4 ms·

Speaking from personal experience, don't do this on a machine you'll ever access remotely, because then you're stuck waiting for the biometric check to time out

Speaking from personal experience, don't do this on a machine you'll ever access remotely, because then you're stuck waiting for the biometric check to time out before you can authenticate via another method.

bodge5000 4y ago
Doesnt just apply to macs/touch bar either. Had the same issue when I setup my fingerprint sensor on my thinkpad on fedora. Maybe theres a way to get both to work, but I never found it
jwr 4y ago
That's why I prefer using Yubikeys (using this setup: https://github.com/drduh/YubiKey-Guide https://github.com/drduh/YubiKey-Guide) — and this method times out immediately (just press esc when the "insert card" dialog comes up). Plus you can have multiple keys. Plus you can use them for gpg and ssh. Plus you can back them up. Plus you can print them on paper.
- tirwander 4y ago
  The biggest reason I haven't adopted Yubikey yet is that I'm super worried I'll lose that one little USB/NFC key
  - _morgs_ 4y ago
    Always get 2...
    - kelnos 4y ago
      How does that work in practice, though? Do most websites (etc.) support enrolling more than one token?
      - fragmede 4y ago
        GitHub and Google/Gmail certainly do.
      - mwarkentin 4y ago
        Almost every one .. the big one that only supports a single MFA token that I'm aware of is AWS...
- GekkePrutser 4y ago
  Yes and you can forward the yubikey through an SSH agent. It's what I do. This way you can sudo with hardware auth both locally and remotely. Enable touch to sign so the yubikey can't be 'milked' for authentication while it's inserted and unlocked. I don't know if you can do the same (forwarding over SSH) with Fido2 but I still use traditional SSH keys anyway (stored on the yubi with OpenPGP). And the pam_ssh_agent_auth module. I'll only consider switching to Fido once everything supports it (eg my iLO devices too) and it can offer at least the same features like forwarding. For now the former is very far from being realised anyway.
smsx 4y ago
I've just tested this, and it works fine. It asks for my password like normal from an ssh session, while still using touch id locally.
- Thorrez 4y ago
  Hmm, what about remote desktop?
  - rfoo 4y ago
    There is a "Use password" button.
xenadu02 4y ago
In macOS terms ssh is a "StandardIO" session, not an Aqua (UI) session so it shouldn't even attempt the biometric prompt in that case.
vladvasiliu 4y ago
There's a workaround for this on the Arch Wiki: https://wiki.archlinux.org/title/Fprint#Login_configuration https://wiki.archlinux.org/title/Fprint#Login_configuration This also helps if you want to use the touch / Yubikey / Whatever to unlock the machine, but you need to type in the password when opening the session so that all the wallets unlock, too.
deleted 4y ago
[deleted]

bodge5000 4y ago

Doesnt just apply to macs/touch bar either. Had the same issue when I setup my fingerprint sensor on my thinkpad on fedora. Maybe theres a way to get both to work, but I never found it

jwr 4y ago

That's why I prefer using Yubikeys (using this setup: https://github.com/drduh/YubiKey-Guide https://github.com/drduh/YubiKey-Guide) — and this method times out immediately (just press esc when the "insert card" dialog comes up). Plus you can have multiple keys. Plus you can use them for gpg and ssh. Plus you can back them up. Plus you can print them on paper.

tirwander 4y ago
The biggest reason I haven't adopted Yubikey yet is that I'm super worried I'll lose that one little USB/NFC key
- _morgs_ 4y ago
  Always get 2...
  - kelnos 4y ago
    How does that work in practice, though? Do most websites (etc.) support enrolling more than one token?
    - fragmede 4y ago
      GitHub and Google/Gmail certainly do.
    - mwarkentin 4y ago
      Almost every one .. the big one that only supports a single MFA token that I'm aware of is AWS...
GekkePrutser 4y ago
Yes and you can forward the yubikey through an SSH agent. It's what I do. This way you can sudo with hardware auth both locally and remotely. Enable touch to sign so the yubikey can't be 'milked' for authentication while it's inserted and unlocked. I don't know if you can do the same (forwarding over SSH) with Fido2 but I still use traditional SSH keys anyway (stored on the yubi with OpenPGP). And the pam_ssh_agent_auth module. I'll only consider switching to Fido once everything supports it (eg my iLO devices too) and it can offer at least the same features like forwarding. For now the former is very far from being realised anyway.

smsx 4y ago

I've just tested this, and it works fine. It asks for my password like normal from an ssh session, while still using touch id locally.

Thorrez 4y ago
Hmm, what about remote desktop?
- rfoo 4y ago
  There is a "Use password" button.

xenadu02 4y ago

In macOS terms ssh is a "StandardIO" session, not an Aqua (UI) session so it shouldn't even attempt the biometric prompt in that case.

vladvasiliu 4y ago

There's a workaround for this on the Arch Wiki: https://wiki.archlinux.org/title/Fprint#Login_configuration https://wiki.archlinux.org/title/Fprint#Login_configuration This also helps if you want to use the touch / Yubikey / Whatever to unlock the machine, but you need to type in the password when opening the session so that all the wallets unlock, too.

deleted 4y ago

[deleted]