![]() When prompted, enter your password and press Enter. Open a new Terminal and run sudo echo test again.If the authentication succeeds without the U2F Key, that indicates the U2F PAM module was not installed or there is a typo in the changes you made to /etc/pam.d/sudo. Even with the correct password, the authentication should fail as the U2F Key is not plugged in.In the new Terminal, run: sudo echo test.Be sure you do not close the Terminal window, otherwise you will not be able to revert the changes. Press Ctrl+O and then Enter to save the file.Note: If you have moved the u2f_keys file to /etc/Yubico/u2f_keys as mentioned in section 3, you will need to append authfile and a path to the PAM configuration, as shown below:Īuth required pam_u2f.so authfile=/etc/Yubico/u2f_keys Add the line below after the common-auth” line.This section covers how to require the YubiKey when using the sudo command, which should be used as a test so that you do not lock yourself out of your computer. This will cause you to be locked out once you reset the machineĤ Configuring the System to Use the U2F Keys 4.1 Test Configuration with the Sudo Command The most common cause is encrypted /home/ folder which will not be readable by root. Warning: By enabling using this process if the files are not readable by users it will cause you to be locked out of your system. Warning: Please note that once you modify the /etc/pam.d/sudo file to require the YubiKey if you were to lose or misplace the YubiKey you will not be able to modify or change the file to remove the YubiKey requirement. This is normally found on the path /usr/lib/x86_64-linux-gnu/security/pam_u2f.so, but this could be different depending on setup. This is done by add " authfile=/etc/Yubico/u2f_keys " to the end of the line of file for pam_u2f.so within the file needed for authentication. Once the u2f_keys file is moved to a safer location the PAM file will need to be modified so that u2f PAM module can find the u2f_keys file. You can then move the file from ~/.config/Yubico to /etc/Yubico by running the command ( sudo mv ~/.config/Yubico/u2f_keys /etc /Yubico/u2f_keys ). After creating a directory named Yubico ( e.g. If you would like to add additional layer of security you can change the output of the u2f_keys file to an area of the OS where you'll need sudo permission to edit the file ( e.g. Run: pamu2fcfg -n > ~/.config/Yubico/u2f_keys.Warning: Having a backup device is strongly recommended so that if your device is lost or broken, you will not be locked out of your computer. If you do not have a backup device available at this time, you can add one later using the steps below as long as you still have access to your account. If you have backup devices, use the steps below to associate them with your account. When your device begins flashing, touch the metal contact to confirm the association.Run: pamu2fcfg > ~/.config/Yubico/u2f_keys.If you haven’t already, Enable the Yubico PPA and f ollow the steps in Using Your U2F YubiKey with Linux.ģ Associating the U2F Key(s) With Your Account.See here for an article geared towards Red Hat and its derivatives. The commands in the guide are for an Ubuntu (or Ubuntu based) system, but the instructions can be adapted for any distribution of Linux. This does not work with remote logins via SSH or other methods. This guide covers how to secure a local Linux login using the U2F feature on YubiKeys and Security Keys. ![]() For more information on the issue, please see the Yubico security advisory here. Most Linux users will want to update via their distribution's package manager (APT, in the case of Ubuntu), but the source code for 1.1.1 is also available on. It is recommended that all users of pam-u2f update to version 1.1.1, which addresses this issue. ![]() Note: Although this guide does not cover configuring pam-u2f to require PIN authentication, note that there is a logic issue in pam-u2f 1.1.0 that, depending on the configuration and the application used, could lead to a local PIN bypass.
0 Comments
Leave a Reply. |