Add password hash authentication method#924
Conversation
|
I am currently working on pulling the authentication stuff out of hyprlock to also use it for the pollkitagent. It would be cool to add this there. What did you change on top of #573? |
|
Also It would be nice to give some reasons why you want to use this over pam authentication. |
What it changes over #573It uses libsodium and the CLI tooling from #585. It also adds some convenience for configuring config file locations to allow for machine-specific differences. Reasoning for hash-based authenticationIt is simple enough to avoid the need for administrative support. As an example, in my corporate environment, the PAM files are unusable for me (because Ubuntu uses its own flavour of PAM incompatible with standard PAM, but I use hypr* from Nix, which uses standard PAM). Thus, I would need help from IT to provide a hand-crafted PAM file for my screen locker. I want to avoid this complexity by providing a simple-enough unprivileged mechanism. |
|
Just to add, I would be glad to help moving this out of hyprlock to wherever you want to have it. |
This is an update of the previous attempt to bring purely user-controlled hash-based authentication to hyprlock.
It is based on #585 and brings a
hyprlock-pwhashhelper binary to create the right hash config in the right location. The location of the hash config file can be chosen via theauth:sodium:secret_fileconfig option and the--configoption tohyprlock-pwhash.The
auth:sodium:secret_fileconfig option can be:./...one slash) which gets extended to "main config file location" + OPTTo be conservative, the PAM and sodium authentication methods are mutually exclusive. That may be unnecessary.
Closes #573