I don’t actually go on site to visit customers as much as 10 years ago, but do work out of the house still relatively regularly. My laptops all have Bitlocker or LUKS encryption each with a unique passphrase, so physical laptop loss would be a financial issue, not a data issue, but the laptops are joined to a domain with multiple users, and I want to REALLY lock down who can get on them once they’re booted, especially when connected into the lab network via VPN, so I install libpam-u2f and add an additional layer of protection to the logon process by requiring my Yubikey to be plugged in to complete authentication.
The old method of doing this required libpam-yubico, which is deprecated, and defaulted to only online checks of the Yubikey. U2F works both online and offline, which is super important for a laptop, and Yubikey’s full documentation for this on Ubuntu at https://support.yubico.com/s/article/Ubuntu-Linux-login-guide-U2F is very good.
The problem in my case is two-fold: first that I have privileged access management solutions in place – the root account is managed by BeyondTrust Password Safe. Logging in with that user, or having the password manager test its password will fail, because that account can’t tap the Yubikey. So we have to add an extra layer of configuration for the PAM/PIM management solution, in the form of pam_succeed_if.so. The second problem becomes clear once you’re installed – I want U2F to be *2nd* factor.
Once libpam-u2f is installed, a file is created by the package at /usr/share/pam-configs/pam-u2f – this is the “pam-auth-update” rule file that controls your PAM configuration in /etc/pam.d/. The Yubikey documentation mentions editing individual files in /etc/pam.d directly to finish the configuration, but the holistic Ubuntu answer is to work with these rules files. The default looks like:Name: FIDO2/U2F authentication using pam-u2f
Default: no
Priority: 384
Auth-Type: Primary
Auth:
[success=end default=ignore] pam_u2f.so cue
Auth-Initial:
[success=end default=ignore] pam_u2f.so cue
My goal here is that the password-manager-protected accounts like root (and other directory accounts that are managed by the vault, since my systems are AD-joined) will NOT have to be Yubikey authenticated, but any account where the human knows the password WILL require MFA. The vault requires MFA to get into it, so effectively, all vault managed accounts are MFA protected. It is setting those passwords to 50+ character CSPRNG-created passwords, so I’m not worried about stuffing or brute force attacks.
Because that /usr/share/pam-configs/pam-u2f file is package-owned, if we edit it, we’ll get overwritten later. Also, in this case we don’t want the success=end because that will jump past pam_lsass.so (or pam_sss.so if we’re using SSSD for the directory connection) and pam_unix.so, making the U2F a single factor, not a second. So instead we create a new /usr/share/pam-configs/u2f-vault file with this content:Name: FIDO2/U2F second factor (exempt: pbps-protected)
Default: no
Priority: 384
Auth-Type: Additional
Auth:
[success=1 default=ignore] pam_succeed_if.so user ingroup pbps-protected quiet
required pam_u2f.so cue
and then we can run pam-auth-update to choose our auth modules, as shown in this screenshot:
You can also run via the CLI: sudo pam-auth-update --enable u2f-vault to add the new module in the correct location, but for a manual change like this the first time, I like to review the options in the curses interface first.
The resulting authentication looks like…rob-laptop login: rob
Password:
Please touch the FIDO authenticator.
Welcome to Ubuntu 24.04.5 LTS (GNU/Linux 6.17.0-1033-oem x86_64)
* Documentation: https://help.ubuntu.com
* Management: https://landscape.canonical.com
* Support: https://ubuntu.com/pro
Expanded Security Maintenance for Applications is enabled.
5 updates can be applied immediately.
2 of these updates are standard security updates.
To see these additional updates run: apt list --upgradable
New release '26.04.1 LTS' available.
Run 'do-release-upgrade' to upgrade to it.
09:25 rob@rob-laptop:~$
And it works in the GUI – you type your password, and once that’s successful, you’ll get a message “Please touch the FIDO authenticator” and the logon screen waits for that 2nd auth before continuing.