#[1]SCHULZ:DK » Feed [2]SCHULZ:DK » Comments Feed [3]SCHULZ:DK » Using SoloKey for Linux Login Comments Feed [4]alternate [5]alternate [6]alternate ([7]BUTTON) Toggle navigation * [8]Home * [9]Categories + [10]projects + [11]News + [12]Code + [13]Gadgets + [14]Security + [15]Links + [16]Quotes + [17]Misc * [18]Gallery * [19]Projects * [20]About * [21]Contact Using SoloKey for Linux Login [22][INLINE] Using SoloKey for Linux Login * [23]1 * 282 * August 23, 2019 * [24]Kim Schulz * [25]Misc [26]Security So [27]yesterday I told about the security keys I use and today I thought I would tell a bit about how I use the [28]SoloKey as an extra security precaution on my Linux computers. So first thing first: This would not (yet) be possible with some groundwork done by the team from [29]Yubico. They have created the PAM (Plugable Authentication Module) module needed for doing U2F authentication. This is also why we get the software from them in the first place (it is also [30]available from github if you want to verify or modify the source code. Installation I primarily use Ubuntu and Arch linux on my machines but in this I will describe how to install it in these Linux distributions. Arch Linux: sudo pacman -S pam-u2f Ubuntu Linux: sudo add-apt-repository ppa:yubico/stable && sudo apt update sudi apt install libpam-u2f In order for your SoloKey to get recognized by the udev system in Linux, you will have to add a rule for it to udev. This is done by creating a new udev rule file: sudo vim /etc/udev/rules.d/70-solokeys.rules Add the following lines to the file and save it: ACTION!="add|change", GOTO="solokeys_end" # SoloKeys rule KERNEL=="hidraw*", SUBSYSTEM=="hidraw", ATTRS{idVendor}=="0483", ATTRS{idProduct}=="a2ca", TAG+="uaccess" LABEL="solokeys_end" Reload udev so the new rule will be active: sudo udevadm control --reload-rules Now you are ready to use your [31]solokey in Linux and can move on to configuring pam. Configuration Now that we have the pam module installed, it is time to add your SoloKey to it. I have chosen to have my configuration for my user as a personal configuration in my home folder. This can also be done via /etc but I will not cover that this time. Create the configuration folder for the keys storage: mkdir ~/.config/Yubico It is important that it is called Yubico exactly as here, as the pam module is hardcoded to use this location. The pam module comes with a configration tool that can be used to create the keys-strings in the configration for your SoloKeys. Simply plugin your solokey into the USB port and then in a terminal run the following command: pamu2fcfg > ~/.config/Yubico/u2f_keys Again the file name is important. Your [32]SoloKey will start to blink and this means you need to press the key. Notice that sometimes you have to hold down the button for a second or so for it to react. When pamu2fcfg has Identified your device it will let you know in the console. It is highly recommended to have a backup key as you will be completely locked out if your only key gets stolen, breaks or something. If you add another key, then it is very important that you do not use the previous command for the new key but instead use the following (it adds a newline and appends to the file instead of overwriting it): pamu2fcfg -n >> ~/.config/Yubico/u2f_keys SoloKeys and sudo Now your key is registered and ready for PAM to use it. The best way to test this is to change the authorization scheme for the sudo command. Before doing so, please do consider to open an extra terminal and change to become root with the “sudo su” or “sudo /bin/bash” command. This way you will have a way to get in and disable your changes if something has gone wrong. Now you can change the pam config file for sudo: sudo vim /etc/pam.d/sudo Find a line near the begining of the file that looks like: @include common-auth and add the following line right after it: auth required pam_u2f.so This says that afther the common login (your normal sudo password prompt) you will be requested to use pam_u2f (your solokey). save the file and then try something simple like: sudo echo "SoloKeys rock" if no SoloKey is inserted into the usb port then it will fail after the password was written. If the soloKey is inserted then it will start blink and you will then have around 10 seconds to press the button on the solokey. Again you might have to hold the button for a second or so for it to get registered. If everything has gone as planned, then you will see it print “SoloKeys Rock” to the terminal. SoloKeys and the desktop Now you are ready to change your desktop login to use the key as well. The procedure is the same, but this time look for the pam config file called : /etc/pam.d/gdm-password # if you use gdm for login /etc/pam.d/lightdm # if you use lightdm Add the line to the file the same way and same location as described above for sudo. After this point you can log out of your desktop and then try to login again. You login will fail if you do not have the solokey inserted in the USB port. The solokey will blink after you inserted your password and then you need to press the button to get fully logged into your desktop. You can do the same change for other files in /etc/pam.d/ so if you for instance use the gnome screensaver, then you can add the line to /etc/pam.d/gnome-screensaver and if you will require it for the common console login (if you boot up without desktop or run a server, then you can add it to /etc/pam.d/login). A note of warning: You can get really locked out of your system if you do not do this the right way. If that happens, then boot your system in recovery mode or (single mode) and then revert your changes. Hope this helps getting you to love your [33]SoloKey even more – I know I did! PS: this will of course also work with OnlyKey U2F and yubikeys. Post tags: [34]archlinux [35]hardware [36]linux [37]onlykey [38]password [39]security [40]solokey [41]solokeys [42]ubuntu [43]yubico [44]yubikey _________________________________________________________________________________________________________________________________________________________________________________________________________________________________ [45]« Security keys – everyone should have at least one! [46]Password-less linux login with SoloKeys » About Kim Schulz [47]author Kim is a software engineer with a great interest for everything with gadgets, programming, photography and tech in general. He works for Samsung Research Center Denmark where he looks into innovations, Wireless tech, bluetooth standards and Android development. Spare time is spend with the family, hardware hacking, cooking , BBQ competitions, photography and travel. 9 Comments [48][INLINE] Michael August 27, 2019 @ 21:58 Thank-you! This is brilliant. Worked perfectly. [49]Reply [50][INLINE] Kim Schulz August 28, 2019 @ 06:00 I am glad that it works for you. [51]Reply [52][INLINE] Christopher Moreira February 18, 2020 @ 23:27 Is there a guide for installing onto CentOS 7 and CentOS 8? [53]Reply [54][INLINE] Christopher Moreira February 27, 2020 @ 19:59 On Ubuntu 14.04 I had to install pamu2fcfg: sudo apt-get -y install pamu2fcfg [55]Reply [56][INLINE] Christopher Moreira March 7, 2020 @ 18:27 To replace a key: pamu2fcfg >> ~/.config/Yubico/u2f_keys Then, remove everything before the next “ubuntu:” entry. nano ~/.config/Yubico/u2f_keys You’ll see something like: ubuntu:1aoIRCptSzwm1Yz_gSmKze2901d1U1lkdhmk5KZrCI532tuiPI_rKqWJYBKwQGAt,045bec2a7c1c42590111e7f46e1fbdefed4f0c91a607b0ba96db210a9e914181417fb3c0898e70e41c566578952655d1745d21af3fc1b35f0d5db86718a27509dcubuntu:1aoIRCptSzwm1Yz_mSmKz e2901d1U1lkdhmk5KZrCI532tuiPI_rKqWJYBKwQGAt,045bec2a7c1c42590111d7f46e1fbdef0d4f0c91a607b0ba96db210a9e914181417fb3c0898e70e41c566578952655d1745d21ef3fc1b35f0ds1b867d8a27509dc So just remove everything before the second ‘ubuntu:’ entry and only the new key will be relevant when logging in. [57]Reply [58][INLINE] alin May 23, 2020 @ 14:00 cool just a comment one can change the file location authfile option something like auth sufficient pam_u2f.so debug authfile=/root/.config/solokeys [59]Reply [60][INLINE] Kim Schulz May 23, 2020 @ 20:21 Thanks. The thing is that the system normally uses an auth file per user so it would require that it works with dynamic path like /home/$USER/.config/solokeys/ [61]Reply [62][INLINE] S April 24, 2021 @ 13:15 Great tutorial thanks a lot! Is it possible to use this U2F in addition to the encryption passphrase for the encryption of the disc before login in? [63]Reply Leave Comment [64]or cancel reply [65]________________________________________________________________________________________________ [66]________________________________________________________________________________________________ [67]________________________________________________________________________________________________ [68]________________________________________________________________________________________________ [69]________________________________________________________________________________________________ [70]________________________________________________________________________________________________ [71]________________________________________________________________________________________________ [72]________________________________________________________________________________________________ [73]________________________________________________________________________________________________ [74]________________________________________________________________________________________________ You may use these HTML tags and attributes:
[75]____________________ [76]____________________ [77]Send Comment [78]_________________________________________ [79]_________________________________________ [80]_________________________________________ [81]_________________________________________ [82]_________________________________________ [83]_________________________________________ [84]_________________________________________ [85]_________________________________________ This site uses Akismet to reduce spam. [86]Learn how your comment data is processed. Search [87]____________________ ([88]BUTTON) Search Recent Posts * [89]Recent * [90]Popular * [91]Views * [92][LINK]-[93][IMAGE] [94]Who shares private social security number online?!?! 0 comments * [95][LINK]-[96][IMAGE] [97]Try Hack Me – 100 days after 0 comments * [98][LINK]-[99][IMAGE] [100]Bash faulty pasting tip 0 comments * [101][LINK]-[102][IMAGE] [103]Computer Security – for fun and profit 1 comment * [104]OpenSSH logos-[105][IMAGE] [106]Official U2F/FIDO support in OpenSSH 0 comments Categories * [107]Code (2) * [108]Misc (13) * [109]News (4) * [110]Privacy (1) * [111]projects (2) * [112]Quote (1) * [113]Security (9) * [114]Vim (1) Subscribe [115]____________________ Tags [116]android [117]archlinux [118]bash [119]bell labs [120]C [121]code [122]codegolf [123]denmark [124]fido2 [125]firewall [126]fun [127]game [128]golfing [129]hacking [130]hardware [131]ios [132]learning [133]linux [134]malware [135]onlykey [136]openssh [137]OSX [138]password [139]programming [140]quote [141]remote desktop [142]security [143]shell [144]solokey [145]solokeys [146]sundhedskortet [147]thm [148]tip [149]tips [150]training [151]trick [152]tricks [153]tryhackme [154]u2f [155]ubuntu [156]unix [157]vim [158]windows [159]yubico [160]yubikey Recent Comments * [161][INLINE] S [162]Great tutorial thanks a lot! Is it... * [163][INLINE] [164]Try Hack Me - 100 days after - SCHULZ:DK [165][…] in December I wrote about... * [166][INLINE] [167]Official U2F/FIDO support in OpenSSH - SCHULZ:DK [168][…] have previously given an... * [169][INLINE] [170]Kim Schulz [171]It seems like it was removed from... * [172][INLINE] [173]Kim Schulz [174]Not if you literally write that as a... Follow me Instagram Gallery Username field is empty. Find me on Github [175]Kim Schulz Kim Schulzkimusan Software engineer by day time - hardware hacker by night time. [176]Follow * [177]Repositories232 * [178]Followers20 * Aalborg, Denmark * [179]http://www.schulz.dk References Visible links 1. https://schulz.dk/feed/ 2. https://schulz.dk/comments/feed/ 3. https://schulz.dk/2019/08/23/using-solokey-for-linux-login/feed/ 4. https://schulz.dk/wp-json/wp/v2/posts/678 5. https://schulz.dk/wp-json/oembed/1.0/embed?url=https://schulz.dk/2019/08/23/using-solokey-for-linux-login/ 6. https://schulz.dk/wp-json/oembed/1.0/embed?url=https://schulz.dk/2019/08/23/using-solokey-for-linux-login/&format=xml 7. form field = submit button 8. https://schulz.dk/ 9. https://schulz.dk/2019/08/23/using-solokey-for-linux-login/ 10. https://schulz.dk/category/projects/ 11. https://schulz.dk/category/news/ 12. https://schulz.dk/category/code/ 13. https://schulz.dk/category/gadgets/ 14. https://schulz.dk/category/security/ 15. https://schulz.dk/category/link/ 16. https://schulz.dk/category/quote/ 17. https://schulz.dk/category/misc/ 18. http://www.colorsofblack.com/ 19. https://schulz.dk/projects/ 20. https://schulz.dk/about/ 21. https://schulz.dk/contact-me/ 22. https://schulz.dk/wp-content/uploads/2019/08/micah-williams-lmFJOx7hPc4-unsplash-800x450.jpg 23. javascript:; 24. https://schulz.dk/author/admin/ 25. https://schulz.dk/category/misc/ 26. https://schulz.dk/category/security/ 27. https://schulz.dk/2019/08/22/security-keys-for-everyone/ 28. https://solokeys.com/discount/kim-schulz 29. https://yubico.com/ 30. https://github.com/Yubico/pam-u2f 31. https://solokeys.com/discount/kim-schulz 32. https://solokeys.com/discount/kim-schulz 33. https://solokeys.com/discount/kim-schulz 34. https://schulz.dk/tag/archlinux/ 35. https://schulz.dk/tag/hardware/ 36. https://schulz.dk/tag/linux/ 37. https://schulz.dk/tag/onlykey/ 38. https://schulz.dk/tag/password/ 39. https://schulz.dk/tag/security/ 40. https://schulz.dk/tag/solokey/ 41. https://schulz.dk/tag/solokeys/ 42. https://schulz.dk/tag/ubuntu/ 43. https://schulz.dk/tag/yubico/ 44. https://schulz.dk/tag/yubikey/ 45. https://schulz.dk/2019/08/22/security-keys-for-everyone/ 46. https://schulz.dk/2019/08/24/password-less-linux-login-with-solokeys/ 47. https://schulz.dk/wp-content/uploads/2016/12/kim_1-e1483019874910.jpg 48. https://schulz.dk/wp-content/plugins/wp-user-avatar/deprecated/wp-user-avatar/images/wpua-150x150.png 49. https://schulz.dk/2019/08/23/using-solokey-for-linux-login/#comment-159 50. https://schulz.dk/wp-content/uploads/2016/12/kim_1-e1483019874910.jpg 51. https://schulz.dk/2019/08/23/using-solokey-for-linux-login/#comment-160 52. https://schulz.dk/wp-content/plugins/wp-user-avatar/deprecated/wp-user-avatar/images/wpua-150x150.png 53. https://schulz.dk/2019/08/23/using-solokey-for-linux-login/#comment-531 54. https://schulz.dk/wp-content/plugins/wp-user-avatar/deprecated/wp-user-avatar/images/wpua-150x150.png 55. https://schulz.dk/2019/08/23/using-solokey-for-linux-login/#comment-534 56. https://schulz.dk/wp-content/plugins/wp-user-avatar/deprecated/wp-user-avatar/images/wpua-150x150.png 57. https://schulz.dk/2019/08/23/using-solokey-for-linux-login/#comment-537 58. https://schulz.dk/wp-content/plugins/wp-user-avatar/deprecated/wp-user-avatar/images/wpua-150x150.png 59. https://schulz.dk/2019/08/23/using-solokey-for-linux-login/#comment-550 60. https://schulz.dk/wp-content/uploads/2016/12/kim_1-e1483019874910.jpg 61. https://schulz.dk/2019/08/23/using-solokey-for-linux-login/#comment-551 62. https://schulz.dk/wp-content/plugins/wp-user-avatar/deprecated/wp-user-avatar/images/wpua-150x150.png 63. https://schulz.dk/2019/08/23/using-solokey-for-linux-login/#comment-672 64. https://schulz.dk/2019/08/23/using-solokey-for-linux-login/#respond 65. form field = text entry area 66. form field = text entry area 67. form field = text entry area 68. form field = text entry area 69. form field = text entry area 70. form field = text entry area 71. form field = text entry area 72. form field = text entry area 73. form field = text entry area 74. form field = text entry area 75. form field = text entry field 76. form field = text entry field 77. form field = submit button 78. form field = text entry area 79. form field = text entry area 80. form field = text entry area 81. form field = text entry area 82. form field = text entry area 83. form field = text entry area 84. form field = text entry area 85. form field = text entry area 86. https://akismet.com/privacy/ 87. form field = text entry field 88. form field = submit button 89. https://schulz.dk/2019/08/23/using-solokey-for-linux-login/#recent_Ni0fo2sSNo 90. https://schulz.dk/2019/08/23/using-solokey-for-linux-login/#popular_Ni0fo2sSNo 91. https://schulz.dk/2019/08/23/using-solokey-for-linux-login/#views_Ni0fo2sSNo 92. https://schulz.dk/2021/06/04/who-shares-private-social-security-number-online/ 93. https://schulz.dk/wp-content/uploads/2021/06/sundhedskortet-800x450.jpg 94. https://schulz.dk/2021/06/04/who-shares-private-social-security-number-online/ 95. https://schulz.dk/2021/03/19/try-hack-me-100-days-after/ 96. https://schulz.dk/wp-content/uploads/2021/03/thm-networks-banner-800x450.png 97. https://schulz.dk/2021/03/19/try-hack-me-100-days-after/ 98. https://schulz.dk/2021/01/26/bash-faulty-pasting-tip/ 99. https://schulz.dk/wp-content/uploads/2021/01/better-paste-800x450.png 100. https://schulz.dk/2021/01/26/bash-faulty-pasting-tip/ 101. https://schulz.dk/2020/12/04/computer-security-for-fun-and-profit/ 102. https://schulz.dk/wp-content/uploads/2020/12/THM-leaderboard-no1-800x450.png 103. https://schulz.dk/2020/12/04/computer-security-for-fun-and-profit/ 104. https://schulz.dk/2020/09/01/u2f-fido-in-openssh-update/ 105. https://schulz.dk/wp-content/uploads/2019/11/opensshimg-800x450.jpg 106. https://schulz.dk/2020/09/01/u2f-fido-in-openssh-update/ 107. https://schulz.dk/category/code/ 108. https://schulz.dk/category/misc/ 109. https://schulz.dk/category/news/ 110. https://schulz.dk/category/privacy/ 111. https://schulz.dk/category/projects/ 112. https://schulz.dk/category/quote/ 113. https://schulz.dk/category/security/ 114. https://schulz.dk/category/vim/ 115. form field = text entry field 116. https://schulz.dk/tag/android/ 117. https://schulz.dk/tag/archlinux/ 118. https://schulz.dk/tag/bash/ 119. https://schulz.dk/tag/bell-labs/ 120. https://schulz.dk/tag/c/ 121. https://schulz.dk/tag/code/ 122. https://schulz.dk/tag/codegolf/ 123. https://schulz.dk/tag/denmark/ 124. https://schulz.dk/tag/fido2/ 125. https://schulz.dk/tag/firewall/ 126. https://schulz.dk/tag/fun/ 127. https://schulz.dk/tag/game/ 128. https://schulz.dk/tag/golfing/ 129. https://schulz.dk/tag/hacking/ 130. https://schulz.dk/tag/hardware/ 131. https://schulz.dk/tag/ios/ 132. https://schulz.dk/tag/learning/ 133. https://schulz.dk/tag/linux/ 134. https://schulz.dk/tag/malware/ 135. https://schulz.dk/tag/onlykey/ 136. https://schulz.dk/tag/openssh/ 137. https://schulz.dk/tag/osx/ 138. https://schulz.dk/tag/password/ 139. https://schulz.dk/tag/programming/ 140. https://schulz.dk/tag/quote-2/ 141. https://schulz.dk/tag/remote-desktop/ 142. https://schulz.dk/tag/security/ 143. https://schulz.dk/tag/shell/ 144. https://schulz.dk/tag/solokey/ 145. https://schulz.dk/tag/solokeys/ 146. https://schulz.dk/tag/sundhedskortet/ 147. https://schulz.dk/tag/thm/ 148. https://schulz.dk/tag/tip/ 149. https://schulz.dk/tag/tips/ 150. https://schulz.dk/tag/training/ 151. https://schulz.dk/tag/trick/ 152. https://schulz.dk/tag/tricks/ 153. https://schulz.dk/tag/tryhackme/ 154. https://schulz.dk/tag/u2f/ 155. https://schulz.dk/tag/ubuntu/ 156. https://schulz.dk/tag/unix/ 157. https://schulz.dk/tag/vim/ 158. https://schulz.dk/tag/windows/ 159. https://schulz.dk/tag/yubico/ 160. https://schulz.dk/tag/yubikey/ 161. https://schulz.dk/wp-content/plugins/wp-user-avatar/deprecated/wp-user-avatar/images/wpua-96x96.png 162. https://schulz.dk/2019/08/23/using-solokey-for-linux-login/#comment-672 163. https://schulz.dk/wp-content/plugins/wp-user-avatar/deprecated/wp-user-avatar/images/wpua-96x96.png 164. https://schulz.dk/2021/03/19/try-hack-me-100-days-after/ 165. https://schulz.dk/2020/12/04/computer-security-for-fun-and-profit/#comment-670 166. https://schulz.dk/wp-content/plugins/wp-user-avatar/deprecated/wp-user-avatar/images/wpua-96x96.png 167. https://schulz.dk/2020/09/01/u2f-fido-in-openssh-update/ 168. https://schulz.dk/2019/11/04/openssh-support-for-u2f-fido2/#comment-655 169. https://schulz.dk/wp-content/uploads/2016/12/kim_1-e1483019874910.jpg 170. http://www.schulz.dk/ 171. https://schulz.dk/2019/11/04/openssh-support-for-u2f-fido2/#comment-654 172. https://schulz.dk/wp-content/uploads/2016/12/kim_1-e1483019874910.jpg 173. http://www.schulz.dk/ 174. https://schulz.dk/2019/11/04/openssh-support-for-u2f-fido2/#comment-560 175. https://avatars.githubusercontent.com/u/1150049?v=4 176. https://github.com/kimusan 177. https://github.com/kimusan?tab=repositories 178. https://github.com/kimusan?tab=followers 179. http://www.schulz.dk/ Hidden links: 181. https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fschulz.dk%2F2019%2F08%2F23%2Fusing-solokey-for-linux-login%2F 182. http://twitter.com/intent/tweet?source=SCHULZ:DK&text=If%20you%20want%20to%20have%20extra%20security%20for%20your%20linux%20machine%20besides%20the%20usual%20password.%20Then%20get%20yourself%20a%20SoloKey%20or%20other%20hardware%20U2F%20key%20and%20use%20that%20as%20secondary%20login.%20Here%20I%20give%20you%20the%20description%20on%20how%20to%20install%20and%20configure%20everything%20for%20using%20Solokeys%20with%20your%20linux.%20Enjoy%21&url=https%3A%2F%2Fschulz.dk%2F2019%2F08%2F23%2Fusing-solokey-for-linux-login%2F 183. https://plus.google.com/share?url=https%3A%2F%2Fschulz.dk%2F2019%2F08%2F23%2Fusing-solokey-for-linux-login%2F 184. http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fschulz.dk%2F2019%2F08%2F23%2Fusing-solokey-for-linux-login%2F&title=Using%20SoloKey%20for%20Linux%20Login&summary=If%20you%20want%20to%20have%20extra%20security%20for%20your%20linux%20machine%20besides%20the%20usual%20password.%20Then%20get%20yourself%20a%20SoloKey%20or%20other%20hardware%20U2F%20key%20and%20use%20that%20as%20secondary%20login.%20Here%20I%20give%20you%20the%20description%20on%20how%20to%20install%20and%20configure%20everything%20for%20using%20Solokeys%20with%20your%20linux.%20Enjoy%21&source=SCHULZ:DK 185. http://www.tumblr.com/share/link?url=https%3A%2F%2Fschulz.dk%2F2019%2F08%2F23%2Fusing-solokey-for-linux-login%2F&name=Using%20SoloKey%20for%20Linux%20Login&description=If%20you%20want%20to%20have%20extra%20security%20for%20your%20linux%20machine%20besides%20the%20usual%20password.%20Then%20get%20yourself%20a%20SoloKey%20or%20other%20hardware%20U2F%20key%20and%20use%20that%20as%20secondary%20login.%20Here%20I%20give%20you%20the%20description%20on%20how%20to%20install%20and%20configure%20everything%20for%20using%20Solokeys%20with%20your%20linux.%20Enjoy%21 186. javascript:; 187. https://www.facebook.com/kim.schulz 188. https://twitter.com/kimschulz 189. https://dk.linkedin.com/in/kimschulz 190. https://dk.pinterest.com/kimschulzdk/ 191. https://github.com/kimusan 192. javascript:;