YubiKey

Chekc YubiKey by Yubico on online website.

Login with GDM (U2F)

• Install libraries

  apt install libpam-u2f
  

• Create a global directory to save registered keys

  mkdir /etc/Yubico
  

• Register username's YubiKey in /etc/Yubico/u2f_keys_username

  # On your YubiKey, touch the key when the light is flashing to verify the user presence.
  pamu2fcfg -u "$SUDO_USER" > /etc/Yubico/u2f_keys_username
  
  # For multiple YubiKey for same user.
  pamu2fcfg -u "$SUDO_USER" -n >> /etc/Yubico/u2f_keys_username
  
  # Optional but good to run.
  chmod 644 /etc/Yubico/u2f_keys_username
  

  # Content of /etc/Yubico/u2f_keys_username
  username:BASE64CODE:BASE64CODE,es256,+presence
  

• Edit file /etc/pam.d/gdm-password

  @include common-auth
  
  # If user password AND YubiKey are both required
  auth    required        pam_u2f.so    authfile=/etc/Yubico/u2f_keys_username    cue
  
  # If user password OR YubiKey is required
  #auth    sufficient      pam_u2f.so    authfile=/etc/Yubico/u2f_keys_username    cue
  
  # If YubiKey is optional
  #   - if it succeeds, skip further auth
  #   - if it fails/absent, fall through to whatever comes after
  #auth    [success=1 default=ignore]    pam_u2f.so    authfile=/etc/Yubico/u2f_keys_username    cue
  
  auth    optional        pam_gnome_keyring.so
  @include common-account
  

• Test and Verify (Optional)

  sudo apt install pamtester
  
  pamtester gdm-password $USER authenticate
  

Passless