From b390c81760561f3aff3e2880675e353f08043c0d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=A9za=20B=C3=BAza?= Date: Wed, 3 Apr 2019 19:11:40 +0200 Subject: [PATCH] Update the documentation --- README.md | 43 ++++++++++++++++++++++++++++ docs/images/architecture-diagram.svg | 2 ++ 2 files changed, 45 insertions(+) create mode 100644 docs/images/architecture-diagram.svg diff --git a/README.md b/README.md index a43ebd4..9102714 100644 --- a/README.md +++ b/README.md @@ -11,3 +11,46 @@ when it is inserted again. ## Supported hardware - all Yubikey having an USB interface (with challenge-response configured slot) + +## Development + +### Building the application + + go build github.com/elvetemedve/session-lock-manager + +### Running tests + + go test -v github.com/elvetemedve/session-lock-manager/device + go test -v github.com/elvetemedve/session-lock-manager/authentication + +### Running the application + + go run github.com/elvetemedve/session-lock-manager + + where service name is the appropriate filename in the pam.d directory + +### Architecture + +![Architecture diagram](./docs/images/architecture-diagram.svg) + +## Configuration + +### Yubikey + +Create a file like `/etc/pam.d/session-locker` with the content below: + + auth required pam_yubico.so mode=challenge-response +Now use the Yubikey configuration tool to setup a slot for challenge-response authentication without user presence. + +## Known issues + + 1. The application cannot be run as regular user on systems where polkit service is installed, because session locking, unlocking requires root privileges. See `/usr/share/polkit-1/actions/org.freedesktop.login1.policy` **org.freedesktop.login1.lock-sessions** section. + + To fix this, edit the policy file and find the XML node ``. Under that node change the `` node to be like below: + ``` + + yes + auth_admin_keep + yes + + ``` diff --git a/docs/images/architecture-diagram.svg b/docs/images/architecture-diagram.svg new file mode 100644 index 0000000..4534a4f --- /dev/null +++ b/docs/images/architecture-diagram.svg @@ -0,0 +1,2 @@ + +

Device

Udev

[Not supported by viewer]
Linux kernel
Linux kernel
Session Lock Manager

Session Lock Manager<div><br></div>

Authentication

PAM

[Not supported by viewer]
Yubikey
device
Yubikey<br/>device
Systemd-Logind
Systemd-Logind
Challenge-response method
by pam_yubico.so

Challenge-response method<br/>by pam_yubico.so<div><br></div>
OS
OS

Session

Dbus

[Not supported by viewer]Provided functionalityUSB device insertedAuthenticatecurrent  userSendmessageUnlocksessionsLocksessionsUSB deviceejectedFilterdevicesPick configuration by service nameGet current user
Polkit
PolkitVerifypermissions \ No newline at end of file