Yubico Forum https://forum.yubico.com/ |
|
Proper inux udev rule for response when yubikey is inserted? https://forum.yubico.com/viewtopic.php?f=4&t=1004 |
Page 1 of 1 |
Author: | coventry [ Sat Mar 16, 2013 10:04 pm ] |
Post subject: | Proper inux udev rule for response when yubikey is inserted? |
I have the following rules in /etc/udev/rules.d/90-yubikey.rules: Code: ACTION=="remove", ENV{ID_VENDOR}=="Yubico", RUN+="/usr/local/bin/ykgone" ACTION=="add", ENV{ID_VENDOR}=="Yubico", RUN+="/usr/local/bin/ykhere" The "remove" rule works great, but the "add" rule is causing problems. With the "add" rule in place, inserting the yubikey causes /usr/local/bin/ykhere to be executed many times a second, the LED on the yubikey to flash at about the same rate, and the yubikey to stop responding to button presses with an OTP token key sequence (but the OTP loss may be because /usr/local/bin/ykhere is generating so many HMAC-SHA1 challenges.) How can I modify the "add" line so that /usr/local/bin/ykhere is only run once when the key is inserted, and the OTP button works as usual the rest of the time This is on lubuntu 12.10, with packages yubikey-personalization 1.7.0-1, libyubikey0 1.8-1. yubikey firmware version 2.3.3. The script /usr/local/bin/ykhere is Code: #!/bin/bash if [ -n "$(lsusb | grep Yubikey)" ] ; then /bin/su coventry -c /usr/local/bin/unlock fi And /usr/local/bin/unlock is #!/bin/bash Code: if [ "`~/bin/chalresp.py `" == "OK" ]; then pkill xscreensaver fi And finally, this is chalresp.py: Code: #!/usr/bin/python import subprocess, os, re recpath = os.path.expanduser('~/.ykchalresp') chal, resp = open(recpath).read().strip().split() def make_resp(chal): return subprocess.check_output(['ykchalresp', '-2', '-H', chal] ).strip() tresp = make_resp(chal) if tresp == resp: # Challenge succeeded; make a new challenge for next time nresp = make_resp(tresp) print >> open(recpath, 'w'), tresp, nresp print 'OK' exit(0) else: print 'Failed' exit(1) I can "fix" the problem by putting a "sleep 20" after "pkill xscreensaver" in /usr/local/bin/unlock and a "service udev restart" after calling /usr/local/bin/unlock in /usr/local/bin/ykhere. But that's kind of a horrendous abuse. |
Author: | coventry [ Mon Mar 18, 2013 5:40 am ] |
Post subject: | Re: Proper inux udev rule for response when yubikey is inser |
"sleep 20" and "pkill xscreensaver" was proving unreliable, in that I still wasn't getting OTPs from a keypress, and the LED would occasionally start flashing again. So I've worked around it for now by replacing the "add" rule with something which tracks the state of the screensaver. Code: #!/bin/bash
function yubiwait() { while [ "`~/bin/chalresp.py 2> /dev/null`" != "OK" ] ; do sleep 0.05 ; done killall xscreensaver } ( while [ /bin/true ] ; do xscreensaver-command -watch ; done ) \ | while read a ; do echo $a | grep "^LOCK" && yubiwait done |
Page 1 of 1 | All times are UTC + 1 hour |
Powered by phpBB® Forum Software © phpBB Group https://www.phpbb.com/ |