dotfiles/dot_scripts/ansible/macsecure_playbook.yaml

---
    - hosts: localhost
      connection: local
      become_method: sudo
      become: yes

      tasks:
          - name: Check yubikey binaries are installed
            stat:
                path: '{{ item }}'
            with_items:
                - /usr/local/bin/ykpamcfg
                - /Applications/YubiKey Manager.app/Contents/MacOS/ykman

          - name: Check Yubico is recognized
            shell: "'/Applications/YubiKey Manager.app/Contents/MacOS/ykman' list | awk '{print $6}'"
            register: yubicoChallenge
            failed_when: yubicoChallenge.rc != 0 or yubicoChallenge.stdout == ''

          - name: Get current user
            become: false
            local_action: command whoami
            register: username_on_host

          - name: Check yubico challenge exists
            stat:
                path: /Users/{{ username_on_host.stdout }}/.yubico/challenge-{{ yubicoChallenge.stdout }}

          - name: Ensure yubikey is needed for authentication at login screen
            lineinfile:
                path: '{{ item }}'
                regexp: ^auth.*pam_yubico.so.*
                line: auth       required       /usr/local/lib/security/pam_yubico.so mode=challenge-response
                insertbefore: ^account    required       pam_opendirectory.so
            with_items:
                - /etc/pam.d/screensaver
                - /etc/pam.d/authorization

          - name: Ensure touch id is enough to authenticate with sudo
            lineinfile:
                path: '{{ item }}'
                regexp: ^auth.*sufficient.*pam_tid.so.*
                line: auth       sufficient     pam_tid.so
                insertafter: ^#.*
            with_items:
                - /etc/pam.d/sudo