Jay Taylor's notes

back to listing index

pallotron/yubiswitch

[web search]
Original source (github.com)
Tags: os-x Mac utility yubikey github.com
Clipped on: 2018-11-30
Skip to content
Image (Asset 1/7) alt= You have unread notifications
  • Image (Asset 2/7) alt=View RepositoryView repository on Sourcegraph
  • Watch
    23
  • Fork
    37

    • /yubiswitch

    OSX status bar application to enable/disable Yubikey Nano

    README.md

    yubiswitch

    Overview

    yubiswitch is an OSX status bar application to enable/disable a Yubikey Nano or Neo from Yubico.

    Yubico is the producer of the Yubikeys: an hardware authentication device, designed to provide an easy to use and secure compliment to the traditional username and password.

    By touching the exposed gold edge, a YubiKey Nano emits a One Time Password (OTP) as if it was typed in from a keyboard. The unique passcode is verified by a YubiKey compliant application.

    Image (Asset 4/7) alt=Download

    Download the latest version in DMG format from github release page here.

    Running

    This application needs to run with escalated privileges in order to exclusively grab the USB HID interface that drives the NANO/NEO-n Yubikey. Running the main app as root is a p.i.t.a. so Yubiswitch installs an helper daemon with root privileges which contains the logic to grab the USB HID interface, the main application talks to this daemon via XPC calls. When you start Yubiswitch for the first time it will ask for your user's password, this is expected to install the helper before mentioned.

    If you use your Yubikey as part of multi-factor authentication for Mac then you might want to make sure that the option "Enable yubiky when sytem locks/sleeps" is enabled.

    If want yubiswitch to lock your computer when you unplug the key make sure that your security settings are as follow:

    Image (Asset 5/7) alt=Integration with shell

    The application supports two basic AppleScript commands:

    • KeyOn
    • KeyOff

    You can switch your yubikey on and off using this basic osacript commands:

    $ osascript -e 'tell application "yubiswitch" to KeyOn'

    $ osascript -e 'tell application "yubiswitch" to KeyOff'

    How to find ProductID and VendorID

    To find the product and vendor ids, do the following in the terminal:

    $ ioreg -p IOUSB -l -w 0 -x | grep Yubikey -A10 | grep idProduct
          "idProduct" = 0x116
$ ioreg -p IOUSB -l -w 0 -x | grep Yubikey -A10 | grep idVendor
          "idVendor" = 0x1050

    note: the -x for ioreg is important for displaying the idProduct field in hexadecimal.

    If you have brew installed and prefer lsusb-style output:

    $ brew update && brew tap jlhonora/lsusb && brew install lsusb

$ lsusb | grep Yubikey
Bus 020 Device 022: ID 1050:0116 1050 Yubikey NEO OTP+U2F+CCID

    Screenshots

    Menu items in the status bar:

    Image (Asset 6/7) alt=Known Issues

    • The app's default settings support the Nano. If you have the neo, go into the app's Preferences by clicking on the menu icon, then set the the Product ID to 0x0114 (or whatever your ProductID is).
    • This app only works with recent version of OSX because it relies on the Notification Centre. OSX 10.8.x and above would do it. Sorry about that.

    TODO and future plans

    • Make hotkey configurable via configuration window, currently it's static and it is cmd-Y. (This is done via ShortcutRecorder now)
    • Use NSNotificationCenter to notify other classes (ie AppDelegate and YubiKey) when user preferences are changed
    • Add "Start at login" feature
    • Support for basic AppleScript comomands: KeyOn/KeyOff
    • Feature: lock computer when yubikey is removed (use IOServiceAddMatchingNotification in IOKit?)
    • Support more yubikeys nano on multiple USB slots
    • Better support for plug and unplug events (fixed with HID interface, dmg not published yet)
    • Feature: support all YubiCo devices without any configuration needed

    How to create DMG for distribution

    You need to make sure that you sign all applications and frameworks, also you need to make sure the dmg file is signed (the bash script createdmg.sh does this for you). You need to sign the app with an official Mac developer profile.

    When you want to create a release:

    • Tag repo with vx.y, ie git tag -a -m 'comment that describe the changes' v0.2
    • Compile release app bundle in Xcode
    • Run script: cd dmg/ && bash createdmg.sh
    • Get the file at /tmp/yubiswitch\_$VERSION.dmg and attach the binary to the release in the new release in the github page

    Dependencies

    yubiswitch uses ShortcutRecoder to implement global hot key and shortcuts recording in the the preference window.

    git submodule add git://github.com/Kentzo/ShortcutRecorder.git

    See this helpful page for instructions on how to set up your Xcode environment should you have any problem.

    How to uninstall

    Uninstallation process is pretty manual. Execute this as root:

    Kill all processes:

    # pkill -f com.pallotron.yubiswitch.helper

    Tell launchctl to stop the helper daemon:

    # launchctl stop com.pallotron.yubiswitch.helper
# launchctl remove com.pallotron.yubiswitch.helper

    Check that launchctl service is no longer there:

    # launchctl list | grep -i yubi

    Remove files from filesystem:

    # rm /Library/PrivilegedHelperTools/com.pallotron.yubiswitch.helper
# rm /Applications/yubiswitch.app/

    Maybe one day I will provide a script to do this.

    Credits

    Credits:

    • Anton Tolchanov (@knyar), he originally wrote this in Python using PyObjC bridge. I decided to port this into Objective-C to learn the language when I found out that Carbon Event Manager libs have been removed from Python3. See http://docs.python.org/2/library/carbon.html
    • @postwait for the USD HID device code
    Press h to open a hovercard with more details.