helm/install-yubikey.sh

175 lines
4.9 KiB
Bash
Raw Permalink Blame History

This file contains ambiguous Unicode characters!

This file contains ambiguous Unicode characters that may be confused with others in your current locale. If your use case is intentional and legitimate, you can safely ignore this warning. Use the Escape button to highlight these characters.

#!/usr/bin/env bash
rbtohex() {
( od -An -vtx1 | tr -d ' \n' )
}
hextorb() {
( tr '[:lower:]' '[:upper:]' | sed -e 's/\([0-9A-F]\{2\}\)/\\\\\\x\1/gI'| xargs printf )
}
# Setup
# nix-env -i gcc-wrapper
# nix-env -i yubikey-personalization
# nix-env -i openssl
# Use nix-shell https://github.com/sgillespie/nixos-yubikey-luks/archive/master.tar.gz
# Compile correct version of OpenSSL key derivation
cc -O3 -I$(nix-build "<nixpkgs>" --no-build-output -A openssl.dev)/include -L$(nix-build "<nixpkgs>" --no-build-output -A openssl.out)/lib $(nix eval "(with import <nixpkgs> {}; pkgs.path)")/nixos/modules/system/boot/pbkdf2-sha512.c -o ./pbkdf2-sha512 -lcrypto
# Yubikey Setup
SLOT=2
# ykpersonalize -"$SLOT" -ochal-resp -ochal-hmac
SALT_LENGTH=16
salt="$(dd if=/dev/random bs=1 count=$SALT_LENGTH 2>/dev/null | rbtohex)"
k_user=PASSWORDCHANGEMEPLAEASES
challenge="$(echo -n $salt | openssl dgst -binary -sha512 | rbtohex)"
response="$(ykchalresp -2 -x $challenge 2>/dev/null)"
# Setup LUKS device
KEY_LENGTH=512
ITERATIONS=1000000
k_luks="$(echo -n $k_user | ./pbkdf2-sha512 $(($KEY_LENGTH / 8)) $ITERATIONS $response | rbtohex)"
EFI_PART=/dev/sda1
LUKS_PART=/dev/sda2
EFI_MNT=/boot/
mkdir -p "$EFI_MNT"
mkfs.fat -F 32 -n boot "$EFI_PART"
mount "$EFI_PART" "$EFI_MNT"
STORAGE=/crypt-storage/default
mkdir -p "$(dirname $EFI_MNT$STORAGE)"
echo -ne "$salt\n$ITERATIONS" > $EFI_MNT$STORAGE
CIPHER=aes-xts-plain64
HASH=sha512
echo -n "$k_luks" | hextorb | cryptsetup luksFormat --cipher="$CIPHER" --key-size="$KEY_LENGTH" --hash="$HASH" --key-file=- "$LUKS_PART"
umount "$EFI_MNT"
# LVM Setup
LUKSROOT=crypthome
echo -n "$k_luks" | hextorb | cryptsetup luksOpen $LUKS_PART $LUKSROOT --key-file=-
pvcreate "/dev/mapper/$LUKSROOT"
VGNAME=partitions
vgcreate "$VGNAME" "/dev/mapper/$LUKSROOT"
lvcreate -L 2G -n swap "$VGNAME"
FSROOT=fsroot
lvcreate -l 100%FREE -n "$FSROOT" "$VGNAME"
vgchange -ay
mkswap -L swap /dev/partitions/swap
# BTRFS Setup
mkfs.btrfs -L "$FSROOT" "/dev/partitions/$FSROOT"
# incase the above breaks
#mkdir /mnt-root
#touch /mnt-root/nix-store.squashfs
mount "/dev/partitions/$FSROOT" /mnt
cd /mnt || exit
btrfs subvolume create root
btrfs subvolume create home
cd
umount /mnt
mount -o subvol=root "/dev/partitions/$FSROOT" /mnt
mkdir /mnt/home
mount -o subvol=home "/dev/partitions/$FSROOT" /mnt/home
mkdir /mnt/boot
mount "$EFI_PART" /mnt/boot
swapon /dev/partitions/swap
# Install NixOS
nixos-generate-config --root /mnt
# Change the config
cat > /mnt/etc/nixos/configuration.nix <<'endmsg'
{ config, pkgs, ... }:
{
imports =
[ # Include the results of the hardware scan.
./hardware-configuration.nix
];
boot.loader.grub.enable = true;
boot.loader.grub.version = 2;
# Define on which hard drive you want to install Grub.
boot.loader.grub.device = "/dev/sda"; # or "nodev" for efi only
# Minimal list of modules to use the EFI system partition and the YubiKey
boot.initrd.kernelModules = [ "vfat" "nls_cp437" "nls_iso8859-1" "usbhid" ];
# Enable support for the YubiKey PBA
boot.initrd.luks.yubikeySupport = true;
# Configuration to use your Luks device
boot.initrd.luks.devices = {
"crypthome" = {
device = "/dev/sda2";
preLVM = true; # You may want to set this to false if you need to start a network service first
yubikey = {
slot = 2;
twoFactor = true; # Set to false if you did not set up a user password.
storage = {
device = "/dev/sda1";
};
};
};
};
# Enable Flakes
nix = {
package = pkgs.nixUnstable;
extraOptions = ''
experimental-features = nix-command flakes
'';
};
networking.hostName = "curve"; # Define your hostname.
networking.wireless.enable = true; # Enables wireless support via wpa_supplicant.
time.timeZone = "Australia/Brisbane";
networking.useDHCP = false;
networking.interfaces.enp0s31f6.useDHCP = true;
networking.interfaces.wlp3s0.useDHCP = true;
# Select internationalisation properties.
i18n.defaultLocale = "en_US.UTF-8";
# console = {
# font = "Lat2-Terminus16";
# keyMap = "us";
# };
services.xserver.layout = "us,dvorak";
sound.enable = true;
hardware.pulseaudio.enable = true;
services.xserver.libinput.enable = true;
# Hmmm maybe somewhere else?
users.users.anish = {
isNormalUser = true;
extraGroups = [ "wheel" ];
};
# Enable the OpenSSH daemon.
# services.openssh.enable = true;
# This value determines the NixOS release from which the default
# settings for stateful data, like file locations and database versions
# on your system were taken. Its perfectly fine and recommended to leave
# this value at the release version of the first install of this system.
# Before changing this value read the documentation for this option
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
system.stateVersion = "22.11"; # Did you read the comment?
}
endmsg
cd /mnt || exit
nixos-install --root /mnt
passwd