WSL-Hello-sudo
sekey
| WSL-Hello-sudo | sekey | |
|---|---|---|
| 7 | 4 | |
| 1,155 | 2,419 | |
| - | 0.0% | |
| 0.0 | 0.0 | |
| 12 months ago | over 1 year ago | |
| Rust | Rust | |
| MIT License | MIT License |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
WSL-Hello-sudo
-
Quick Tip: Enable Touch ID for Sudo
Well, `sudo` is a *nix binary, so Linux and macOS are your most popular options here.
Fingerprint authentication for sudo was enabled by default on my Manjaro install after I enrolled a fingerprint so I guess popular Linux distributions configure it automatically. If yours doesn't, try the configuration methods on this page: https://wiki.archlinux.org/title/fprint or here: https://askubuntu.com/questions/1015416/use-fingerprint-auth... or consult your operating system's documentation.
The big difference is that you need "pam_fprintd.so" instead of "pam_tid". On Ubuntu (or derived, probably), running "sudo pam-auth-update" will allow you to configure fingerprint authentication without needing to manually edit system files.
Do note that if you use a more exotic window manager, any fancy visual sudo prompts may not know how to deal with such a system.
If you're on Windows and want WSL with Windows Hello, there's this tool: https://github.com/nullpo-head/WSL-Hello-sudo which is a PAM library that will call into Windows Hello from WSL. Windows Hello should in turn support your fingerprint reader or other biometric authentication system configured for your PC.
-
WSL Hello Sudo: Face Recognition of Windows Hello on Windows Subsystem for Linux
What kind of prompt is this? It looks like Windows Terminal running Bash, but are the icons PNGs (windows + home), or a specific type-face rendering emoji?
https://github.com/nullpo-head/WSL-Hello-sudo/blob/master/de...
-
Use Touch ID for Sudo on Mac
Similarly for WSL2 using Windows Hello:
https://github.com/nullpo-head/WSL-Hello-sudo
- WSL-Hello-sudo - sudo by face recognition of Windows Hello on WSL
sekey
- Use TouchID to Authenticate Sudo on macOS
-
Apple/Google/Microsoft to accelerate rollout of passwordless sign‑in standard
> relaying auth requests to your phone for approval and storing secrets in the Secure Enclave
Like https://github.com/kryptco/kr [key stored in a [...] mobile app]?
Also, newer Macs have a Secure Enclave (supports 256-bit secp256r1 ECC keys):
https://github.com/maxgoedjen/secretive [storing and managing SSH keys in the Secure Enclave [...] or a Smart Card (such as a YubiKey)]
https://github.com/sekey/sekey [Use Touch ID / Secure Enclave for SSH Authentication!]
- Use Touch ID for Sudo on Mac
-
How often should I rotate my SSH keys?
Similar to the recommendations to use a YubiKey/hardware token, SeKey on a Mac lets you use a key generated in the Secure Enclave in an unexportable form (https://github.com/sekey/sekey)
What are some alternatives?
pam-watchid - PAM plugin module that allows the Apple Watch to be used for authentication
secretive - Store SSH keys in the Secure Enclave
sudo-touchid - A fork of `sudo` with Touch ID support.
rdpwrap - RDP Wrapper Library
openssh-sk-winhello - A helper for OpenSSH to interact with FIDO2 and U2F security keys through native Windows Hello API
pam_reattach - Reattach to the user's GUI session on macOS during authentication (for Touch ID support in tmux)
wsl-distrod - Distrod is a meta-distro for WSL 2 which installs Ubuntu, Arch, Debian, Gentoo, etc. with systemd in a minute for you. Distrod also has built-in auto-start feature on Windows startup and port forwarding ability.
webauthn - Web Authentication: An API for accessing Public Key Credentials
pam-duress - A Pluggable Authentication Module (PAM) which allows the establishment of alternate passwords that can be used to perform actions to clear sensitive data, notify IT/Security staff, close off sensitive network connections, etc if a user is coerced into giving a threat actor a password.
bless - Repository for BLESS, an SSH Certificate Authority that runs as a AWS Lambda function