Universal 2nd Factor (U2F) is an open standard that strengthens and simplifies two-factor authentication (2FA) using specialized USB or NFC devices based on similar security technology found in smart cards.
While initially developed by Google and Yubico, with contribution from NXP Semiconductors, the standard is now hosted by the FIDO Alliance.
For all articles on U2F and U2F-devices see: Category:Universal 2nd Factor.
WebAuthn is a more recent standard.
Authentication for websites
U2F is supported by major sites like Google, Facebook, Twitter, or GitHub. Check out 2fa.directory or dongleauth.com to find other websites and links to setup documentation. For all browsers which support it, likely the only action required is to install . Yubico offers a demo page for testing.
Authentication for user sessions
Yubico, the company creating the YubiKey, develops an U2F PAM module. It can be used to act as a second factor during login or replace the need for a password entirely.
Installing the PAM module
The module is part of the package.
Adding a key
authfile=/path/to/u2f_keys to the end of the line for pam_u2f.so. This is also useful if you wish to move
u2f_keys to a protected part of the file-system. For multi-user implementations use a central mapping file as explained in the official documentation of pam-u2f.
Keys need to be added with the tool
$ mkdir ~/.config/Yubico $ pamu2fcfg -o pam://hostname -i pam://hostname > ~/.config/Yubico/u2f_keys
After entering your PIN, click the button of your U2F key to confirm the key.
hostname with the actual hostname.
If you own more than one key, append the next ones with
$ pamu2fcfg -o pam://hostname -i pam://hostname -n >> ~/.config/Yubico/u2f_keys
-n in the above command is required. It will omit the username portion of the generated entry as required in the spec for subsequent entries for the same user. Multiple entries with the same username will cause unpredictable behaviour in PAM. Also, do not add line breaks manually.
sudo -s). This way you can revert any changes if something goes wrong.
auth sufficient pam_u2f.so cue origin=pam://hostname appid=pam://hostname
as the first line. Be sure to replace the
hostname as mentioned above. Then create a new terminal and type
sudo ls. Your key's LED should flash and after clicking it the command is executed. The option
cue is set to provide indication of what to do, i.e.
Please touch the device.
In order to make the token the only method of sudo (ie. no password fallback) you will need to comment out the other auth methods present. This is usually just the default system-auth include.
#auth include system-auth
You should also change
required in the above
auth required pam_u2f.so nouserok origin=pam://hostname appid=pam://hostname
after the existing
auth lines. Please note the use of the
nouserok option which allows the rule to fail if the user did not configure a key. This way setups with multiple users where only some of them use a U2F key are supported.
u2f_keys file is unavailable. In this case use a central mapping file as explained in the official documentation of pam-u2f.
Some multi-function security keys (ex. Trezor Model T) which can do U2F / PAM may not advertise the feature on system boot which is intentionally out of the CTAP 2.0 specification. With multiple U2F keys present, this can result in two-minute long delays when used with GDM as pam-u2f does sequential lookups and will wait for the (Trezor) device to timeout before offering presence / touch with the secondary U2F key . You could try adding the
nodetect option alongside
debug and finish any device specific login (ex. screen PIN) before GDM loads.
Other authentication methods
Enable the PAM module for other services like explained above. For example, to secure the screensaver of Cinnamon, edit
If you managed to lock yourself out of the system, boot into recovery mode or from a USB pen drive. Then revert the changes in the PAM configuration and reboot.
In case the pam-u2f module silently fails, add debug keyword to the auth line in a file in
Data-at-rest encryption with LUKS
First, you will need to setup your
/etc/crypttab file (see below), or customize your initramfs if you wish to unlock your root partition. The full procedure is similar to the use of a TPM chip for unlocking. See Trusted Platform Module#systemd-cryptenroll.
To register the key, you will need to use the systemd-cryptenroll utility. First, run the following command to list your detected keys:
$ systemd-cryptenroll --fido2-device=list
Then you can register the key in a LUKS slot, specifying
auto value (or path to the FIDO2 device such as
/dev/hidrawX if you have multiple):
$ systemd-cryptenroll --fido2-device=auto /dev/sdX
For a non-root data partition the crypttab would look like this:
data /dev/sdX none fido2-device=auto
This should also work if your encrypted partition is a logical volume managed under LVM:
data /dev/vg1/data none fido2-device=auto