Trezor recently upgraded the firmware for their handy devices to include U2F functionality. This is great for securing online resources, but what about using your Trezor and U2F to help secure Ubuntu/Mint workstations? Is it possible to add two factor authentication to things like MDM logins and sudo?
Warning
Be aware that if you mess things up, or don't have your Trezor handy after you finish configuring U2F on your workstation you'll be locked out. Caveat Emptor!
Update Reddit User /u/stickac adds:
Cool thing about TREZOR is that you can recover the seed used to generate U2F secret, so even if you lose TREZOR you can still log in to your machine after recovery (as opposed when using other U2F tokens).
See: https://doc.satoshilabs.com/trezor-user/recovery.html
Installation
You'll need your Trezor be be running firmware 1.4 or greater. See: https://blog.trezor.io/secure-two-factor-authentication-with-trezor-u2f-e940fd5a60af#.9ys8d47f3 for details. Once your Trezor is ready and you'll need to add U2F authentication as an option on your machine. To do so install the needed U2F packages by running:
$ sudo apt-get install libpam-u2f pamu2fcfg
U2F_Mappings File
Next you'll need to generate your U2F mappings file. Plug in your Trezor and run:
$ pamu2fcfg -u yourusername > /tmp/u2f_mappings
You'll need to confirm on your Trezor at this point.
Now move the u2f_mappings file into /etc:
$ sudo mv /tmp/u2f_mappings /etc/u2f_mappings
Configuring Pam to Use U2F
The u2f_mappings file you've put into /etc will be used by pam to add two factor authentication to your system by adding a couple of config lines to the appropriate pam files.
Here's some of the things you'll want to add U2F authentication to:
- sudo
- login
- su
- mdm, lightdm or gdm
- cinnamon-screensaver
You can see the various things on your system which require authentication by looking in /etc/pam.d/ If you're a hacker like me, you can try configuring U2F for other things using the information in this article. If you do, I suggest trying it out on a Virtual Machine first.
$ ls /etc/pam.d
Examples
Time to fire up your favorite text editor!
sudo
First add two factor authentication to the sudo command.
$ sudo emacs -nw /etc/pam.d/sudo
Add this at the end of the file:
# u2f authentication
auth required pam_u2f.so authfile=/etc/u2f_mappings cue
You can test at this point by firing up another terminal and running a sudo command. If you've done things correctly you'll be asked for your password and then prompted to "Please touch the device." Your Trezor will also be prompting you to authorize. Congratulations your system now requires your Trezor to run sudo. Pretty neat eh?
login
Next lets secure login. I don't want anyone besides me getting onto my system using a virtual console. If you're not aware of what this means check out: https://en.wikipedia.org/wiki/Virtual_console
$ sudo emacs -nw /etc/pam.d/login
Add this at the end of the file:
# u2f authentication
auth required pam_u2f.so authfile=/etc/u2f_mappings cue
Test by bringing up a virtual console. Again you'll be prompted to touch your Trezor after you've authenticated.
su
By now you should see what is being done here. Lets lock down the su command now: https://en.wikipedia.org/wiki/Su_(Unix)
$ sudo emacs -nw /etc/pam.d/su
Add this at the end of the file:
# u2f authentication
auth required pam_u2f.so authfile=/etc/u2f_mappings cue
You can test by running:
$ su yourusername
Conclusion
Be sure to add U2F authentication to your login and screen saver screens as well. I run GDM and Cinnamon, so I set up U2F for those. Again, see /etc/pam.d for the config files you'll need to tweak. As mentioned in Mike Jonesey's article, to really secure your install you should be running your disks fully encrypted, etc.
Happy Hacking!
Congratulations @shaneantyr! You have received a personal award!
Happy Birthday - 1 Year
Click on the badge to view your own Board of Honor on SteemitBoard.
For more information about this award, click here
Downvoting a post can decrease pending rewards and make it less visible. Common reasons:
Submit
Interesting thoughts
Downvoting a post can decrease pending rewards and make it less visible. Common reasons:
Submit
Congratulations @shaneantyr! You received a personal award!
You can view your badges on your Steem Board and compare to others on the Steem Ranking
Vote for @Steemitboard as a witness to get one more award and increased upvotes!
Downvoting a post can decrease pending rewards and make it less visible. Common reasons:
Submit