ExternalVendorCode/heads
1
0
Fork 0
mirror of https://github.com/linuxboot/heads.git synced 2025-01-18 10:46:44 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Add CONFIG_HOTP_BRANDING

Browse Source
This commit is contained in:
alex-nitrokey 2020-06-11 17:04:03 +02:00
parent 4069619ead
commit 28735a8c84
No known key found for this signature in database
GPG Key ID: A8853020E8EE6FBA
4 changed files with 14 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
Makefile
View File

@ -48,6 +48,9 @@ include $(CONFIG)
# Unless otherwise specified, we are building for heads # Unless otherwise specified, we are building for heads
CONFIG_HEADS ?= y CONFIG_HEADS ?= y
# HOTP USB Security naming if not specified in boards config
CONFIG_HOTPKEY_BRANDING ?= "HOTP USB Security dongle"
# Some things want usernames, we use the current checkout # Some things want usernames, we use the current checkout
# so that they are reproducible # so that they are reproducible
GIT_HASH := $(shell git rev-parse HEAD) GIT_HASH := $(shell git rev-parse HEAD)

7
initrd/bin/gui-init
View File

@ -93,7 +93,7 @@ update_totp()
echo "Scan the QR code to add the new TOTP secret" echo "Scan the QR code to add the new TOTP secret"
/bin/seal-totp /bin/seal-totp
if [ -x /bin/libremkey_hotp_verification ]; then if [ -x /bin/libremkey_hotp_verification ]; then
echo "Once you have scanned the QR code, hit Enter to configure your Librem Key" echo "Once you have scanned the QR code, hit Enter to configure your $(CONFIG_HOTPKEY_BRANDING)"
read read
/bin/seal-libremkey /bin/seal-libremkey
else else
@ -192,7 +192,8 @@ while true; do
HOTP=`unseal-hotp` HOTP=`unseal-hotp`
enable_usb enable_usb
if ! libremkey_hotp_verification info ; then if ! libremkey_hotp_verification info ; then
whiptail $CONFIG_WARNING_BG_COLOR --clear --title 'WARNING: Please Insert Your Librem Key' --msgbox "Your Librem Key was not detected.\n\nPlease insert your Librem Key" 30 90 whiptail $CONFIG_WARNING_BG_COLOR --clear --title 'WARNING: Please Insert Your
$(CONFIG_HOTPKEY_BRANDING)' --msgbox "Your $(CONFIG_HOTPKEY_BRANDING) was not detected.\n\nPlease insert your $(CONFIG_HOTPKEY_BRANDING)" 30 90
fi fi
# Don't output HOTP codes to screen, so as to make replay attacks harder # Don't output HOTP codes to screen, so as to make replay attacks harder
libremkey_hotp_verification check $HOTP libremkey_hotp_verification check $HOTP
@ -205,7 +206,7 @@ while true; do
MAIN_MENU_BG_COLOR=$CONFIG_ERROR_BG_COLOR MAIN_MENU_BG_COLOR=$CONFIG_ERROR_BG_COLOR
;; ;;
* ) * )
HOTP="Error checking code, Insert Librem Key and retry" HOTP="Error checking code, Insert $(CONFIG_HOTPKEY_BRANDING) and retry"
MAIN_MENU_BG_COLOR=$CONFIG_WARNING_BG_COLOR MAIN_MENU_BG_COLOR=$CONFIG_WARNING_BG_COLOR
;; ;;
esac esac

4
initrd/bin/kexec-seal-key
View File

@ -84,8 +84,8 @@ cat "$KEY_DEVICES" | cut -d\ -f1 | xargs /bin/qubes-measure-luks \
|| die "Unable to measure the LUKS headers" || die "Unable to measure the LUKS headers"
luks_pcr=`tpm calcfuturepcr -ix 16 -if /tmp/luksDump.txt` luks_pcr=`tpm calcfuturepcr -ix 16 -if /tmp/luksDump.txt`
# Librem Key loads USB modules which changes PCR5. # HOTP USB Secrity dongle loads USB modules which changes PCR5.
# In the event Librem Key is enabled, skip verification of PCR5 # In the event HOTP USB Security dongle is enabled, skip verification of PCR5
if [ -x /bin/libremkey_hotp_verification ]; then if [ -x /bin/libremkey_hotp_verification ]; then
pcr_5="X" pcr_5="X"
else else

10
initrd/bin/seal-libremkey
View File

@ -1,5 +1,5 @@
#!/bin/sh #!/bin/sh
# Retrieve the sealed TOTP secret and initialize a Librem Key with it # Retrieve the sealed TOTP secret and initialize a USB Security dongle with it
. /etc/functions . /etc/functions
@ -50,17 +50,17 @@ counter_value=1
enable_usb enable_usb
if ! libremkey_hotp_verification info ; then if ! libremkey_hotp_verification info ; then
echo "Insert your Librem Key and press Enter to configure it" echo "Insert your $(CONFIG_HOTPKEY_BRANDING) and press Enter to configure it"
read read
if ! libremkey_hotp_verification info ; then if ! libremkey_hotp_verification info ; then
# don't leak key on failure # don't leak key on failure
shred -n 10 -z -u "$HOTP_SECRET" 2> /dev/null shred -n 10 -z -u "$HOTP_SECRET" 2> /dev/null
die "Unable to find Librem Key" die "Unable to find $(CONFIG_HOTPKEY_BRANDING)"
fi fi
fi fi
echo -e "" echo -e ""
read -s -p "Enter your Librem Key Admin PIN: " admin_pin read -s -p "Enter your $(CONFIG_HOTPKEY_BRANDING) Admin PIN: " admin_pin
echo -e "\n" echo -e "\n"
libremkey_hotp_initialize "$admin_pin" $HOTP_SECRET $counter_value libremkey_hotp_initialize "$admin_pin" $HOTP_SECRET $counter_value
@ -94,7 +94,7 @@ echo $counter_value > $HOTP_COUNTER \
#|| die "Unable to create hotp counter file" #|| die "Unable to create hotp counter file"
mount -o remount,ro /boot mount -o remount,ro /boot
echo -e "\nLibrem Key initialized successfully. Press Enter to continue." echo -e "\n$(CONFIG_HOTPKEY_BRANDING) initialized successfully. Press Enter to continue."
read read
exit 0 exit 0