f.so authfile=/etc/Nitrokey/u2f_keys cue prompt nouserok

.. tip::
.. tip::

- Since we are using Central Authentication Mapping, we need to tell
``pam_u2f`` the location of the file to use with the ``authfile``
option.
- Since we are using Central Authentication Mapping, we need to tell
``pam_u2f`` the location of the file to use with the ``authfile``
option.

- If you often forget to insert the key, ``prompt`` option make
``pam_u2f`` print ``Insert your U2F device, then press ENTER.``
and give you a chance to insert the Nitrokey.
- If you often forget to insert the key, ``prompt`` option make
``pam_u2f`` print ``Insert your U2F device, then press ENTER.``
and give you a chance to insert the Nitrokey.

- If you would like to be prompted to touch the Nitrokey, ``cue``
option will make ``pam_u2f`` print ``Please touch the device.``
message.
- If you would like to be prompted to touch the Nitrokey, ``cue``
option will make ``pam_u2f`` print ``Please touch the device.``
message.

- `nouserok` will ensure that you can still login using the username and
password, you might want to remove this at some point once the setup
is working and you don't want regular username & password based logins.
- `nouserok` will ensure that you can still login using the username and
password, you might want to remove this at some point once the setup
is working and you don't want regular username & password based logins.

Once we modified the ``common-auth``, we can save and exit the file.
Once we modified the ``common-auth``, we can save and exit the file.

You can test the configuration by typing ``sudo ls`` in the terminal. You should be prompted the message ``Please touch the device.`` and have a similar output on the terminal:
You can test the configuration by typing ``sudo ls`` in the terminal. You should be prompted the message ``Please touch the device.`` and have a similar output on the terminal:

.. code-block:: bash
.. code-block:: bash

nitrouser@nitrouser:~$ sudo ls
[sudo] password for nitrouser: Please touch the device.
nitrouser@nitrouser:~$ sudo ls
[sudo] password for nitrouser: Please touch the device.

You can also test your configuration by logging out of the user session and logging back. A similar screen should be displayed once you you unplug/replug yout Nitrokey FIDO2 and type your password:
You can also test your configuration by logging out of the user session and logging back. A similar screen should be displayed once you you unplug/replug yout Nitrokey FIDO2 and type your password:

.. figure:: /fido2/linux/images/u2f-fido-pam-2.png
:alt: img6
.. figure:: /fido2/linux/images/u2f-fido-pam-2.png
:alt: img6

Usage
-----
Expand Down
3 changes: 0 additions & 3 deletions fido2/linux/product_platform_heading.rst

This file was deleted.

3 changes: 0 additions & 3 deletions fido2/mac/product_platform_heading.rst

This file was deleted.

2 changes: 0 additions & 2 deletions fido2/shared/firmware-update.rst.inc
Original file line number Diff line number Diff line change
@@ -1,8 +1,6 @@
Firmware Update
===============

.. include:: ./product_platform_heading.rst

This guide describes how to update the firmware on the Nitrokey FIDO2.

.. important::
Expand Down
2 changes: 0 additions & 2 deletions fido2/shared/index-content2.rst.inc
Original file line number Diff line number Diff line change
@@ -1,8 +1,6 @@
Nitrokey Reset
--------------

.. include:: ./product_platform_heading.rst

.. contents:: :local:

Factory Reset operation regenerates the secret material stored on the Nitrokey FIDO U2F / Nitrokey FIDO2, which makes it a completely new key logic-side. New owner cannot use it to login to account of the previous one. In case of the FIDO2 Resident Keys the material is erased.
Expand Down
Loading
Loading