IRC chat logs for #ltsp on irc.libera.chat (webchat)
Channel log from 25 March 2020 (all times are UTC)
| 00:10 | <map7`> Can you use yubikey to login to LTSP 20.3 fat clients?
| |
| 00:10 | map7` is now known as map7 | |
| 00:11 | <vagrantc> maybe ... essentially anything you could configure on a standalone machine you *should* be able to configure ... but it may require some tinkering to get it to work correctly
| |
| 00:13 | <map7> vagrantc: Cool, yubikey does have good debian support so I might give it a go down the track
| |
| 01:32 | adrianorg has left IRC (adrianorg!~adrianorg@179.187.26.41.dynamic.adsl.gvt.net.br, Ping timeout: 258 seconds) | |
| 02:02 | adrianorg has joined IRC (adrianorg!~adrianorg@179.187.26.41.dynamic.adsl.gvt.net.br) | |
| 03:45 | vagrantc has left IRC (vagrantc!~vagrant@unaffiliated/vagrantc, Quit: leaving) | |
| 04:28 | shored has left IRC (shored!~shored@87-92-92-55.bb.dnainternet.fi, Read error: Connection reset by peer) | |
| 04:29 | shored has joined IRC (shored!~shored@87-92-92-55.bb.dnainternet.fi) | |
| 05:05 | GodFather has left IRC (GodFather!~rcc@d53-64-7-141.nap.wideopenwest.com, Ping timeout: 256 seconds) | |
| 05:08 | GodFather has joined IRC (GodFather!~rcc@d53-64-7-141.nap.wideopenwest.com) | |
| 06:10 | gdi2k has joined IRC (gdi2k!~gdi2k@58.69.160.28) | |
| 07:21 | map7 has left IRC (map7!~user@103.232.216.31, Remote host closed the connection) | |
| 07:21 | map7` has joined IRC (map7`!~user@103.232.216.31) | |
| 07:30 | <alkisg> map7`: yubikey doesn't provide a password so I don't think it will be able to authenticate via SSHFS
| |
| 07:30 | It will authenticate locally, but then you'll need NFS to access /home
| |
| 07:31 | I think I've heard something about yubikey and ssh authentication, but I haven't looked into it as I've never even saw a yubikey
| |
| 07:32 | I imagine they'd implement it similar to key-based authentication
| |
| 07:57 | eu^lfbn-dij-1-95 has joined IRC (eu^lfbn-dij-1-95!5a7d97c4@lfbn-dij-1-956-196.w90-125.abo.wanadoo.fr) | |
| 08:14 | eu^lfbn-dij-1-95 has left IRC (eu^lfbn-dij-1-95!5a7d97c4@lfbn-dij-1-956-196.w90-125.abo.wanadoo.fr, Remote host closed the connection) | |
| 08:25 | woernie_ has joined IRC (woernie_!~werner@p5DDEC5BE.dip0.t-ipconnect.de) | |
| 08:33 | woernie_ has left IRC (woernie_!~werner@p5DDEC5BE.dip0.t-ipconnect.de, Quit: http://quassel-irc.org - Chat comfortably. Anywhere.) | |
| 08:34 | woernie_ has joined IRC (woernie_!~werner@p5DDEC5BE.dip0.t-ipconnect.de) | |
| 08:56 | <meo> alkisg: you can use PAM to authenticate OTP
| |
| 08:56 | yubikeys have switchable authentication slots, each can be configured, you can even have it spit out a static password
| |
| 08:57 | I use it as a private key container HSM
| |
| 10:29 | shored has left IRC (shored!~shored@87-92-92-55.bb.dnainternet.fi, Ping timeout: 256 seconds) | |
| 10:32 | shored has joined IRC (shored!~shored@87-92-92-55.bb.dnainternet.fi) | |
| 10:37 | <alkisg> meo: the question is, can you insert a yubikey and automatically have ssh authenticate to a remote server?
| |
| 10:47 | Or, can you run `ssh remote-server`, and have yubikey help in authentication there...
| |
| 10:48 | When ssh'ing to a remote server, the local PAM isn't involved
| |
| 10:50 | ssh client needs to have yubikey specific code, in order to use it
| |
| 10:59 | <meo> alkisg: no, you use gpg-agent and scdaemon for that
| |
| 10:59 | the first access to the smartcard requires pinentry
| |
| 10:59 | which implies some form of ui
| |
| 11:00 | but it definitely works otherwise
| |
| 11:00 | I am logged in to this session off yubikey authentication
| |
| 11:00 | woernie_ has left IRC (woernie_!~werner@p5DDEC5BE.dip0.t-ipconnect.de, Ping timeout: 264 seconds) | |
| 11:01 | <meo> essentially gpg-agent relays ssh authentication requests to scdaemon which talks to yubikey
| |
| 11:02 | woernie has joined IRC (woernie!~werner@p578bb7b6.dip0.t-ipconnect.de) | |
| 11:02 | <alkisg> meo, gpg-agent can't be used in the login screen, as the user isn't yet logged in
| |
| 11:03 | ltsp has a pam hook that will need to somehow bind the local authentication attempt to a remote ssh, all that before login
| |
| 11:05 | shored has left IRC (shored!~shored@87-92-92-55.bb.dnainternet.fi, Read error: Connection reset by peer) | |
| 11:05 | <meo> gpg-agent, scdaemon and pinentry per se are not dependent on the specific uid and can be spawned as e.g. nobody or in a temporary session, pinentry would require interactive UI but I suppose it's doable
| |
| 11:06 | the trick would be to connect gpg-agent to the running scdaemon after logon I suppose
| |
| 11:06 | <alkisg> It's not possible to launch other GUI programs from the login screen; the gnome devs specifically refused to support that
| |
| 11:06 | <meo> that I wouldn't know, I believe there's a mechanism for this in xdm
| |
| 11:06 | <alkisg> They only allow their own, like orca, and nothing else (I was trying to have them allow epoptes broadcasts, i.e. a vnc viewer, over the login screen)
| |
| 11:06 | shored has joined IRC (shored!~shored@87-92-92-55.bb.dnainternet.fi) | |
| 11:07 | <alkisg> They don't have a window manager running at that point, so any program you run gets underneath the display screen
| |
| 11:07 | So what we'd want from a yubikey would be, to find a way to: login on vt1 as root. Then insert a yubikey, and have a command like `ssh user@server` authenticate automatically
| |
| 11:07 | No xorg or wayland involved
| |
| 11:08 | I think there was a request or an attempt or something, to put code in ssh client to do that
| |
| 11:08 | That would be the proper place, not overlays or agents...
| |
| 11:09 | <meo> that would be doable, since there's console pinentry as well
| |
| 11:10 | <alkisg> pinentry echoes a password to stdin?
| |
| 11:13 | Teridon1 has joined IRC (Teridon1!~Teridon@dragon.teridon.com) | |
| 11:41 | bcg has left IRC (bcg!~b@df-vm8yyyyyyyyyyyyyyt-3.rev.dnainternet.fi, Quit: bcg) | |
| 11:41 | bcg has joined IRC (bcg!~b@df-vm8yyyyyyyyyyyyyyt-3.rev.dnainternet.fi) | |
| 11:44 | bcg has left IRC (bcg!~b@df-vm8yyyyyyyyyyyyyyt-3.rev.dnainternet.fi, Client Quit) | |
| 11:45 | bcg has joined IRC (bcg!~b@df-vm8yyyyyyyyyyyyyyt-3.rev.dnainternet.fi) | |
| 11:59 | bcg has left IRC (bcg!~b@df-vm8yyyyyyyyyyyyyyt-3.rev.dnainternet.fi, Quit: bcg) | |
| 12:00 | bcg has joined IRC (bcg!~b@df-vm8yyyyyyyyyyyyyyt-3.rev.dnainternet.fi) | |
| 12:05 | woernie has left IRC (woernie!~werner@p578bb7b6.dip0.t-ipconnect.de, Remote host closed the connection) | |
| 12:07 | woernie has joined IRC (woernie!~werner@p5DDEC5BE.dip0.t-ipconnect.de) | |
| 12:30 | Teridon2 has joined IRC (Teridon2!~Teridon@dragon.teridon.com) | |
| 12:31 | Teridon1 has left IRC (Teridon1!~Teridon@dragon.teridon.com, Ping timeout: 240 seconds) | |
| 12:38 | woernie has left IRC (woernie!~werner@p5DDEC5BE.dip0.t-ipconnect.de, Ping timeout: 264 seconds) | |
| 12:38 | woernie has joined IRC (woernie!~werner@p5DDEC5BE.dip0.t-ipconnect.de) | |
| 13:04 | GodFather has left IRC (GodFather!~rcc@d53-64-7-141.nap.wideopenwest.com, Quit: Ex-Chat) | |
| 13:07 | GodFather has joined IRC (GodFather!~rcc@d53-64-7-141.nap.wideopenwest.com) | |
| 13:09 | GodFather has left IRC (GodFather!~rcc@d53-64-7-141.nap.wideopenwest.com, Remote host closed the connection) | |
| 13:22 | GodFather has joined IRC (GodFather!~rcc@d53-64-7-141.nap.wideopenwest.com) | |
| 13:32 | Mikaela has left IRC (Mikaela!~Mikaela@unaffiliated/mikaela, Quit: Mikaela) | |
| 13:34 | Mikaela has joined IRC (Mikaela!~Mikaela@unaffiliated/mikaela) | |
| 13:40 | Mikaela has left IRC (Mikaela!~Mikaela@unaffiliated/mikaela, Quit: Mikaela) | |
| 13:41 | Mikaela has joined IRC (Mikaela!~Mikaela@unaffiliated/mikaela) | |
| 13:45 | Mikaela has left IRC (Mikaela!~Mikaela@unaffiliated/mikaela, Client Quit) | |
| 13:47 | Mikaela has joined IRC (Mikaela!~Mikaela@unaffiliated/mikaela) | |
| 14:26 | vagrantc has joined IRC (vagrantc!~vagrant@unaffiliated/vagrantc) | |
| 14:41 | GodFather has left IRC (GodFather!~rcc@d53-64-7-141.nap.wideopenwest.com, Remote host closed the connection) | |
| 14:42 | GodFather has joined IRC (GodFather!~rcc@d53-64-7-141.nap.wideopenwest.com) | |
| 16:12 | GodFather_ has joined IRC (GodFather_!~rcc@d53-64-7-141.nap.wideopenwest.com) | |
| 16:12 | GodFather_ has left IRC (GodFather_!~rcc@d53-64-7-141.nap.wideopenwest.com, Remote host closed the connection) | |
| 16:42 | woernie has left IRC (woernie!~werner@p5DDEC5BE.dip0.t-ipconnect.de, Remote host closed the connection) | |
| 16:47 | uumas has left IRC (uumas!uumaskapsi@gateway/shell/matrix.org/x-nfulzmxwdcfukodz, Ping timeout: 256 seconds) | |
| 16:48 | woernie has joined IRC (woernie!~werner@p5DDEC5BE.dip0.t-ipconnect.de) | |
| 16:53 | uumas has joined IRC (uumas!uumaskapsi@gateway/shell/matrix.org/x-iesnstbpahkaeney) | |
| 19:23 | Teridon2 has left IRC (Teridon2!~Teridon@dragon.teridon.com, Quit: Leaving.) | |
| 20:15 | GodFather has left IRC (GodFather!~rcc@d53-64-7-141.nap.wideopenwest.com, Ping timeout: 256 seconds) | |
| 20:29 | GodFather has joined IRC (GodFather!~rcc@d53-64-7-141.nap.wideopenwest.com) | |
| 21:04 | woernie has left IRC (woernie!~werner@p5DDEC5BE.dip0.t-ipconnect.de, Remote host closed the connection) | |
| 22:41 | map7` has left IRC (map7`!~user@103.232.216.31, Remote host closed the connection) | |
| 23:42 | GodFather has left IRC (GodFather!~rcc@d53-64-7-141.nap.wideopenwest.com, Ping timeout: 256 seconds) | |