Git-Mirrors/qubes-doc
1
0
Fork 0
mirror of https://github.com/QubesOS/qubes-doc.git synced 2025-01-26 22:37:17 -05:00
Code Issues Packages Projects Releases Wiki Activity

more verbose instructions for Locking the screen when YubiKey is removed

Browse Source
This commit is contained in:
Patrick Schleizer 2017-11-14 00:46:52 +01:00 committed by GitHub
parent d8544f2d9c
commit 6c76f98d45
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 13 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
security/yubi-key.md
View File

@ -104,7 +104,9 @@ YubiKey. This will require creating simple qrexec service which will expose
ability to lock the screen to your USB VM, and then adding udev hook to ability to lock the screen to your USB VM, and then adding udev hook to
actually call that service. actually call that service.
1. First configure the qrexec service. Create `/etc/qubes-rpc/custom.LockScreen` (in dom0) In dom0:
1. First configure the qrexec service. Create `/etc/qubes-rpc/custom.LockScreen`
with simple command to lock the screen. In case of xscreensaver (used in Xfce) with simple command to lock the screen. In case of xscreensaver (used in Xfce)
it would be: it would be:
@ -115,7 +117,9 @@ would require creating `/etc/qubes-rpc/policy/custom.LockScreen` with:
sys-usb dom0 allow sys-usb dom0 allow
3. Create udev hook in your USB VM. Store it in `/rw/config` to have it In your USB VM:
3. Create udev hook. Store it in `/rw/config` to have it
persistent across VM restarts. For example name the file persistent across VM restarts. For example name the file
`/rw/config/yubikey.rules`. Write there single line: `/rw/config/yubikey.rules`. Write there single line:
@ -126,8 +130,13 @@ persistent across VM restarts. For example name the file
ln -s /rw/config/yubikey.rules /etc/udev/rules.d/ ln -s /rw/config/yubikey.rules /etc/udev/rules.d/
udevadm control --reload udevadm control --reload
Then make `/rw/config/rc.local` executable. For changes to take effect, you 5. Then make `/rw/config/rc.local` executable.
need to call this script manually for the first time.
sudo chmod +x /rw/config/rc.local
6. For changes to take effect, you need to call this script manually for the first time.
sudo /rw/config/rc.local
If you use KDE, the command(s) in first step would be different: If you use KDE, the command(s) in first step would be different: