Sync from SUSE:SLFO:Main cockpit revision 339cbbf7872fe4e8138ad695e6155f72

0006-totp-motd.patch

@@ -0,0 +1,10 @@
+--- a/src/systemd/inactive.motd
++++ b/src/systemd/inactive.motd
+@@ -1,2 +1,7 @@
+ Activate the web console with: systemctl enable --now cockpit.socket
+ 
++Note: Cockpit disallows root login by default.
++To create a regular user and optionally enable 2FA run both:
++
++jeos-config user
++jeos-config otp

_scmsync.obsinfo

@@ -0,0 +1,4 @@
+mtime: 1727777011
+commit: 21d1ebacbb91c3907f48a5d9df03dd989adbc2050db1d3aac87b892c3ae84354
+url: https://src.suse.de/jzerebecki/cockpit
+revision: slfo

cockpit.changes

@@ -1,3 +1,13 @@
+-------------------------------------------------------------------
+Mon Sep 30 07:08:12 UTC 2024 - Alice Brooks <alice.brooks@suse.com>
+
+- add 0006-totp-motd.patch for guidance to enabling totp to the mtod
+
+-------------------------------------------------------------------
+Wed Sep 18 12:37:18 UTC 2024 - Jan Zerebecki <jan.suse@zerebecki.de>
+
+- support optional TOTP for authentication, requires pam_oath
+
 -------------------------------------------------------------------
 Mon Aug 20 11:44:33 UTC 2024 - Alice Brooks <alice.brooks@suse.com>
 

cockpit.pam

@@ -8,3 +8,4 @@ password include common-password
 session required pam_loginuid.so
 session optional pam_keyinit.so force revoke
 session include common-session
+auth [user_unknown=ignore success=ok] pam_oath.so usersfile=${HOME}/.pam_oath_usersfile no_usersfile_okay window=20 digits=6

cockpit.spec

@@ -69,6 +69,7 @@ Patch5:         storage-btrfs.patch
 # SLE Micro specific patches
 Patch101:       hide-pcp.patch
 Patch102:       0002-selinux-temporary-remove-setroubleshoot-section.patch
+Patch107:       0006-totp-motd.patch
 # For anything based on SLES 15 codebase (including Leap, SLE Micro)
 Patch103:       0004-leap-gnu18-removal.patch
 Patch104:       selinux_libdir.patch
@@ -225,6 +226,7 @@ BuildRequires:  python3-tox-current-env
 %patch -P 4 -p1
 %patch -P 5 -p1
 %patch -P 106 -p1
+%patch -P 107 -p1
 
 # SLE Micro specific patches
 %if 0%{?is_smo}
@@ -519,6 +521,7 @@ Requires: cockpit-bridge >= %{version}-%{release}
 Requires: shadow-utils
 %endif
 Requires: grep
+Requires: jeos-firstboot
 Requires: /usr/bin/pwscore
 Requires: /usr/bin/date
 Provides: cockpit-shell = %{version}-%{release}
@@ -568,6 +571,7 @@ Suggests: sssd-dbus >= 2.6.2
 %if 0%{?suse_version}
 Requires(pre): permissions
 Requires: distribution-logos
+Requires: pam_oath >= 2.6.11.12
 Requires: wallpaper-branding
 %endif
 # for cockpit-desktop