Use touch id for sudo + yubico for login screen

This commit is contained in:
Morgan Wattiez 2019-06-22 19:06:28 +02:00
parent 620f2aa909
commit 614c6205dd
2 changed files with 17 additions and 2 deletions

View File

@ -49,3 +49,6 @@ pip3 install boto3
pip3 install awscli
pip3 install pipenv
```
### If Yubico is installed, run this :
`sudo ansible-playbook ~/Code/dotfiles/mac_playbook.yaml`

View File

@ -4,9 +4,21 @@
become_method: sudo
become: yes
tasks:
- name: Ensure yubikey is needed for authentication
- name: Ensure yubikey is needed for authentication at login screen
lineinfile:
path: /etc/pam.d/authorization
path: "{{ item }}"
regexp: '^auth.*pam_yubico.so.*'
line: "auth required /usr/local/lib/security/pam_yubico.so mode=challenge-response"
insertbefore: "^account required pam_opendirectory.so"
with_items:
- /etc/pam.d/screensaver
- /etc/pam.d/authorization
- name: Ensure touch id is enough to authenticate with sudo
lineinfile:
path: "{{ item }}"
regexp: '^auth.*sufficient.*pam_tid.so.*'
line: "auth sufficient pam_tid.so"
insertafter: "^#.*"
with_items:
- /etc/pam.d/sudo