Use touch id for sudo + yubico for login screen
This commit is contained in:
parent
620f2aa909
commit
614c6205dd
@ -49,3 +49,6 @@ pip3 install boto3
|
||||
pip3 install awscli
|
||||
pip3 install pipenv
|
||||
```
|
||||
|
||||
### If Yubico is installed, run this :
|
||||
`sudo ansible-playbook ~/Code/dotfiles/mac_playbook.yaml`
|
||||
|
@ -4,9 +4,21 @@
|
||||
become_method: sudo
|
||||
become: yes
|
||||
tasks:
|
||||
- name: Ensure yubikey is needed for authentication
|
||||
- name: Ensure yubikey is needed for authentication at login screen
|
||||
lineinfile:
|
||||
path: /etc/pam.d/authorization
|
||||
path: "{{ item }}"
|
||||
regexp: '^auth.*pam_yubico.so.*'
|
||||
line: "auth required /usr/local/lib/security/pam_yubico.so mode=challenge-response"
|
||||
insertbefore: "^account required pam_opendirectory.so"
|
||||
with_items:
|
||||
- /etc/pam.d/screensaver
|
||||
- /etc/pam.d/authorization
|
||||
|
||||
- name: Ensure touch id is enough to authenticate with sudo
|
||||
lineinfile:
|
||||
path: "{{ item }}"
|
||||
regexp: '^auth.*sufficient.*pam_tid.so.*'
|
||||
line: "auth sufficient pam_tid.so"
|
||||
insertafter: "^#.*"
|
||||
with_items:
|
||||
- /etc/pam.d/sudo
|
||||
|
Loading…
Reference in New Issue
Block a user