Skip to content

Enrolling fido2 mid install #4603

Description

@h8d13

Basically currently when using fido2 to enroll:

I believe we should add a small input pause before...

	@staticmethod
	def fido2_enroll(hsm_device: Fido2Device, dev_path: Path, password: Password) -> None:
		worker = SysCommandWorker(f'systemd-cryptenroll --fido2-device={hsm_device.path} {dev_path}', peek_output=True)
		pw_inputted = False
		pin_inputted = False

		info('You might need to touch the FIDO2 device to unlock it if no prompt comes up after 3 seconds')

		while worker.is_alive():
			if pw_inputted is False:
				if bytes(f'please enter current passphrase for disk {dev_path}', 'UTF-8') in worker._trace_log.lower():
					worker.write(bytes(password.plaintext, 'UTF-8'))
					pw_inputted = True
			elif pin_inputted is False:
				if bytes('please enter security token pin', 'UTF-8') in worker._trace_log.lower():
					worker.write(bytes(getpass.getpass(' '), 'UTF-8'))
					pin_inputted = True

Instead would prompt: ready to enroll {hsm_device.path} ? press any key to continue...
First that could reduce the while usage which is fragile, and also make it explicit since user presense is needed at this stage of the automated install (easy to miss in large output).

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Fields

    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions