From 2473e1bfdeeb0ea7cc47a14811c29cc4801c8038 Mon Sep 17 00:00:00 2001
From: Chloe Surett <chloe@surett.me>
Date: Mon, 17 Nov 2025 11:57:09 -0500
Subject: ssh: T7483: Add fido2 PubkeyAuthOptions

---
 data/templates/ssh/sshd_config.j2 | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

(limited to 'data')

diff --git a/data/templates/ssh/sshd_config.j2 b/data/templates/ssh/sshd_config.j2
index d5d155340..32f7e23e7 100644
--- a/data/templates/ssh/sshd_config.j2
+++ b/data/templates/ssh/sshd_config.j2
@@ -72,6 +72,20 @@ HostKeyAlgorithms {{ hostkey_algorithm | join(',') }}
 PubkeyAcceptedAlgorithms {{ pubkey_accepted_algorithm | join(',') }}
 {% endif %}
 
+{% if fido is vyos_defined %}
+{%     set configured_pubkey_options = [] %}
+{%     if fido.pin_required is vyos_defined %}
+{%         do configured_pubkey_options.append('verify-required') %}
+{%     endif %}
+{%     if fido.touch_required is vyos_defined %}
+{%         do configured_pubkey_options.append('touch-required') %}
+{%     endif %}
+{%     if configured_pubkey_options | length > 0 %}
+# Sets one or more public key authentication options.
+PubkeyAuthOptions {{ configured_pubkey_options | join(' ') }}
+{%     endif %}
+{% endif %}
+
 {% if mac is vyos_defined %}
 # Specifies the available MAC (message authentication code) algorithms
 MACs {{ mac | join(',') }}
-- 
cgit v1.2.3