3.4.1 Nastavenie pre použitie v rámci dvojstupňového overenia (2FA)

Aby sa kľúč dal použiť, je nutné rozšíriť udev pravidlá systému o pravidlá príznačné pre daný kľúč. Nasledovný postup popisuje kroky pre rozšírenie udev pravidiel prostredníctvom súboru udev pravidiel lib/udev/rules.d/70-u2f.rules poskytovaného balíkom libfido2 z modulu (gnu packages security-token) a pre pridanie vášho používateľského účtu do skupiny ‘"plugdev"’, ktorú využíva:

(use-package-modules ... security-token ...)
...
(operating-system
 ...
 (users (cons* (user-account
               (name "vas-pouzivatelsky-ucet")
               (group "users")
               (supplementary-groups
		'("wheel" "netdev" "audio" "video"
                  "plugdev"))           ;<- pridaná systémová skupina
               (home-directory "/home/vas-pouzivatelsky-ucet"))
              %base-user-accounts))
 ...
 (services
  (cons*
   ...
   (udev-rules-service 'fido2 libfido2 #:groups '("plugdev")))))

Znovunastavením systému a opätovným prihlásením do vášho grafického sedenia uplatníte členstvo vášho používateľského účtu v novej skupine. Potom môžete overiť použiteľnosť vášho kľúča spustením:

guix shell ungoogled-chromium -- chromium chrome://settings/securityKeys

a potvrdením, že bezpečnostný kľúč sa dá vynulovať v ponuke „Vynulovať váš bezpečnostný kľúč“. Ak to funguje, blahoželáme! Váš bezpečnostný kľúč je pripravený na použitie v aplikáciách podporujúcich dvojstupňové overenie (2FA).

3.4.2 Disabling OTP code generation for a Yubikey

If you use a Yubikey security key and are irritated by the spurious OTP codes it generates when inadvertently touching the key (e.g. causing you to become a spammer in the ‘#guix’ channel when discussing from your favorite IRC client!), you can disable it via the following ykman command:

guix shell python-yubikey-manager -- ykman config usb --force --disable OTP

Alternatively, you could use the ykman-gui command provided by the yubikey-manager-qt package and either wholly disable the ‘OTP’ application for the USB interface or, from the ‘Applications -> OTP’ view, delete the slot 1 configuration, which comes pre-configured with the Yubico OTP application.

3.4.3 Requiring a Yubikey to open a KeePassXC database

The KeePassXC password manager application has support for Yubikeys, but it requires installing a udev rules for your Guix System and some configuration of the Yubico OTP application on the key.

The necessary udev rules file comes from the yubikey-personalization package, and can be installed like:

(use-package-modules ... security-token ...)
...
(operating-system
 ...
 (services
  (cons*
   ...
   (udev-rules-service 'yubikey yubikey-personalization))))

After reconfiguring your system (and reconnecting your Yubikey), you’ll then want to configure the OTP challenge/response application of your Yubikey on its slot 2, which is what KeePassXC uses. It’s easy to do so via the Yubikey Manager graphical configuration tool, which can be invoked with:

guix shell yubikey-manager-qt -- ykman-gui

First, ensure ‘OTP’ is enabled under the ‘Interfaces’ tab, then navigate to ‘Applications -> OTP’, and click the ‘Configure’ button under the ‘Long Touch (Slot 2)’ section. Select ‘Challenge-response’, input or generate a secret key, and click the ‘Finish’ button. If you have a second Yubikey you’d like to use as a backup, you should configure it the same way, using the same secret key.

Your Yubikey should now be detected by KeePassXC. It can be added to a database by navigating to KeePassXC’s ‘Database -> Database Security...’ menu, then clicking the ‘Add additional protection...’ button, then ‘Add Challenge-Response’, selecting the security key from the drop-down menu and clicking the ‘OK’ button to complete the setup.