This repository has no description
541 B
18 lines
1{ ... }:
2# Enables second factor for ssh password login
3
4## Usage:
5# gen-oath-safe <username> totp
6## scan the qrcode with google authenticator (or FreeOTP)
7## copy last line into secrets/<host>/users.oath (chmod 700)
8{
9 security.pam.oath = {
10 # enabling it will make it a requisite of `all` services
11 # enable = true;
12 digits = 6;
13 # TODO assert existing
14 usersFile = "${config.krebs.secret.directory}/users.oath";
15 };
16 # I want TFA only active for sshd with password-auth
17 security.pam.services.sshd.oathAuth = true;
18}