YubiKey

Chekc YubiKey by Yubico on online website.

Install libraries
```
apt install libpam-u2f
```
Create a global directory to save registered keys
```
mkdir /etc/Yubico
```

# On your YubiKey, touch the key when the light is flashing to verify the user presence.
pamu2fcfg -u "$SUDO_USER" > /etc/Yubico/u2f_keys_username

# For multiple YubiKey for same user.
pamu2fcfg -u "$SUDO_USER" -n >> /etc/Yubico/u2f_keys_username

# Optional but good to run.
chmod 644 /etc/Yubico/u2f_keys_username

# Content of /etc/Yubico/u2f_keys_username
username:BASE64KEYHANDLE,BASE64PUBLICKEY,es256,+presence

Edit file /etc/pam.d/gdm-password

@include common-auth

# If user password AND YubiKey are both required
auth    required        pam_u2f.so    authfile=/etc/Yubico/u2f_keys_username    cue

# If user password OR YubiKey is required
#auth    sufficient      pam_u2f.so    authfile=/etc/Yubico/u2f_keys_username    cue

# If YubiKey is optional
#   - if it succeeds, skip further auth
#   - if it fails/absent, fall through to whatever comes after
#auth    [success=1 default=ignore]    pam_u2f.so    authfile=/etc/Yubico/u2f_keys_username    cue

auth    optional        pam_gnome_keyring.so
@include common-account

Test and Verify (Optional)

sudo apt install pamtester

pamtester gdm-password $USER authenticate

Passless LUKS key slot (FIDO2)

In the following example, we use a LUKS image file storage.img for example, you can replace the file path with device path.

Note: your image or disk must be LUKS2, NOT LUKS1.

Backup LUKS header

cryptsetup luksHeaderBackup storage.img --header-backup-file storage.img.header

Enroll YubiKey as a key slot

# You may need to verify by other key slot like enter password
systemd-cryptenroll storage.img --fido2-device=auto --fido2-with-client-pin=no --fido2-with-user-presence=yes

Check for the key slots
```
cryptsetup luksDump storage.img
```

YubiKey

Login with GDM (U2F)

Passless LUKS key slot (FIDO2)