Split fido2 and fingerprint setups into setup and remove (#5670)
* Split fido2 and fingerprint setups into setup and remove Don't make one thing do two things * Extract helpers and clean up * No need to hide them * Don't need these
This commit is contained in:
David Heinemeier Hansson
@@ -53,6 +53,7 @@ GROUP_DESCRIPTIONS[npx]="NPX package wrappers"
|
||||
GROUP_DESCRIPTIONS[pkg]="Package management helpers"
|
||||
GROUP_DESCRIPTIONS[plymouth]="Plymouth boot theme management"
|
||||
GROUP_DESCRIPTIONS[powerprofiles]="Power profile management"
|
||||
GROUP_DESCRIPTIONS[echo]="Colored terminal output helpers"
|
||||
GROUP_DESCRIPTIONS[refresh]="Reset config to defaults"
|
||||
GROUP_DESCRIPTIONS[reinstall]="Reinstall and reset workflows"
|
||||
GROUP_DESCRIPTIONS[reminder]="Desktop notification reminders"
|
||||
|
||||
Executable
+9
@@ -0,0 +1,9 @@
|
||||
#!/bin/bash
|
||||
|
||||
# omarchy:summary=Print a failure message in red
|
||||
# omarchy:args=<message>
|
||||
|
||||
RED='\033[0;31m'
|
||||
NC='\033[0m'
|
||||
|
||||
echo -e "${RED}$*${NC}"
|
||||
Executable
+9
@@ -0,0 +1,9 @@
|
||||
#!/bin/bash
|
||||
|
||||
# omarchy:summary=Print an informational message in yellow
|
||||
# omarchy:args=<message>
|
||||
|
||||
YELLOW='\033[1;33m'
|
||||
NC='\033[0m'
|
||||
|
||||
echo -e "${YELLOW}$*${NC}"
|
||||
Executable
+9
@@ -0,0 +1,9 @@
|
||||
#!/bin/bash
|
||||
|
||||
# omarchy:summary=Print a success message in green
|
||||
# omarchy:args=<message>
|
||||
|
||||
GREEN='\033[0;32m'
|
||||
NC='\033[0m'
|
||||
|
||||
echo -e "${GREEN}$*${NC}"
|
||||
+12
-5
@@ -330,8 +330,8 @@ show_setup_power_menu() {
|
||||
|
||||
show_setup_security_menu() {
|
||||
case $(menu "Setup" " Fingerprint\n Fido2") in
|
||||
*Fingerprint*) present_terminal omarchy-setup-fingerprint ;;
|
||||
*Fido2*) present_terminal omarchy-setup-fido2 ;;
|
||||
*Fingerprint*) present_terminal omarchy-setup-security-fingerprint ;;
|
||||
*Fido2*) present_terminal omarchy-setup-security-fido2 ;;
|
||||
*) show_setup_menu ;;
|
||||
esac
|
||||
}
|
||||
@@ -644,7 +644,7 @@ show_install_elixir_menu() {
|
||||
}
|
||||
|
||||
show_remove_menu() {
|
||||
case $(menu "Remove" " Package\n Browser\n Web App\n TUI\n Development\n Gaming\n Preinstalls\n Dictation\n Theme\n Windows\n Fingerprint\n Fido2") in
|
||||
case $(menu "Remove" " Package\n Browser\n Web App\n TUI\n Development\n Gaming\n Preinstalls\n Dictation\n Theme\n Windows\n Security") in
|
||||
*Package*) terminal omarchy-pkg-remove ;;
|
||||
*Browser*) show_remove_browser_menu ;;
|
||||
*Web*) present_terminal omarchy-webapp-remove ;;
|
||||
@@ -655,12 +655,19 @@ show_remove_menu() {
|
||||
*Dictation*) present_terminal omarchy-voxtype-remove ;;
|
||||
*Theme*) present_terminal omarchy-theme-remove ;;
|
||||
*Windows*) present_terminal "omarchy-windows-vm remove" ;;
|
||||
*Fingerprint*) present_terminal "omarchy-setup-fingerprint --remove" ;;
|
||||
*Fido2*) present_terminal "omarchy-setup-fido2 --remove" ;;
|
||||
*Security*) show_remove_security_menu ;;
|
||||
*) show_main_menu ;;
|
||||
esac
|
||||
}
|
||||
|
||||
show_remove_security_menu() {
|
||||
case $(menu "Remove" " Fingerprint\n Fido2") in
|
||||
*Fingerprint*) present_terminal omarchy-remove-security-fingerprint ;;
|
||||
*Fido2*) present_terminal omarchy-remove-security-fido2 ;;
|
||||
*) show_remove_menu ;;
|
||||
esac
|
||||
}
|
||||
|
||||
show_remove_browser_menu() {
|
||||
case $(menu "Remove" " Chrome\n Edge\n Brave\n Brave Origin\n Firefox\n Zen") in
|
||||
*Chrome*) present_terminal "omarchy-remove-browser chrome" ;;
|
||||
|
||||
Executable
+35
@@ -0,0 +1,35 @@
|
||||
#!/bin/bash
|
||||
|
||||
# omarchy:summary=Remove FIDO2 authentication from sudo and polkit
|
||||
# omarchy:requires-sudo=true
|
||||
|
||||
set -e
|
||||
|
||||
|
||||
remove_pam_config() {
|
||||
# Remove from sudo
|
||||
if grep -q pam_u2f.so /etc/pam.d/sudo; then
|
||||
omarchy-echo-info "Removing FIDO2 authentication from sudo..."
|
||||
sudo sed -i '/pam_u2f\.so/d' /etc/pam.d/sudo
|
||||
fi
|
||||
|
||||
# Remove from polkit
|
||||
if [[ -f /etc/pam.d/polkit-1 ]] && grep -Fq 'pam_u2f.so' /etc/pam.d/polkit-1; then
|
||||
omarchy-echo-info "Removing FIDO2 authentication from polkit..."
|
||||
sudo sed -i '/pam_u2f\.so/d' /etc/pam.d/polkit-1
|
||||
fi
|
||||
}
|
||||
|
||||
omarchy-echo-success "Removing FIDO2 device from authentication.\n"
|
||||
|
||||
remove_pam_config
|
||||
|
||||
if [[ -d /etc/fido2 ]]; then
|
||||
omarchy-echo-info "Removing FIDO2 configuration..."
|
||||
sudo rm -rf /etc/fido2
|
||||
fi
|
||||
|
||||
omarchy-echo-info "Removing FIDO2 packages..."
|
||||
omarchy-pkg-drop libfido2 pam-u2f
|
||||
|
||||
omarchy-echo-success "FIDO2 authentication has been completely removed."
|
||||
Executable
+37
@@ -0,0 +1,37 @@
|
||||
#!/bin/bash
|
||||
|
||||
# omarchy:summary=Remove fingerprint authentication from sudo, polkit, and lock screen
|
||||
# omarchy:requires-sudo=true
|
||||
|
||||
set -e
|
||||
|
||||
|
||||
remove_pam_config() {
|
||||
# Remove from sudo
|
||||
if grep -q pam_fprintd.so /etc/pam.d/sudo; then
|
||||
omarchy-echo-info "Removing fingerprint authentication from sudo..."
|
||||
sudo sed -i '/pam_fprintd\.so/d' /etc/pam.d/sudo
|
||||
fi
|
||||
|
||||
# Remove from polkit
|
||||
if [[ -f /etc/pam.d/polkit-1 ]] && grep -Fq 'pam_fprintd.so' /etc/pam.d/polkit-1; then
|
||||
omarchy-echo-info "Removing fingerprint authentication from polkit..."
|
||||
sudo sed -i '/pam_fprintd\.so/d' /etc/pam.d/polkit-1
|
||||
fi
|
||||
}
|
||||
|
||||
remove_hyprlock_fingerprint_icon() {
|
||||
omarchy-echo-info "Removing fingerprint icon from hyprlock placeholder text..."
|
||||
sed -i 's/placeholder_text = .*/placeholder_text = Enter Password/' ~/.config/hypr/hyprlock.conf
|
||||
sed -i 's/fingerprint:enabled = .*/fingerprint:enabled = false/' ~/.config/hypr/hyprlock.conf
|
||||
}
|
||||
|
||||
omarchy-echo-success "Removing fingerprint scanner from authentication.\n"
|
||||
|
||||
remove_pam_config
|
||||
remove_hyprlock_fingerprint_icon
|
||||
|
||||
omarchy-echo-info "Removing fingerprint packages..."
|
||||
omarchy-pkg-drop fprintd libfprint-git
|
||||
|
||||
omarchy-echo-success "Fingerprint authentication has been completely removed."
|
||||
@@ -1,131 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
# omarchy:summary=Set up or remove FIDO2 authentication for sudo and polkit
|
||||
# omarchy:args=[--remove]
|
||||
# omarchy:requires-sudo=true
|
||||
|
||||
set -e
|
||||
|
||||
GREEN='\033[0;32m'
|
||||
RED='\033[0;31m'
|
||||
YELLOW='\033[1;33m'
|
||||
NC='\033[0m' # No Color
|
||||
|
||||
print_success() {
|
||||
echo -e "${GREEN}$1${NC}"
|
||||
}
|
||||
|
||||
print_error() {
|
||||
echo -e "${RED}$1${NC}"
|
||||
}
|
||||
|
||||
print_info() {
|
||||
echo -e "${YELLOW}$1${NC}"
|
||||
}
|
||||
|
||||
check_fido2_hardware() {
|
||||
tokens=$(fido2-token -L 2>/dev/null)
|
||||
if [[ -z $tokens ]]; then
|
||||
print_error "\nNo FIDO2 device detected. Please plug it in (you may need to unlock it as well)."
|
||||
return 1
|
||||
fi
|
||||
return 0
|
||||
}
|
||||
|
||||
setup_pam_config() {
|
||||
# Configure sudo
|
||||
if ! grep -q pam_u2f.so /etc/pam.d/sudo; then
|
||||
print_info "Configuring sudo for FIDO2 authentication..."
|
||||
sudo sed -i '1i auth sufficient pam_u2f.so cue authfile=/etc/fido2/fido2' /etc/pam.d/sudo
|
||||
fi
|
||||
|
||||
# Configure polkit
|
||||
if [[ -f /etc/pam.d/polkit-1 ]] && ! grep -q 'pam_u2f.so' /etc/pam.d/polkit-1; then
|
||||
print_info "Configuring polkit for FIDO2 authentication..."
|
||||
sudo sed -i '1i auth sufficient pam_u2f.so cue authfile=/etc/fido2/fido2' /etc/pam.d/polkit-1
|
||||
elif [[ ! -f /etc/pam.d/polkit-1 ]]; then
|
||||
print_info "Creating polkit configuration with FIDO2 authentication..."
|
||||
sudo tee /etc/pam.d/polkit-1 >/dev/null <<'EOF'
|
||||
auth sufficient pam_u2f.so cue authfile=/etc/fido2/fido2
|
||||
auth required pam_unix.so
|
||||
|
||||
account required pam_unix.so
|
||||
password required pam_unix.so
|
||||
session required pam_unix.so
|
||||
EOF
|
||||
fi
|
||||
}
|
||||
|
||||
remove_pam_config() {
|
||||
# Remove from sudo
|
||||
if grep -q pam_u2f.so /etc/pam.d/sudo; then
|
||||
print_info "Removing FIDO2 authentication from sudo..."
|
||||
sudo sed -i '/pam_u2f\.so/d' /etc/pam.d/sudo
|
||||
fi
|
||||
|
||||
# Remove from polkit
|
||||
if [[ -f /etc/pam.d/polkit-1 ]] && grep -Fq 'pam_u2f.so' /etc/pam.d/polkit-1; then
|
||||
print_info "Removing FIDO2 authentication from polkit..."
|
||||
sudo sed -i '/pam_u2f\.so/d' /etc/pam.d/polkit-1
|
||||
fi
|
||||
}
|
||||
|
||||
if [[ "--remove" == $1 ]]; then
|
||||
print_success "Removing FIDO2 device from authentication.\n"
|
||||
|
||||
# Remove PAM configuration
|
||||
remove_pam_config
|
||||
|
||||
# Remove FIDO2 configuration
|
||||
if [[ -d /etc/fido2 ]]; then
|
||||
print_info "Removing FIDO2 configuration..."
|
||||
sudo rm -rf /etc/fido2
|
||||
fi
|
||||
|
||||
# Uninstall packages
|
||||
print_info "Removing FIDO2 packages..."
|
||||
sudo pacman -Rns --noconfirm libfido2 pam-u2f
|
||||
|
||||
print_success "FIDO2 authentication has been completely removed."
|
||||
else
|
||||
print_success "Setting up FIDO2 device for authentication.\n"
|
||||
|
||||
# Install required packages
|
||||
print_info "Installing required packages..."
|
||||
omarchy-pkg-add libfido2 pam-u2f
|
||||
|
||||
if ! check_fido2_hardware; then
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Create the pamu2fcfg file
|
||||
if [[ ! -f /etc/fido2/fido2 ]]; then
|
||||
sudo mkdir -p /etc/fido2
|
||||
print_success "\nLet's setup your device by confirming on the device now."
|
||||
print_info "Touch your FIDO2 key when it lights up...\n"
|
||||
|
||||
if pamu2fcfg >/tmp/fido2; then
|
||||
sudo mv /tmp/fido2 /etc/fido2/fido2
|
||||
print_success "FIDO2 device registered successfully!"
|
||||
else
|
||||
print_error "\nFIDO2 registration failed. Please try again."
|
||||
exit 1
|
||||
fi
|
||||
else
|
||||
print_info "FIDO2 device already registered."
|
||||
fi
|
||||
|
||||
# Configure PAM
|
||||
setup_pam_config
|
||||
|
||||
# Test with sudo
|
||||
print_info "\nTesting FIDO2 authentication with sudo..."
|
||||
print_info "Touch your FIDO2 key when prompted.\n"
|
||||
|
||||
if sudo echo "FIDO2 authentication test successful"; then
|
||||
print_success "\nPerfect! FIDO2 authentication is now configured."
|
||||
print_info "You can use your FIDO2 key for sudo and polkit authentication."
|
||||
else
|
||||
print_error "\nVerification failed. You may want to check your configuration."
|
||||
fi
|
||||
fi
|
||||
@@ -1,161 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
# omarchy:summary=Set up or remove fingerprint authentication for sudo, polkit, and lock screen
|
||||
# omarchy:args=[--remove]
|
||||
# omarchy:requires-sudo=true
|
||||
|
||||
set -e
|
||||
|
||||
GREEN='\033[0;32m'
|
||||
RED='\033[0;31m'
|
||||
YELLOW='\033[1;33m'
|
||||
NC='\033[0m' # No Color
|
||||
|
||||
print_success() {
|
||||
echo -e "${GREEN}$1${NC}"
|
||||
}
|
||||
|
||||
print_error() {
|
||||
echo -e "${RED}$1${NC}"
|
||||
}
|
||||
|
||||
print_info() {
|
||||
echo -e "${YELLOW}$1${NC}"
|
||||
}
|
||||
|
||||
check_fingerprint_hardware() {
|
||||
# Get fingerprint devices for the user
|
||||
devices=$(fprintd-list "$USER" 2>/dev/null)
|
||||
|
||||
# Exit if no devices found
|
||||
if [[ -z $devices ]]; then
|
||||
print_error "\nNo fingerprint sensor detected."
|
||||
return 1
|
||||
fi
|
||||
return 0
|
||||
}
|
||||
|
||||
setup_pam_config() {
|
||||
# Configure sudo
|
||||
if ! grep -q pam_fprintd.so /etc/pam.d/sudo; then
|
||||
print_info "Configuring sudo for fingerprint authentication..."
|
||||
sudo sed -i '1i auth sufficient pam_fprintd.so' /etc/pam.d/sudo
|
||||
fi
|
||||
|
||||
# Configure polkit
|
||||
if [[ -f /etc/pam.d/polkit-1 ]] && ! grep -q 'pam_fprintd.so' /etc/pam.d/polkit-1; then
|
||||
print_info "Configuring polkit for fingerprint authentication..."
|
||||
sudo sed -i '1i auth sufficient pam_fprintd.so' /etc/pam.d/polkit-1
|
||||
elif [[ ! -f /etc/pam.d/polkit-1 ]]; then
|
||||
print_info "Creating polkit configuration with fingerprint authentication..."
|
||||
sudo tee /etc/pam.d/polkit-1 >/dev/null <<'EOF'
|
||||
auth sufficient pam_fprintd.so
|
||||
auth required pam_unix.so
|
||||
|
||||
account required pam_unix.so
|
||||
password required pam_unix.so
|
||||
session required pam_unix.so
|
||||
EOF
|
||||
fi
|
||||
}
|
||||
|
||||
add_hyprlock_fingerprint_icon() {
|
||||
print_info "Adding fingerprint icon to hyprlock placeholder text..."
|
||||
sed -i 's/placeholder_text = .*/placeholder_text = <span> Enter Password <\/span>/' ~/.config/hypr/hyprlock.conf
|
||||
sed -i 's/fingerprint:enabled = .*/fingerprint:enabled = true/' ~/.config/hypr/hyprlock.conf
|
||||
}
|
||||
|
||||
remove_hyprlock_fingerprint_icon() {
|
||||
print_info "Removing fingerprint icon from hyprlock placeholder text..."
|
||||
sed -i 's/placeholder_text = .*/placeholder_text = Enter Password/' ~/.config/hypr/hyprlock.conf
|
||||
sed -i 's/fingerprint:enabled = .*/fingerprint:enabled = false/' ~/.config/hypr/hyprlock.conf
|
||||
}
|
||||
|
||||
remove_pam_config() {
|
||||
# Remove from sudo
|
||||
if grep -q pam_fprintd.so /etc/pam.d/sudo; then
|
||||
print_info "Removing fingerprint authentication from sudo..."
|
||||
sudo sed -i '/pam_fprintd\.so/d' /etc/pam.d/sudo
|
||||
fi
|
||||
|
||||
# Remove from polkit
|
||||
if [[ -f /etc/pam.d/polkit-1 ]] && grep -Fq 'pam_fprintd.so' /etc/pam.d/polkit-1; then
|
||||
print_info "Removing fingerprint authentication from polkit..."
|
||||
sudo sed -i '/pam_fprintd\.so/d' /etc/pam.d/polkit-1
|
||||
fi
|
||||
}
|
||||
|
||||
if [[ "--remove" == $1 ]]; then
|
||||
print_success "Removing fingerprint scanner from authentication.\n"
|
||||
|
||||
# Remove PAM configuration
|
||||
remove_pam_config
|
||||
|
||||
# Remove fingerprint icon from hyprlock placeholder text
|
||||
remove_hyprlock_fingerprint_icon
|
||||
|
||||
# Uninstall packages
|
||||
print_info "Removing fingerprint packages..."
|
||||
sudo pacman -Rns --noconfirm fprintd
|
||||
|
||||
print_success "Fingerprint authentication has been completely removed."
|
||||
else
|
||||
print_success "Setting up fingerprint scanner for authentication.\n"
|
||||
|
||||
# Install required packages
|
||||
print_info "Installing required packages..."
|
||||
|
||||
# ASUS ExpertBook B9406CAA ships a FocalTech FT9349 ESS reader (USB
|
||||
# 2808:a97a). Mainline libfprint at 1.94.x lacks the focaltech_moc
|
||||
# driver (and its 0xa97a id_table entry); OPR ships libfprint-git
|
||||
# which carries both. Once upstream catches up, this branch is a
|
||||
# no-op and `libfprint-git` provides=libfprint anyway. Detect via
|
||||
# /sys to avoid depending on usbutils being installed first.
|
||||
for v in /sys/bus/usb/devices/*/idVendor; do
|
||||
[[ "$(cat "$v" 2>/dev/null)" == "2808" ]] || continue
|
||||
[[ "$(cat "${v%idVendor}idProduct" 2>/dev/null)" == "a97a" ]] || continue
|
||||
print_info "FocalTech FT9349 detected (B9406CAA) — using libfprint-git from OPR..."
|
||||
# libfprint-git provides+conflicts libfprint; pacman -S --noconfirm
|
||||
# defaults the conflict prompt to N and aborts. Pre-remove libfprint
|
||||
# with -Rdd so the install goes silent. -Rdd (not omarchy-pkg-drop's
|
||||
# -Rns) is required because fprintd requires libfprint; the dep is
|
||||
# re-satisfied immediately by libfprint-git's provides=libfprint.
|
||||
if omarchy-pkg-present libfprint; then
|
||||
sudo pacman -Rdd --noconfirm libfprint
|
||||
fi
|
||||
omarchy-pkg-add libfprint-git
|
||||
break
|
||||
done
|
||||
|
||||
omarchy-pkg-add fprintd usbutils
|
||||
|
||||
if ! check_fingerprint_hardware; then
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Configure PAM
|
||||
setup_pam_config
|
||||
|
||||
# Add fingerprint icon to hyprlock placeholder text
|
||||
add_hyprlock_fingerprint_icon
|
||||
|
||||
# Enroll first fingerprint
|
||||
print_success "\nLet's setup your right index finger as the first fingerprint."
|
||||
print_info "Keep moving the finger around on sensor until the process completes.\n"
|
||||
|
||||
if sudo fprintd-enroll "$USER"; then
|
||||
print_success "\nFingerprint enrolled successfully!"
|
||||
|
||||
# Verify
|
||||
print_info "\nNow let's verify that it's working correctly.\n"
|
||||
if fprintd-verify; then
|
||||
print_success "\nPerfect! Fingerprint authentication is now configured."
|
||||
print_info "You can use your fingerprint for sudo, polkit, and lock screen (Super + Escape)."
|
||||
else
|
||||
print_error "\nVerification failed. You may want to try enrolling again."
|
||||
fi
|
||||
else
|
||||
print_error "\nEnrollment failed. Please try again."
|
||||
exit 1
|
||||
fi
|
||||
fi
|
||||
Executable
+81
@@ -0,0 +1,81 @@
|
||||
#!/bin/bash
|
||||
|
||||
# omarchy:summary=Set up FIDO2 authentication for sudo and polkit
|
||||
# omarchy:requires-sudo=true
|
||||
|
||||
set -e
|
||||
|
||||
|
||||
check_fido2_hardware() {
|
||||
tokens=$(fido2-token -L 2>/dev/null)
|
||||
if [[ -z $tokens ]]; then
|
||||
omarchy-echo-failure "\nNo FIDO2 device detected. Please plug it in (you may need to unlock it as well)."
|
||||
return 1
|
||||
fi
|
||||
return 0
|
||||
}
|
||||
|
||||
setup_pam_config() {
|
||||
# Configure sudo
|
||||
if ! grep -q pam_u2f.so /etc/pam.d/sudo; then
|
||||
omarchy-echo-info "Configuring sudo for FIDO2 authentication..."
|
||||
sudo sed -i '1i auth sufficient pam_u2f.so cue authfile=/etc/fido2/fido2' /etc/pam.d/sudo
|
||||
fi
|
||||
|
||||
# Configure polkit
|
||||
if [[ -f /etc/pam.d/polkit-1 ]] && ! grep -q 'pam_u2f.so' /etc/pam.d/polkit-1; then
|
||||
omarchy-echo-info "Configuring polkit for FIDO2 authentication..."
|
||||
sudo sed -i '1i auth sufficient pam_u2f.so cue authfile=/etc/fido2/fido2' /etc/pam.d/polkit-1
|
||||
elif [[ ! -f /etc/pam.d/polkit-1 ]]; then
|
||||
omarchy-echo-info "Creating polkit configuration with FIDO2 authentication..."
|
||||
sudo tee /etc/pam.d/polkit-1 >/dev/null <<'EOF'
|
||||
auth sufficient pam_u2f.so cue authfile=/etc/fido2/fido2
|
||||
auth required pam_unix.so
|
||||
|
||||
account required pam_unix.so
|
||||
password required pam_unix.so
|
||||
session required pam_unix.so
|
||||
EOF
|
||||
fi
|
||||
}
|
||||
|
||||
omarchy-echo-success "Setting up FIDO2 device for authentication.\n"
|
||||
|
||||
# Install required packages
|
||||
omarchy-echo-info "Installing required packages..."
|
||||
omarchy-pkg-add libfido2 pam-u2f
|
||||
|
||||
if ! check_fido2_hardware; then
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Create the pamu2fcfg file
|
||||
if [[ ! -f /etc/fido2/fido2 ]]; then
|
||||
sudo mkdir -p /etc/fido2
|
||||
omarchy-echo-success "\nLet's setup your device by confirming on the device now."
|
||||
omarchy-echo-info "Touch your FIDO2 key when it lights up...\n"
|
||||
|
||||
if pamu2fcfg >/tmp/fido2; then
|
||||
sudo mv /tmp/fido2 /etc/fido2/fido2
|
||||
omarchy-echo-success "FIDO2 device registered successfully!"
|
||||
else
|
||||
omarchy-echo-failure "\nFIDO2 registration failed. Please try again."
|
||||
exit 1
|
||||
fi
|
||||
else
|
||||
omarchy-echo-info "FIDO2 device already registered."
|
||||
fi
|
||||
|
||||
# Configure PAM
|
||||
setup_pam_config
|
||||
|
||||
# Test with sudo
|
||||
omarchy-echo-info "\nTesting FIDO2 authentication with sudo..."
|
||||
omarchy-echo-info "Touch your FIDO2 key when prompted.\n"
|
||||
|
||||
if sudo echo "FIDO2 authentication test successful"; then
|
||||
omarchy-echo-success "\nPerfect! FIDO2 authentication is now configured."
|
||||
omarchy-echo-info "You can use your FIDO2 key for sudo and polkit authentication."
|
||||
else
|
||||
omarchy-echo-failure "\nVerification failed. You may want to check your configuration."
|
||||
fi
|
||||
Executable
+95
@@ -0,0 +1,95 @@
|
||||
#!/bin/bash
|
||||
|
||||
# omarchy:summary=Set up fingerprint authentication for sudo, polkit, and lock screen
|
||||
# omarchy:requires-sudo=true
|
||||
|
||||
set -e
|
||||
|
||||
|
||||
check_fingerprint_hardware() {
|
||||
# Get fingerprint devices for the user
|
||||
devices=$(fprintd-list "$USER" 2>/dev/null)
|
||||
|
||||
# Exit if no devices found
|
||||
if [[ -z $devices ]]; then
|
||||
omarchy-echo-failure "\nNo fingerprint sensor detected."
|
||||
return 1
|
||||
fi
|
||||
return 0
|
||||
}
|
||||
|
||||
setup_pam_config() {
|
||||
# Configure sudo
|
||||
if ! grep -q pam_fprintd.so /etc/pam.d/sudo; then
|
||||
omarchy-echo-info "Configuring sudo for fingerprint authentication..."
|
||||
sudo sed -i '1i auth sufficient pam_fprintd.so' /etc/pam.d/sudo
|
||||
fi
|
||||
|
||||
# Configure polkit
|
||||
if [[ -f /etc/pam.d/polkit-1 ]] && ! grep -q 'pam_fprintd.so' /etc/pam.d/polkit-1; then
|
||||
omarchy-echo-info "Configuring polkit for fingerprint authentication..."
|
||||
sudo sed -i '1i auth sufficient pam_fprintd.so' /etc/pam.d/polkit-1
|
||||
elif [[ ! -f /etc/pam.d/polkit-1 ]]; then
|
||||
omarchy-echo-info "Creating polkit configuration with fingerprint authentication..."
|
||||
sudo tee /etc/pam.d/polkit-1 >/dev/null <<'EOF'
|
||||
auth sufficient pam_fprintd.so
|
||||
auth required pam_unix.so
|
||||
|
||||
account required pam_unix.so
|
||||
password required pam_unix.so
|
||||
session required pam_unix.so
|
||||
EOF
|
||||
fi
|
||||
}
|
||||
|
||||
add_hyprlock_fingerprint_icon() {
|
||||
omarchy-echo-info "Adding fingerprint icon to hyprlock placeholder text..."
|
||||
sed -i 's/placeholder_text = .*/placeholder_text = <span> Enter Password <\/span>/' ~/.config/hypr/hyprlock.conf
|
||||
sed -i 's/fingerprint:enabled = .*/fingerprint:enabled = true/' ~/.config/hypr/hyprlock.conf
|
||||
}
|
||||
|
||||
omarchy-echo-success "Setting up fingerprint scanner for authentication.\n"
|
||||
|
||||
# Install required packages
|
||||
omarchy-echo-info "Installing required packages..."
|
||||
|
||||
# libfprint-git provides+conflicts libfprint; pacman -S --noconfirm
|
||||
# defaults the conflict prompt to N and aborts. Pre-remove libfprint
|
||||
# with -Rdd so the install goes silent. -Rdd (not omarchy-pkg-drop's
|
||||
# -Rns) is required because fprintd requires libfprint; the dep is
|
||||
# re-satisfied immediately by libfprint-git's provides=libfprint.
|
||||
if omarchy-pkg-present libfprint; then
|
||||
sudo pacman -Rdd --noconfirm libfprint
|
||||
fi
|
||||
|
||||
omarchy-pkg-add libfprint-git fprintd usbutils
|
||||
|
||||
if ! check_fingerprint_hardware; then
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Configure PAM
|
||||
setup_pam_config
|
||||
|
||||
# Add fingerprint icon to hyprlock placeholder text
|
||||
add_hyprlock_fingerprint_icon
|
||||
|
||||
# Enroll first fingerprint
|
||||
omarchy-echo-success "\nLet's setup your right index finger as the first fingerprint."
|
||||
omarchy-echo-info "Keep moving the finger around on sensor until the process completes.\n"
|
||||
|
||||
if sudo fprintd-enroll "$USER"; then
|
||||
omarchy-echo-success "\nFingerprint enrolled successfully!"
|
||||
|
||||
# Verify
|
||||
omarchy-echo-info "\nNow let's verify that it's working correctly.\n"
|
||||
if fprintd-verify; then
|
||||
omarchy-echo-success "\nPerfect! Fingerprint authentication is now configured."
|
||||
omarchy-echo-info "You can use your fingerprint for sudo, polkit, and lock screen (Super + Escape)."
|
||||
else
|
||||
omarchy-echo-failure "\nVerification failed. You may want to try enrolling again."
|
||||
fi
|
||||
else
|
||||
omarchy-echo-failure "\nEnrollment failed. Please try again."
|
||||
exit 1
|
||||
fi
|
||||
Reference in New Issue
Block a user