Commit f22be10e4537

@@ -393,6 +393,38 @@ setup_wireguard() {
 	log_warn "Then re-run:  sudo systemctl restart wg-quick@wg0"
 }
 
+# --- Phase 7: YubiKey sudo (pam-u2f) ---
+
+setup_yubikey_sudo() {
+	if ! rpm -q pam-u2f &>/dev/null; then
+		log_info "Installing pam-u2f..."
+		sudo dnf install -y pam-u2f pamu2fcfg
+	else
+		log_info "pam-u2f already installed"
+	fi
+
+	local u2f_keys="${HOME}/.config/Yubico/u2f_keys"
+	if [[ ! -f "$u2f_keys" ]]; then
+		log_info "Registering YubiKey for PAM U2F — touch the key when it blinks..."
+		mkdir -p "$(dirname "$u2f_keys")"
+		pamu2fcfg >"$u2f_keys"
+		log_info "YubiKey registered at $u2f_keys"
+		log_warn "To add a backup key later: pamu2fcfg -n >> $u2f_keys"
+	else
+		log_info "YubiKey already registered at $u2f_keys"
+	fi
+
+	# Configure sudo to accept YubiKey touch (sufficient = no password needed)
+	local sudo_pam="/etc/pam.d/sudo"
+	if ! grep -q pam_u2f.so "$sudo_pam" 2>/dev/null; then
+		log_info "Adding pam_u2f to $sudo_pam (sufficient — falls back to password)..."
+		sudo sed -i '1a auth       sufficient   pam_u2f.so' "$sudo_pam"
+		log_info "YubiKey sudo configured"
+	else
+		log_info "pam_u2f already in $sudo_pam"
+	fi
+}
+
 # --- Phase 7: CRC (OpenShift Local) ---
 
 setup_crc() {
@@ -508,6 +540,7 @@ main() {
 	setup_unscd
 	build_and_activate
 	setup_wireguard
+	setup_yubikey_sudo
 	setup_shell
 	setup_home_manager
 	setup_crc

@@ -273,6 +273,38 @@ setup_luks_fido2() {
 	fi
 }
 
+# --- Phase 7b: YubiKey sudo (pam-u2f) ---
+
+setup_yubikey_sudo() {
+	if ! rpm -q pam-u2f &>/dev/null; then
+		log_info "Installing pam-u2f..."
+		sudo dnf install -y pam-u2f pamu2fcfg
+	else
+		log_info "pam-u2f already installed"
+	fi
+
+	local u2f_keys="${HOME}/.config/Yubico/u2f_keys"
+	if [[ ! -f "$u2f_keys" ]]; then
+		log_info "Registering YubiKey for PAM U2F — touch the key when it blinks..."
+		mkdir -p "$(dirname "$u2f_keys")"
+		pamu2fcfg >"$u2f_keys"
+		log_info "YubiKey registered at $u2f_keys"
+		log_warn "To add a backup key later: pamu2fcfg -n >> $u2f_keys"
+	else
+		log_info "YubiKey already registered at $u2f_keys"
+	fi
+
+	# Configure sudo to accept YubiKey touch (sufficient = no password needed)
+	local sudo_pam="/etc/pam.d/sudo"
+	if ! grep -q pam_u2f.so "$sudo_pam" 2>/dev/null; then
+		log_info "Adding pam_u2f to $sudo_pam (sufficient — falls back to password)..."
+		sudo sed -i '1a auth       sufficient   pam_u2f.so' "$sudo_pam"
+		log_info "YubiKey sudo configured"
+	else
+		log_info "pam_u2f already in $sudo_pam"
+	fi
+}
+
 # --- Phase 8: unscd for nix NSS resolution ---
 
 setup_unscd() {
@@ -427,6 +459,7 @@ main() {
 	setup_unscd
 	setup_system_configs
 	setup_wireguard
+	setup_yubikey_sudo
 	setup_shell
 	setup_home_manager
 	print_summary