pam_u2f: also require first factor?

[shosti]

pam_u2f is currently always configured as being "sufficient", so no password is necessary if U2F authentication succeeds. It would be nice if it were optionally "requisite" instead (similarly to #22724 for OATH), since U2F is designed for second-factor auth after all.

[vlaci]

I've written a module to override the default behavior:
https://gist.github.com/vlaci/80bebce47a8ac6770035d362b3d004e0

I've used to hardcode PAM configuration to overcome this limitation but it was really brittle because every time the list of installed services changed I had to remember to look into the generated service file and copy-paste the modified version back to configuration.nix.

The module works via extending the default PAM service configuration with a hook which replaces the default rule corresponding to pam_u2f.so in the service's text attribute. This way the configuration remain customizable via the security.pam module.

[benley]

It looks like this is configurable now, with:

{
  security.pam.u2f.control = "required";
}