[pve-devel] [RFC/Draft] U2F Authentication

[Wolfgang Bumiller]

This is an attempt at adding U2F authentication. This is a little
different than our current 2FA variant, since it requires the user to be
able to interactively add/update/delete the U2F key, and also (mostly)
requires the login to happen in two phases which required some changes
to our ticket system: In addition to regular tickets there's now a
special u2f ticket syntax which, after the initial login and before the
verification happened, contains the challenge the client has to
recognize and deal with by sending it off to the u2f device.

Notes:
  * Currently this adds libu2f-server bindings to pve-access-control
    (via xs), which therefore now depends on that library. We can add
    this as a "suggested" or "recommended" package, and/or split the
    bindings into a libpve-u2f-perl package or something...

  * Since we need to store the key somewhere, this is currently working
    for the PVE realm for the testing phase. We can either leave it up
    to the authentication plugin to store the data (eg. ldap could maybe
    store it on the ldap server?) or just decide on sticking it all
    somewhere in /etc/priv and keep it plugin independent. (That's
    probably a simpler approach anyway)

  * UI and JS part probably need some polishing by people who're more
    enthusiastic about javascript ;-)

To test:
  * Setup working certificates (needs to be green in your browser)
  * Configure the u2f appid and origin (we might be able to do that
    automatically - especially now with the additional certificate
    helpers from the let's encrypt part we should be able to figure out
    a default domain/url that way...
    datacenter.cfg example:

       u2f: appid=https://awesomecluster.foo.bar:8006,origin=https://awesomecluster.foo.bar:8006