blob: a5fc5dfde0a24a1fe42678c44363a9f516667fa1 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
|
#!/bin/sh -ex
mkdir -p ~/.config/Yubico
create_keys() {
pamu2fcfg -t es256 -N > /tmp/es256
[ "${U2F_TOKEN}" != "" ] && return
pamu2fcfg -t es256 -N -r -o originA > /tmp/es256.r
pamu2fcfg -t rs256 -N -r -o originB > /tmp/rs256.r
}
run_tests() {
[ "${U2F_TOKEN}" != "" ] && return
echo "auth sufficient pam_u2f.so" > /etc/pam.d/dummy
cp /tmp/es256 ~/.config/Yubico/u2f_keys
pamtester dummy root authenticate
echo "auth sufficient pam_u2f.so origin=originA" > /etc/pam.d/dummy
cp /tmp/es256.r ~/.config/Yubico/u2f_keys
pamtester dummy root authenticate
echo "auth sufficient pam_u2f.so origin=originB" > /etc/pam.d/dummy
cp /tmp/rs256.r ~/.config/Yubico/u2f_keys
pamtester dummy root authenticate
}
run_user_presence_tests() {
echo "auth sufficient pam_u2f.so" > /etc/pam.d/dummy
cat /tmp/es256 | sed 's/-$/p/' > ~/.config/Yubico/u2f_keys
pamtester dummy root authenticate
[ "${U2F_TOKEN}" != "" ] && return
echo "auth sufficient pam_u2f.so origin=originA" > /etc/pam.d/dummy
cat /tmp/es256.r | sed 's/-$/p/' > ~/.config/Yubico/u2f_keys
pamtester dummy root authenticate
echo "auth sufficient pam_u2f.so origin=originB" > /etc/pam.d/dummy
cat /tmp/rs256.r | sed 's/-$/p/' > ~/.config/Yubico/u2f_keys
pamtester dummy root authenticate
}
run_user_verification_tests() {
[ "${U2F_TOKEN}" != "" ] && return
[ "${FIDO2_PIN}" = "" ] && return
echo "auth sufficient pam_u2f.so" > /etc/pam.d/dummy
cat /tmp/es256 | sed 's/-$/v/' > ~/.config/Yubico/u2f_keys
pamtester dummy root authenticate
echo "auth sufficient pam_u2f.so origin=originA" > /etc/pam.d/dummy
cat /tmp/es256.r | sed 's/-$/v/' > ~/.config/Yubico/u2f_keys
pamtester dummy root authenticate
echo "auth sufficient pam_u2f.so origin=originB" > /etc/pam.d/dummy
cat /tmp/rs256.r | sed 's/-$/v/' > ~/.config/Yubico/u2f_keys
pamtester dummy root authenticate
}
create_keys
run_tests
run_user_presence_tests
run_user_verification_tests
|