Commit graph

17 commits

Author SHA1 Message Date
Yu Watanabe db9ecf0501 license: LGPL-2.1+ -> LGPL-2.1-or-later 2020-11-09 13:23:58 +09:00
Lennart Poettering 61a29a020c homed: ignore ratelimiting counters when timestamp is from future
This likely indicates that the system clock is simply wrong, hence allow
access in this case.

Fixes: #15917
2020-09-21 18:02:35 +02:00
Zbigniew Jędrzejewski-Szmek 0e98d17e77 Add a helper function that does make_salt+crypt_r
No functional change.
2020-09-15 09:30:56 +02:00
Lennart Poettering 9be99f81a7 homed: report a home directory as "dirty" if image file has dirty flag 2020-08-25 18:18:56 +02:00
Lennart Poettering 87d7893cfb homed: support recovery keys
For discussion around this see: https://pagure.io/fedora-workstation/issue/82

Recovery keys for homed are very similar to regular passwords, except
that they are exclusively generated by the computer, and not chosen by
the user. The idea is that they are printed or otherwise stored
externally and not what users type in every day.

Taking inspiration from Windows and MacOS this uses 256bit keys. We
format them in 64 yubikey modhex characters, in groups of 8 chars
separated by dashes.

Why yubikey modhex? modhex only uses characters that are are located at
the same place in western keyboard designs. This should reduce the
chance for incorrect inputs for a major chunk of our users, though
certainly not all. This is particular relevant during early boot and
recovery situations, where there's a good chance the keyboard mapping is
not correctly set up.
2020-08-25 18:14:55 +02:00
Lennart Poettering aecbc87df4 home: add helper to process/normalize modhex64 recovery keys 2020-08-25 18:14:55 +02:00
Lennart Poettering 0a388dfcc5 core,home,machined: generate description fields for all groups we synthesize 2020-08-07 08:39:52 +02:00
Lennart Poettering 11579a956d home: use ID128_UUID_STRING_MAX where appropriate 2020-08-04 12:40:34 +02:00
Zbigniew Jędrzejewski-Szmek 071be2fa9f
Merge pull request #15442 from poettering/fido2
add fido2 authentication support to homed
2020-07-03 17:27:15 +02:00
Zbigniew Jędrzejewski-Szmek 37b22b3b47 tree: wide "the the" and other trivial grammar fixes 2020-07-02 09:51:38 +02:00
Lennart Poettering 7b78db28e5 homed: add support for authenticating with fido2 hmac-secret tokens 2020-07-01 11:17:28 +02:00
Lennart Poettering c0bde0d240 user-record: rename JSON field "pkcs11Pin" to "tokenPin"
We'd like to use it for FIDO2 tokens too, and the concept is entirely
generic, hence let's just reuse the field, but rename it. Read the old
name for compatibility, and treat the old name and the new name as
identical for most purposes.
2020-07-01 11:17:28 +02:00
Lennart Poettering 0d5e523461 home: when adding a binding for a user record, use common code for determining automatic image path
Make use of the new user_record_build_image_path() helper the previous
commit added to share some code.

Also, let's make sure we update all parsed-out fields with the new data
from the binding, so that the parsed-out fields are definitely
up-to-date.
2020-05-07 23:32:57 +02:00
Lennart Poettering 560a3e5dd6 home: make sure whenever we touch the 'secret' part of a user record, we set the the sensitive flag on it 2020-04-29 16:32:46 +02:00
Zbigniew Jędrzejewski-Szmek 162392b75a tree-wide: spellcheck using codespell
Fixes #15436.
2020-04-16 18:00:40 +02:00
Yu Watanabe 02cec15629 user-record-util: add missing error check
Fixes CID#1415123.
2020-01-31 23:08:59 +09:00
Lennart Poettering 70a5db5822 home: add new systemd-homed service that can manage LUKS homes
Fixes more or less: https://bugs.freedesktop.org/show_bug.cgi?id=67474
2020-01-28 22:36:07 +01:00