Skip to content

Conversation

@spacefrogg
Copy link

This is an update of the previous attempt to bring purely user-controlled hash-based authentication to hyprlock.

It is based on #585 and brings a hyprlock-pwhash helper binary to create the right hash config in the right location. The location of the hash config file can be chosen via the auth:sodium:secret_file config option and the --config option to hyprlock-pwhash.

The auth:sodium:secret_file config option can be:

  1. a stem which gets completed to "main config file location" + OPT + ".conf"
  2. a relative path (with at least ./... one slash) which gets extended to "main config file location" + OPT
  3. an absolute path that is taken as is.

To be conservative, the PAM and sodium authentication methods are mutually exclusive. That may be unnecessary.

Closes #573

@PointerDilemma
Copy link
Collaborator

I am currently working on pulling the authentication stuff out of hyprlock to also use it for the pollkitagent. It would be cool to add this there.

What did you change on top of #573?

@PointerDilemma
Copy link
Collaborator

Also It would be nice to give some reasons why you want to use this over pam authentication.

@spacefrogg
Copy link
Author

What it changes over #573

It uses libsodium and the CLI tooling from #585. It also adds some convenience for configuring config file locations to allow for machine-specific differences.

Reasoning for hash-based authentication

It is simple enough to avoid the need for administrative support. As an example, in my corporate environment, the PAM files are unusable for me (because Ubuntu uses its own flavour of PAM incompatible with standard PAM, but I use hypr* from Nix, which uses standard PAM). Thus, I would need help from IT to provide a hand-crafted PAM file for my screen locker. I want to avoid this complexity by providing a simple-enough unprivileged mechanism.

@spacefrogg
Copy link
Author

Just to add, I would be glad to help moving this out of hyprlock to wherever you want to have it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants