Setting up working FIDO2 key in Guix

Setting up working FIDO2 key in Guix

[Raymundo Soto]

Hi everyone!

I have been trying to follow `info guix' but I am feeling
a bit lost now regarding the subject topic.

Here are the relevant portions of my config.scm:

(use-modules
[...] (gnu services security-token) (guix packages) (guix download))

[...]

(define %nitrokey-udev-rules
  (origin
    (method url-fetch)
    (uri "[...]")
    (hash (content-hash "[...]"))))

[...]

(operating-system
[...]
  (services
    (append
      (list
        (udev-rules-service 'nitrokey $nitrokey-udev-rules)
        [...])
      %desktop-services))
  [...]

The Nitrokey is detected by the Kernel, and udevadvm monitor shows
events such as plugging and unplugging.

The Nitrokey has a couple of functions and, interestingly enough, I
had been able to use the functions for ssh-keygen with a non-admin
password even before adding the udev rules. But now I am trying to
use the FIDO2 functionality - which I am sure does not work because:

1.- Neither nitrocli nor the Nitrokey app detect the key
2.- A website supporting dongleauth/FIDO was not able to read data.

Am I missing some step here?

Any hints greatly appreciated.

Thanks,

Ray.-

Re: Setting up working FIDO2 key in Guix

[Aleksej via]

Hi! As far as I know we have an older version of nitrokey app, that does not support NitroKey 3 series. (see <https://github.com/Nitrokey/nitrokey-app2>). For the FIDO2, I can't tell anything right now, but I'll start investigating as soon as I receive my NitroKey. 

Thanks,
Lesik Edelweiss

Setting up working FIDO2 key in Guix

[Jonathan Brielmaier]

Hey Ray,

I'm using a Nitrokey 3A NFC under Guix System.

I have the following in my config.scm:
(use-package-modules security-token)
[...]
(udev-rules-service 'nitrokey libnitrokey)

And FIDO in the web browser does work for me (e.g. gitlab.com or
webauthn.io).

~Jonathan

Re: Setting up working FIDO2 key in Guix

[Raymundo Soto]

Hi! This solution provided by J. Brielmaier worked! Downloading
the nitrokey udev rules wasn't even necessary.

Thanks!

* Jonathan Brielmaier <jonathan.brielmaier@web.de>:
> Hey Ray,
> 
> I'm using a Nitrokey 3A NFC under Guix System.
> 
> I have the following in my config.scm:
> (use-package-modules security-token)
> [...]
> (udev-rules-service 'nitrokey libnitrokey)
> 
> And FIDO in the web browser does work for me (e.g. gitlab.com or
> webauthn.io).
> 
> ~Jonathan