Commit graph

379 commits

Author SHA1 Message Date
Moritz Maxeiner 09f9af17b4 Update to the Yubikey PBA
Security-relevant changes:
 * No (salted) passphrase hash send to the yubikey, only hash of the salt (as it was in the original implementation).
 * Derive $k_luks with PBKDF2 from the yubikey $response (as the PBKDF2 salt) and the passphrase $k_user
   (as the PBKDF2 password), so that if two-factor authentication is enabled
   (a) a USB-MITM attack on the yubikey itself is not enough to break the system
   (b) the potentially low-entropy $k_user is better protected against brute-force attacks
 * Instead of using uuidgen, gather the salt (previously random uuid / uuid_r) directly from /dev/random.
 * Length of the new salt in byte added as the parameter "saltLength", defaults to 16 byte.
   Note: Length of the challenge is 64 byte, so saltLength > 64 may have no benefit over saltLengh = 64.
 * Length of $k_luks derived with PBKDF2 in byte added as the parameter "keyLength", defaults to 64 byte.
   Example: For a luks device with a 512-bit key, keyLength should be 64.
 * Increase of the PBKDF2 iteration count per successful authentication added as the
   parameter "iterationStep", defaults to 0.

Other changes:
 * Add optional grace period before trying to find the yubikey, defaults to 2 seconds.

Full overview of the yubikey authentication process:

  (1) Read $salt and $iterations from unencrypted device (UD).
  (2) Calculate the $challenge from the $salt with a hash function.
      Chosen instantiation: SHA-512($salt).
  (3) Challenge the yubikey with the $challenge and receive the $response.
  (4) Repeat three times:
    (a) Prompt for the passphrase $k_user.
    (b) Derive the key $k_luks for the luks device with a key derivation function from $k_user and $response.
        Chosen instantiation: PBKDF2(HMAC-SHA-512, $k_user, $response, $iterations, keyLength).
    (c) Try to open the luks device with $k_luks and escape loop (4) only on success.
  (5) Proceed only if luks device was opened successfully, fail otherwise.

  (6) Gather $new_salt from a cryptographically secure pseudorandom number generator
      Chosen instantiation: /dev/random
  (7) Calculate the $new_challenge from the $new_salt with the same hash function as (2).
  (8) Challenge the yubikey with the $new_challenge and receive the $new_response.
  (9) Derive the new key $new_k_luks for the luks device in the same manner as in (4) (b),
      but with more iterations as given by iterationStep.
 (10) Try to change the luks device's key $k_luks to $new_k_luks.
 (11) If (10) was successful, write the $new_salt and the $new_iterations to the UD.
      Note: $new_iterations = $iterations + iterationStep

Known (software) attack vectors:

 * A MITM attack on the keyboard can recover $k_user. This, combined with a USB-MITM
   attack on the yubikey for the $response (1) or the $new_response (2) will result in
   (1) $k_luks being recovered,
   (2) $new_k_luks being recovered.
 * Any attacker with access to the RAM state of stage-1 at mid- or post-authentication
   can recover $k_user, $k_luks, and  $new_k_luks
 * If an attacker has recovered $response or $new_response, he can perform a brute-force
   attack on $k_user with it without the Yubikey needing to be present (using cryptsetup's
   "luksOpen --verify-passphrase" oracle. He could even make a copy of the luks device's
   luks header and run the brute-force attack without further access to the system.
 * A USB-MITM attack on the yubikey will allow an attacker to attempt to brute-force
   the yubikey's internal key ("shared secret") without it needing to be present anymore.

Credits:

 * Florian Klien,
   for the original concept and the reference implementation over at
   https://github.com/flowolf/initramfs_ykfde
 * Anthony Thysse,
   for the reference implementation of accessing OpenSSL's PBKDF2 over at
   http://www.ict.griffith.edu.au/anthony/software/pbkdf2.c
2014-02-08 14:59:52 +01:00
Moritz Maxeiner 8e74e1fded Replace the current Yubikey PBA implementation with the previous one.
Rationale:
  * The main reason for choosing to implement the PBA in accordance
    with the Yubico documentation was to prevent a MITM-USB-attack
    successfully recovering the new LUKS key.
  * However, a MITM-USB-attacker can read user id and password when
    they were entered for PBA, which allows him to recover the new
    challenge after the PBA is complete, with which he can challenge
    the Yubikey, decrypt the new AES blob and recover the LUKS key.
  * Additionally, since the Yubikey shared secret is stored in the
    same AES blob, after such an attack not only is the LUKS device
    compromised, the Yubikey is as well, since the shared secret
    has also been recovered by the attacker.
  * Furthermore, with this method an attacker could also bruteforce
    the AES blob, if he has access to the unencrypted device, which
    would again compromise the Yubikey, should he be successful.
  * Finally, with this method, once the LUKS key has been recovered
    once, the encryption is permanently broken, while with the previous
    system, the LUKS key itself it changed at every successful boot,
    so recovering it once will not necessarily result in a permanent
    breakage and will also not compromise the Yubikey itself (since
    its secret is never stored anywhere but on the Yubikey itself).

Summary:
The current implementation opens up up vulnerability to brute-forcing
the AES blob, while retaining the current MITM-USB attack, additionally
making the consequences of this attack permanent and extending it to
the Yubikey itself.
2014-02-03 22:50:17 +01:00
Oliver Charles 0d18d39e98 switch-to-configuration.pl: Handle successful auto-restarts
switch-to-configuration.pl is currently hard-coded to assume that if a
unit is in the "auto-restart" state that something has gone wrong, but
this is not strictly true. For example, I run offlineimap as a oneshot
service restarting itself every minute (on success). NixOS currently
thinks that offlineimap has failed to start as it enters the
auto-restart state, because it doesn't consider why the unit failed.

This commit changes switch-to-configuration.pl to inspect the full
status of a unit in auto-restart state, and now only considers it failed
if the ExecMainStatus is non-zero.
2014-02-02 15:56:22 +01:00
Vladimír Čunát 4a55391f1f Merge #1645 and #1646: lightdm and -gtk-greeter update 2014-02-02 15:51:35 +01:00
Vladimír Čunát b5a32b3944 Merge #1618: use ubuntu module blacklists by default 2014-02-02 15:51:07 +01:00
Jaka Hudoklin b6e3cd7170 nixos/nscd: add option to change nscd config
[Bjørn Forsman <bjorn.forsman@gmail.com>:
 - use types.lines instead of types.string. The former joins strings
   with "\n" and the latter with "" (and is deprecated).
]
2014-02-02 15:31:55 +01:00
Eelco Dolstra 559f5be07d dhcpcd: Update to 6.2.1
Dhcpcd now has integration with udev, so it should no longer be a
problem if udev renames an interface while dhcpcd is running.
2014-02-02 11:28:45 +01:00
Arvin Moezzi 0602ef22de git-daemon service: fix typo in option (close #1659) 2014-02-01 11:56:56 +01:00
Rob Vermaas 9b1bd84940 httpd: Respect original order of environment eval. 2014-01-31 21:18:24 +01:00
Rob Vermaas bfa56d7657 httpd: Only add PHPRC to environment of httpd when enablePHP is true. 2014-01-31 21:14:05 +01:00
Oliver Charles 32a08d0846 lightdm: Update to 1.8.6 2014-01-31 12:42:03 +00:00
Petr Rockai 2062abfd4f Merge branch 'yubikey' of git://github.com/Calrama/nixpkgs 2014-01-29 18:54:07 +01:00
Moritz Maxeiner 7bf94cadad Add library dependencies explicitly 2014-01-29 18:49:26 +01:00
Moritz Maxeiner e96f58ef5c Implement muli-user authentication for yubikey pba, i.e. multiple users can now share a single luks keyslot.
This is achieved by having multiple lines per storage file, one for each user (if the feature is enabled); each of these
lines has the same format as would be the case for the userless authentication, except that they are prepended with a
SHA-512 of the user's id.
2014-01-29 17:20:05 +01:00
Moritz Maxeiner 20cfaf0faa Change the crypt-storage file to be hex encoded instead of raw binary. To update from the previous configuration, convert your crypt-storage file from raw binary to hex. 2014-01-29 13:58:35 +01:00
aszlig 795941261a
nixos-generate-config: Fix reference to <nixos>.
IIUC, <nixos> is going to be deprecated someday in the future, and as
most of those references are already replaced I guess it's safe to
replace it here as well, as it is only relevant on new/updated
installations.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
2014-01-29 13:23:30 +01:00
Moritz Maxeiner cce9712331 Enable two-factor authentication by default. Add proper descriptions to attributes. 2014-01-29 12:55:32 +01:00
Moritz Maxeiner 45b1ffb8db Cosmetic change to yubikey detection 2014-01-28 20:39:46 +01:00
Vladimír Čunát 5acaa980a5 pull module blacklist from Ubuntu and use it by default
People often have serious problems due to bogus modules like *fb.
2014-01-28 12:52:36 +01:00
Moritz Maxeiner 407a770161 Rewrite as a pre-boot authentication module (mostly) comforming to the design specification of
'YubiKey Integration for Full Disk Encryption Pre-Boot Authentication (Copyright) Yubico, 2011 Version: 1.1'.

Used binaries:
  * uuidgen - for generation of random sequence numbers
  * ykchalresp - for challenging a Yubikey
  * ykinfo - to check if a Yubikey is plugged in at boot (fallback to passphrase authentication otherwise)
  * openssl - for calculation of SHA-1, HMAC-SHA-1, as well as AES-256-CTR (de/en)cryption

Main differences to the specification mentioned above:
  * No user management (yet), only one password+yubikey per LUKS device
  * SHA-512 instead of CRC-16 for checksum

Main differences to the previous implementation:
  * Instead of changing the key slot of the LUKS device each boot,
    the actual key for the LUKS device will be encrypted itself
  * Since the response for the new challenge is now calculated
    locally with openssl, the MITM-USB-attack with which previously
    an attacker could obtain the new response (that was used as the new
    encryption key for the LUKS device) by listening to the
    Yubikey has ideally become useless (as long as uuidgen can
    successfuly generate new random sequence numbers).

Remarks:
  * This is not downwards compatible to the previous implementation
2014-01-28 04:02:51 +01:00
Rob Vermaas 4ccd60af00 Merge pull request #1178 from chexxor/fix-httpd-ssh
HTTPD: Check for SSL Cert value before building with SSL support.
2014-01-27 12:34:42 -08:00
Petr Rockai 66db1b3a64 nixos: Add a dictd service. 2014-01-25 16:35:02 +01:00
Aristid Breitkreuz 5d3d6b3799 support -Q in nixos-rebuild 2014-01-25 11:20:25 +01:00
Moritz Maxeiner 333f5caaf9 Implement authentication for a LUKS device with a yubikey (HMAC-SHA1); supports simple challenge-response and two-factor authentication 2014-01-25 03:33:09 +01:00
Thomas Tuegel 7b743fcaab networkmanager: load modules required for PPTP 2014-01-24 09:22:59 -06:00
Vladimír Čunát 12235ed36e remove .topmsg (close #1578) 2014-01-23 22:30:07 +01:00
Shea Levy 51de280c0a nixos X tests: wait for logind to link a session to the server
There seems to be some race causing failures if an X command gets in before slim starts the session

Signed-off-by: Shea Levy <shea@shealevy.com>
2014-01-22 14:23:56 -05:00
Shea Levy d18bc25b95 Rename linuxManualConfig to buildLinux
Signed-off-by: Shea Levy <shea@shealevy.com>
2014-01-21 20:05:55 -05:00
Shea Levy 30f7947031 Whitespace to force a build
Ugh

Signed-off-by: Shea Levy <shea@shealevy.com>
2014-01-19 15:07:35 -05:00
Domen Kožar e5b6de80bb Merge pull request #1536 from Shados/service-haveged
Adds a service for haveged, the entropy daemon
2014-01-18 09:38:51 -08:00
Shea Levy d454e094ef kmscon: Don't re-run systemd-vconsole-setup after boot, and let tty1 wait for vconsole setup
Signed-off-by: Shea Levy <shea@shealevy.com>
2014-01-18 11:17:49 -05:00
Shea Levy ca7805be94 systemd: Enable specifying extra config files for a unit
This will allow overriding package-provided units, or overriding only a
specific instance of a unit template.

Signed-off-by: Shea Levy <shea@shealevy.com>
2014-01-18 11:10:39 -05:00
Shea Levy 9c1d3bfa9f Whitespace to force a rebuild
Signed-off-by: Shea Levy <shea@shealevy.com>
2014-01-17 12:15:49 -05:00
Shea Levy 7f15b0c132 Merge branch 'xprofile' of git://github.com/pSub/nixpkgs into master
Allow the user to execute commands at the beginning of the X session.

Signed-off-by: Shea Levy <shea@shealevy.com>
2014-01-17 09:28:19 -05:00
Alexei Robyn 6d80803e66 Adds a service for haveged, the entropy daemon
Includes configuration option for the threshold beneath which to refill
the entropy pool - defaults to 1024 bits as this is the number used in
other distro's existing service files I looked at.
2014-01-17 22:10:52 +11:00
Shea Levy babd66e8e6 Fix environment.etc setting
Signed-off-by: Shea Levy <shea@shealevy.com>
2014-01-15 15:15:46 -05:00
Shea Levy 22c5c57043 Fix typo
Thanks to @bennofs for pointing it out

Signed-off-by: Shea Levy <shea@shealevy.com>
2014-01-15 11:14:46 -05:00
Shea Levy fd97be3501 Don't restart kmscon VTs if the unit changes
Signed-off-by: Shea Levy <shea@shealevy.com>
2014-01-15 08:52:08 -05:00
Shea Levy 646af581f5 Option description formatting
Signed-off-by: Shea Levy <shea@shealevy.com>
2014-01-15 08:17:19 -05:00
Shea Levy 852c270035 nixos: Split mesa setup from xserver.nix
With kmscon, it is now possible to have a system without X that still
needs the mesa setup in /run/opengl-driver

Signed-off-by: Shea Levy <shea@shealevy.com>
2014-01-15 08:17:19 -05:00
Shea Levy 48daf624c5 Add module to use kmscon instead of linux-console for VTs
This required some changes to systemd unit handling:

* Add an option to specify that a unit is just a symlink
* Allow specified units to overwrite systemd-provided ones
* Have gettys.target require autovt@1.service instead of getty@1.service

Signed-off-by: Shea Levy <shea@shealevy.com>
2014-01-15 08:17:19 -05:00
Thomas Bereknyei 57e3feda74 Adds kippo SSH honeypot 2014-01-14 10:32:26 +00:00
Eelco Dolstra 6fb27abf33 Merge branch 'java' 2014-01-13 13:16:17 +01:00
Jaka Hudoklin 78d3180dbe xfce: add xfce screenshooter 2014-01-13 10:55:18 +00:00
Jaka Hudoklin ba1bbc2fa8 nixos/cgminer: fix restarts, set uid 2014-01-13 00:19:06 +01:00
Oliver Charles 422f2032ab services.postgresql: Hint to use mkForce for authentication
This fixes #1395
2014-01-11 22:01:21 +00:00
Rok Garbas e1f363350a connman-vpn and connman-vpn dbus servise should start after connman service 2014-01-11 21:17:17 +01:00
Matej Cotman 7d4d3536f7 connman: new packages ConnMan v1.20 and connman-ui 2014-01-11 20:22:53 +01:00
Eelco Dolstra c32d0180e4 Don't set $TZ
Now that Java is happy with our /etc/localtime, there is no reason to
set $TZ anymore.  (See 945849b86f, 279248f6c5, 1b5e860f65607b4cc7de4b6b5db95460cf144526.)

Fixes #1463.
2014-01-06 18:27:07 +01:00
Eelco Dolstra 1b5e860f65 Make /etc/localtime a direct symlink to the zoneinfo file
Some programs (notably the Java Runtime Environment) expect to be able
to extract the name of the time zone from the target of the
/etc/localtime symlink.  That doesn't work if /etc/localtime is a
symlink to /etc/static/localtime.  So make it a direct symlink.
2014-01-06 18:23:41 +01:00