1

I just bought a Yubikey 5 NFC and have set it up per their instructions on Ubuntu 19.04. But my preferred use case is to use the key as passwordless option (if it's plugged in; allow access - if it's not; enter password).

I've found some topics on this here and here but both are either not for a Yubikey or not for Ubuntu. And I'm too inexperienced with these things to blindly fiddle with settings as there is a good chance I'd get locked out forever if I do something wrong.

So I know the Yubikey 5 supports passwordless login for Windows, I figure it must be available on Ubuntu somehow, right? Does anyone have a tip for me?

Edit: To give some context to the valid point made below that this setup wouldn't increase security, matter of fact, would lower it: Yes, I know, very true indeed. However in my case I work mostly from my own (secured) home, but am a stickler for very complicated passwords. However it is slowing me down I have to enter a very long password each time my laptop idles too long, so for when I'm at home, I'd like to be able to use just the key, and if I'm away, leave the key at home and just use a password.

Edit2: Thanks to hackerb9's answer and running through the Yubico install steps again I got it to work. Essentially all I did different was to add auth sufficient pam_u2f.so to both /etc/pam.d/gdm-password and /etc/pam.d/sudo instead of @include common-u2f (which would result in auth sufficient pam_u2f.so authfile=/etc/u2f_mappings cue). So essentially just removed authfile=/etc/u2f_mappings cue did the trick. I'm not 100% sure but I think this is due a 'setup conflict' as I set up the key before attempting this.

1
+50

You're right to be worried about locking yourself out. If your home directory is encrypted and you keep a Two-Factor Authentication authorization mapping file there, you will not be able to log in! That's why I always use a central authfile (/etc/u2f_mappings).

I suggest creating a second account while testing so you don't lock yourself out of your main account. Also, be sure to get a second 2FA key and register it as a backup in case you lose the first one.

How to enable passwordless login

Although you should be careful, the process is easy and straightforward. To make it even easier, I've written this so you can simply cut and paste the following commands into a terminal:

  1. sudo -i
  2. apt install libpam-u2f
  3. pamu2fcfg | tee /etc/u2f_mappings

    # (At this point, press the button. You should see a long string of numbers. If you don't, make sure you have udev setup correctly.)

  4. cd /etc/pam.d

  5. echo 'auth sufficient pam_u2f.so authfile=/etc/u2f_mappings cue' > common-u2f

  6. for f in gdm-password lightdm sudo login; do

    mv $f $f~

    awk '/@include common-auth/ {print "@include common-u2f"}; {print}' $f~ > $f

    done

  7. exit

Notes

  • When logging in, you'll be prompted to touch your device if it is detected Otherwise, you'll be asked to type in a password.

  • We use the term "sufficient" above so that either the password or the U2F key are sufficient to login (as requested in the question). For a more typical Two-factor Authentication login, "sufficient" would be replaced by the word "required" so that both would always be needed.

  • The u2f line in the pam.d files must come before @include common-auth, otherwise you'll be required to type in a password before the U2F key is checked.

  • I would be remiss if I didn't point out that using a "2FA" key in this way, while convenient, does not increase your security. In fact, you've only opened a second way to get into your account. But, that's not necessarily bad; not everybody needs high-security and a dongle like this can save you from having an easy to type, short, and vulnerable password.

And so much more!

By the way, these instructions aren't just for devices from Yubico. I'm using a key from Solokeys and it works great. Additionally, the setup works for both USB and NFC keys.

If you need more information, Yubico's instructions — as mentioned in the original question — are fairly informative. Also, see the man pages for pam_u2f and pamu2fcfg.

  • Thanks for the abundant answer! Pasting your commands and following along went fine until the last step where I'm not to sure if the formatting of the copy/paste was the issue but I got this back a couple of tries; mv: cannot stat 'lightdm': No such file or directory awk: cannot open lightdm~ (No such file or directory) Which would make sense because i'm on ubuntu 19.04 and that uses gdm as far as I know. Do you have any clues for that one as well? – Alex Timmer Sep 9 at 15:31
  • Just go ahead and ignore that error. I just put that in in case someone with an old version of Ubuntu comes across this answer. – hackerb9 Sep 10 at 3:51
  • OK! Well then, I followed everything else and rebooted, but no difference. If I leave the key out and just enter my password; it fails. If I just press the key, it fails. It only still logs in with a combination of both. In your notes you state "The u2f line in the pam.d files must come before @include common-auth, otherwise you'll be required to type in a password before the U2F key is checked. ". In what files should that line be? I have the random string of numbers in /etc/u2f_mappings and /etc/pam.d/common-u2f is empty except for that line from command #5. Am I missing something? – Alex Timmer Sep 10 at 7:38
  • It is requiring both? It should not do that if you used the word "sufficient". Perhaps there was some other change made to /etc/pam.d/gdm-password? What does grep u2f /etc/pam.d/* say? Try adding the word debug after the word "cue" in line 5 to get debug info. – hackerb9 Sep 10 at 15:18
  • The file which must have @include common-u2f before @include common-auth is /etc/pam.d/gdm-password. (Or, if you are trying sudo, /etc/pam.d/sudo). However, that is not the problem you are experiencing since you said the password alone fails. Using sufficient means that either method will work. By the way, you do not need to reboot or anything like that. Changes to the pam files are immediate. You can test u2f using sudo -k ls, so you don't even need to log out. – hackerb9 Sep 10 at 15:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.