1

I am trying to set up a passwordless login for Linux Mint 19.3, in order to be able to log in either with a Yubikey token or a password. I followed the instructions from Yubikey website and this thread, but I cannot make it work.

Briefly, this is what I did:

  1. sudo pamu2fcfg -u `whoami` > /etc/Yubico/u2f_keys

  2. In /etc/pam.d/ I created common-u2f with the following content:

    auth sufficient pam_u2f.so authfile=/etc/Yubico/u2f_keys debug debug_file=/var/log/pam_u2f.log authpending_file=/etc/Yubico/pam-u2f-authpending

  3. I added 

    @include common-u2f
    before 
    @include common-auth
    in the following files: lightdm, sudo, login, cinnamon-screensaver

Now, I can use command sudo, unlock the screen, and log in (only after logging out) with just my Yubikey. However, when I try to log in after reboot, something strange happen. I get the blinking light on the Yubikey, and after pressing it, the screen goes black as if it is going to bring up my desktop, but instead it goes back to the log in screen. So, basically, if I try to use Yubikey, it gets stuck in the log-in loop. To get out of it, I just have to remove the token and use my password.

When I looked at the debug log, I saw that it tries to authenticate me twice. First time it succeeds, but second time it complains about u2f device not found. I don't know why it calls pam_u2f.so module twice after reboot, as for sudo, unlocking the screen, and logging in (after logging out), it only calls it once (as expected). Here is the content of the debug log:

debug(pam_u2f): ../pam-u2f.c:99 (parse_cfg): called.
debug(pam_u2f): ../pam-u2f.c:100 (parse_cfg): flags 0 argc 4
debug(pam_u2f): ../pam-u2f.c:102 (parse_cfg): argv[0]=authfile=/etc/Yubico/u2f_keys
debug(pam_u2f): ../pam-u2f.c:102 (parse_cfg): argv[1]=debug
debug(pam_u2f): ../pam-u2f.c:102 (parse_cfg): argv[2]=debug_file=/var/log/pam_u2f.log
debug(pam_u2f): ../pam-u2f.c:102 (parse_cfg): argv[3]=authpending_file=/etc/Yubico/pam-u2f-authpending
debug(pam_u2f): ../pam-u2f.c:104 (parse_cfg): max_devices=0
debug(pam_u2f): ../pam-u2f.c:105 (parse_cfg): debug=1
debug(pam_u2f): ../pam-u2f.c:106 (parse_cfg): interactive=0
debug(pam_u2f): ../pam-u2f.c:107 (parse_cfg): cue=0
debug(pam_u2f): ../pam-u2f.c:108 (parse_cfg): nodetect=0
debug(pam_u2f): ../pam-u2f.c:109 (parse_cfg): manual=0
debug(pam_u2f): ../pam-u2f.c:110 (parse_cfg): nouserok=0
debug(pam_u2f): ../pam-u2f.c:111 (parse_cfg): openasuser=0
debug(pam_u2f): ../pam-u2f.c:112 (parse_cfg): alwaysok=0
debug(pam_u2f): ../pam-u2f.c:113 (parse_cfg): authfile=/etc/Yubico/u2f_keys
debug(pam_u2f): ../pam-u2f.c:114 (parse_cfg): authpending_file=/etc/Yubico/pam-u2f-authpending
debug(pam_u2f): ../pam-u2f.c:115 (parse_cfg): origin=(null)
debug(pam_u2f): ../pam-u2f.c:116 (parse_cfg): appid=(null)
debug(pam_u2f): ../pam-u2f.c:117 (parse_cfg): prompt=(null)
debug(pam_u2f): ../pam-u2f.c:169 (pam_sm_authenticate): Origin not specified, using "pam://host1"
debug(pam_u2f): ../pam-u2f.c:181 (pam_sm_authenticate): Appid not specified, using the same value of origin (pam://host1)
debug(pam_u2f): ../pam-u2f.c:192 (pam_sm_authenticate): Maximum devices number not set. Using default (24)
debug(pam_u2f): ../pam-u2f.c:210 (pam_sm_authenticate): Requesting authentication for user user1
debug(pam_u2f): ../pam-u2f.c:221 (pam_sm_authenticate): Found user user1
debug(pam_u2f): ../pam-u2f.c:222 (pam_sm_authenticate): Home directory for user1 is /home/user1
debug(pam_u2f): ../pam-u2f.c:271 (pam_sm_authenticate): Using authentication file /etc/Yubico/u2f_keys
debug(pam_u2f): ../util.c:105 (get_devices_from_authfile): Authorization line: user1: 
debug(pam_u2f): ../util.c:110 (get_devices_from_authfile): Matched user: user1
debug(pam_u2f): ../util.c:137 (get_devices_from_authfile): KeyHandle for device number 1: 
debug(pam_u2f): ../util.c:156 (get_devices_from_authfile): publicKey for device number 1: 
debug(pam_u2f): ../util.c:167 (get_devices_from_authfile): Length of key number 1 is 65
debug(pam_u2f): ../util.c:137 (get_devices_from_authfile): KeyHandle for device number 2: 
debug(pam_u2f): ../util.c:156 (get_devices_from_authfile): publicKey for device number 2: 
debug(pam_u2f): ../util.c:167 (get_devices_from_authfile): Length of key number 2 is 65
debug(pam_u2f): ../util.c:194 (get_devices_from_authfile): Found 2 device(s) for user user1
debug(pam_u2f): ../pam-u2f.c:340 (pam_sm_authenticate): Using file '/etc/Yubico/pam-u2f-authpending' for emitting touch request notifications
debug(pam_u2f): ../util.c:277 (do_authentication): Device max index is 0
debug(pam_u2f): ../util.c:311 (do_authentication): Attempting authentication with device number 1
debug(pam_u2f): ../util.c:335 (do_authentication): Challenge: { "keyHandle": "", "version": "U2F_V2", "challenge": "", "appId": "pam:\/\/host1" }
debug(pam_u2f): ../util.c:349 (do_authentication): Response: { "signatureData": "", "clientData": "" }
debug(pam_u2f): ../pam-u2f.c:410 (pam_sm_authenticate): done. [Success]
debug(pam_u2f): ../pam-u2f.c:99 (parse_cfg): called.
debug(pam_u2f): ../pam-u2f.c:100 (parse_cfg): flags 0 argc 4
debug(pam_u2f): ../pam-u2f.c:102 (parse_cfg): argv[0]=authfile=/etc/Yubico/u2f_keys
debug(pam_u2f): ../pam-u2f.c:102 (parse_cfg): argv[1]=debug
debug(pam_u2f): ../pam-u2f.c:102 (parse_cfg): argv[2]=debug_file=/var/log/pam_u2f.log
debug(pam_u2f): ../pam-u2f.c:102 (parse_cfg): argv[3]=authpending_file=/etc/Yubico/pam-u2f-authpending
debug(pam_u2f): ../pam-u2f.c:104 (parse_cfg): max_devices=0
debug(pam_u2f): ../pam-u2f.c:105 (parse_cfg): debug=1
debug(pam_u2f): ../pam-u2f.c:106 (parse_cfg): interactive=0
debug(pam_u2f): ../pam-u2f.c:107 (parse_cfg): cue=0
debug(pam_u2f): ../pam-u2f.c:108 (parse_cfg): nodetect=0
debug(pam_u2f): ../pam-u2f.c:109 (parse_cfg): manual=0
debug(pam_u2f): ../pam-u2f.c:110 (parse_cfg): nouserok=0
debug(pam_u2f): ../pam-u2f.c:111 (parse_cfg): openasuser=0
debug(pam_u2f): ../pam-u2f.c:112 (parse_cfg): alwaysok=0
debug(pam_u2f): ../pam-u2f.c:113 (parse_cfg): authfile=/etc/Yubico/u2f_keys
debug(pam_u2f): ../pam-u2f.c:114 (parse_cfg): authpending_file=/etc/Yubico/pam-u2f-authpending
debug(pam_u2f): ../pam-u2f.c:115 (parse_cfg): origin=(null)
debug(pam_u2f): ../pam-u2f.c:116 (parse_cfg): appid=(null)
debug(pam_u2f): ../pam-u2f.c:117 (parse_cfg): prompt=(null)
debug(pam_u2f): ../pam-u2f.c:169 (pam_sm_authenticate): Origin not specified, using "pam://host1"
debug(pam_u2f): ../pam-u2f.c:181 (pam_sm_authenticate): Appid not specified, using the same value of origin (pam://host1)
debug(pam_u2f): ../pam-u2f.c:192 (pam_sm_authenticate): Maximum devices number not set. Using default (24)
debug(pam_u2f): ../pam-u2f.c:210 (pam_sm_authenticate): Requesting authentication for user user1
debug(pam_u2f): ../pam-u2f.c:221 (pam_sm_authenticate): Found user user1
debug(pam_u2f): ../pam-u2f.c:222 (pam_sm_authenticate): Home directory for user1 is /home/user1
debug(pam_u2f): ../pam-u2f.c:271 (pam_sm_authenticate): Using authentication file /etc/Yubico/u2f_keys
debug(pam_u2f): ../util.c:105 (get_devices_from_authfile): Authorization line: user1: 
debug(pam_u2f): ../util.c:110 (get_devices_from_authfile): Matched user: user1
debug(pam_u2f): ../util.c:137 (get_devices_from_authfile): KeyHandle for device number 1: 
debug(pam_u2f): ../util.c:156 (get_devices_from_authfile): publicKey for device number 1: 
debug(pam_u2f): ../util.c:167 (get_devices_from_authfile): Length of key number 1 is 65
debug(pam_u2f): ../util.c:137 (get_devices_from_authfile): KeyHandle for device number 2: 
debug(pam_u2f): ../util.c:156 (get_devices_from_authfile): publicKey for device number 2: 
debug(pam_u2f): ../util.c:167 (get_devices_from_authfile): Length of key number 2 is 65
debug(pam_u2f): ../util.c:194 (get_devices_from_authfile): Found 2 device(s) for user user1
debug(pam_u2f): ../pam-u2f.c:340 (pam_sm_authenticate): Using file '/etc/Yubico/pam-u2f-authpending' for emitting touch request notifications
debug(pam_u2f): ../util.c:271 (do_authentication): Unable to discover device(s), cannot find U2F device
debug(pam_u2f): ../pam-u2f.c:371 (pam_sm_authenticate): do_authentication returned -2
debug(pam_u2f): ../pam-u2f.c:410 (pam_sm_authenticate): done. [Authentication failure]

As you can see from the log, it tries to authenticate me twice. I have no idea why. Any help would be appreciated!

Proto Ukr
  • 151
  • 5

2 Answers2

4

After some exhaustive research and debug, I came to a very simple realization -- the passwordless login will not work for me since my home folder is encrypted. It can only be decrypted with my password, and since Linux does not store the actual password anywhere (just a hash), I must provide it to log in after reboot. By the way, that would explain why I was able to use Yubikey to log in after logging out and use other commands that rely on common-auth PAM file.

Proto Ukr
  • 151
  • 5
  • 1
    Looks like the same happens for any other passwordless schema. I tried pam_usb (that uses a USB pen to store a OTP used to login) and I had the same problem. As long as I can see, if you have an encrypted home directory, can use these devices ONLY as a second step in a 2FA or MFA scheme. – AlexBottoni Jun 22 '21 at 11:12
  • @proto-ukr I just proved you are wrong I put my key in /auth/file_name so it's accessible when home is encrypted and I was able to login – Pawel Cioch Dec 09 '22 at 20:19
0

I think it should be possible it could be a flavor of this method https://github.com/agherzan/yubikey-full-disk-encryption

When you type a password it must unwrap a hash needed for home folder directory, so same method must happen but after using a key.

If you look at this article when you encrypt home after installation https://www.linuxuprising.com/2018/04/how-to-encrypt-home-folder-in-ubuntu.html

You can obtain a key in step 5. Print and record the recovery passphrase.

I believe it either should be possible to "re-route" that unwrap after a key, or you should encrypt your home, using a key, but then if you lose a key, you can't login with password. I think it should be possible to have home encrypted using asymmetric key when both password and U2F key can decrypt.

We just need some Linux security guru to show us how, maybe here https://blog.rtwm.io/2021/03/complete-u2f-yubikey-linux-mint-20-login-with-encrypted-home-folders/

I think I'll figure it out eventually

look at file /etc/pam.d/common-auth

part of it is

# and here are more per-package modules (the "Additional" block)
auth    optional    pam_ecryptfs.so unwrap

the ...pam_ecryptfs.so unwrap that's about home folder most likely so I think we need to put

auth required pam_u2f.so authfile={your-non-home-location}

before that that ... pam_ecryptfs.so unwrap

TO BE CONTINUED...

Pawel Cioch
  • 231
  • 2
  • 4