[GH-ISSUE #47] Implement PIV support #15

New issue

Closed

opened 2026-05-07 00:17:25 +02:00 by BreizhHardware · 2 comments

BreizhHardware commented

2026-05-07 00:17:25 +02:00

Owner

Originally created by @speed47 on GitHub (Nov 16, 2020).
Original GitHub issue: https://github.com/ovh/the-bastion/issues/47

By using ovh-yubico-piv-checker.
Parts of the support have already been open-sourced, namely:

The accountPIV plugin, to set the per-account policy
The cron/osh-piv-grace-reaper.pl script, to expire PIV grace periods
The accountInfo plugin, to report the status of the account PIV policy
a few internal helper functions

To get complete support we need to:

add PIV support to selfAddIngressKey/selfDelIngressKey
A global bastion-wide policy flag, if enforcing PIV for all accounts is desired

Originally created by @speed47 on GitHub (Nov 16, 2020). Original GitHub issue: https://github.com/ovh/the-bastion/issues/47 By using [ovh-yubico-piv-checker](https://github.com/ovh/yubico-piv-checker). Parts of the support have already been open-sourced, namely: - The `accountPIV` plugin, to set the per-account policy - The `cron/osh-piv-grace-reaper.pl` script, to expire PIV grace periods - The `accountInfo` plugin, to report the status of the account PIV policy - a few internal helper functions To get complete support we need to: - add PIV support to `selfAddIngressKey`/`selfDelIngressKey` - A global bastion-wide policy flag, if enforcing PIV for all accounts is desired