Skip to content

feat: add support for fido keybind - #89

Merged
javalsai merged 5 commits into
javalsai:masterfrom
Creationsss:fido-keybind
Dec 13, 2025
Merged

javalsai merged 5 commits into
javalsai:masterfrom
Creationsss:fido-keybind

Conversation

@Creationsss

@Creationsss Creationsss commented Dec 13, 2025

Copy link
Copy Markdown
Contributor
  • Add optional FIDO keybind for passwordless auth via pam_u2f

Disabled by default, enable with fido = F3 in config

Requires pam_u2f configured with a registered key (pamu2fcfg output in ~/.config/Yubico/u2f_keys or system-wide).

Tested with YubiKey C Bio - FIDO Edition and YubiKey 5C NFC
Tested on Arch Linux, Hyprland using 6.17.11-lqx1-1-lqx

forgot to mention i tested this with

#%PAM-1.0

auth sufficient pam_u2f.so cue
auth       requisite    pam_nologin.so
auth       include      system-local-login
account    include      system-local-login
session    include      system-local-login
password   include      system-local-login

@javalsai

Copy link
Copy Markdown
Owner

Looks good in general, another 10/10 PR. Will merge this shortly after I double check all security stuff and the UI things (each time I add something it needs even more a rewrite).

Also I need to add documentation with this.

And if you don't mind, where do you usually find useful PAM documentation?? It was a hassle to implement the primitive current one.

@javalsai javalsai self-assigned this Dec 13, 2025
@javalsai javalsai added the enhancement New feature or request label Dec 13, 2025
Comment thread src/ui.c
@Creationsss

Copy link
Copy Markdown
Contributor Author

Looks good in general, another 10/10 PR. Will merge this shortly after I double check all security stuff and the UI things (each time I add something it needs even more a rewrite).

Also I need to add documentation with this.

And if you don't mind, where do you usually find useful PAM documentation?? It was a hassle to implement the primitive current one.

reading sudo, login, or ly source
man 3 pam
or just https://github.com/linux-pam/linux-pam/tree/master/doc
or even https://wiki.archlinux.org/title/PAM 😭

@javalsai

Copy link
Copy Markdown
Owner

I'm gonna merge this regardless but is the yubikey implementation literally the same as if it tried to login with an empty password? Does that mean that just pressing enter also works?

@Creationsss

Copy link
Copy Markdown
Contributor Author

I'm gonna merge this regardless but is the yubikey implementation literally the same as if it tried to login with an empty password? Does that mean that just pressing enter also works?

pressing enter with empty password will trigger pam_u2f if configured and device is present, otherwise auth fails, so yeah i guess just a convenience if theres something already in the password field?

@javalsai

Copy link
Copy Markdown
Owner

I think a better cfg name would be related to "empty password login" or something similar. But unless there's a need for such a keybind for other things, I think saying its for yubikeys its fine.

Also don't mind if I push some docs to your branch.

@javalsai
javalsai merged commit a7a1f42 into javalsai:master Dec 13, 2025
19 of 20 checks passed
@javalsai

Copy link
Copy Markdown
Owner

im actually gonna finally make a minor release with all the latest changes for once in a lil while, ive been delaying this too much already

@Creationsss
Creationsss deleted the fido-keybind branch December 17, 2025 22:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

enhancement New feature or request

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants