==================================================
Using a Yubikey to authenticate to a Gentoo system
==================================================
:CreationDate: 2015-11-29 13:30:11
:Id: SW/yubikey-auth
:tags: - software
       - configs

Very rough:

* add `my overlay`_

* un-keyword the needed packages, for example by writing this to
  ``/etc/portage/package.accept_keywords/yubikey``::

    app-crypt/libu2f-host
    app-crypt/libu2f-server
    sys-auth/pam_u2f

* install |pam_u2f|_

* add at the top of ``/etc/pam.d/system-login``::

    auth  required  pam_u2f.so

* run::

    mkdir -p ~/config/Yubico
    pamu2fcfg -uusername -opam://$(hostname) -ipam://$(hostname) \
      >> ~/config/Yubico/u2f_keys

* Done. See the |pam_u2f|_ documentation for further details.

.. note::

   By declaring that |pam_u2f| is "``required``", you're saying that
   the Yubikey is necessary *in addition to your password*. If you
   want to just use the Yubikey, write ``sufficient`` instead.

.. _`my overlay`: https://www.thenautilus.net/cgit/gentoo-overlay/
.. _`pam_u2f`: https://developers.yubico.com/pam-u2f/
.. |pam_u2f| replace:: ``pam_u2f``