Yubikey - Revision history

Sapi: Added a little note with the ID_MODEL_ID of the Security Series, so users won't run into issues first thing.

2026-02-19T02:16:23Z

Added a little note with the ID_MODEL_ID of the Security Series, so users won't run into issues first thing.

← Older revision		Revision as of 02:16, 19 February 2026
Line 171:		Line 171:

	If this does not work with your Yubikey take a look at the output of this command when you plug-in/unplug your Yubikey		If this does not work with your Yubikey take a look at the output of this command when you plug-in/unplug your Yubikey
	<code>udevadm monitor --udev --environment</code> and adjust the rule accordingly. This rule should work with most Yubikey 5 series models		<code>udevadm monitor --udev --environment</code> and adjust the rule accordingly. This rule should work with most Yubikey 5 series models. The Yubikey Security series <code>ID_MODEL_ID</code> is <code>0402</code>.

	== Links ==		== Links ==

Mmkaram: /* Logging-in */ Added option for exclusive Yubikey login/sudo

2025-05-27T06:55:37Z

Logging-in: Added option for exclusive Yubikey login/sudo

← Older revision		Revision as of 06:55, 27 May 2025
Line 55:		Line 55:

	See chapter ''Test PAM configuration'' an the end of this page.		See chapter ''Test PAM configuration'' an the end of this page.

			6. (optional) Only allow Yubikey for login and sudo authentication

			If you don't want to be able to use your password to login to your user account or access sudo, you can modify the pam service as follows.
			{{Warning\|Be careful, losing your Yubikey will make it impossible to sign in with this configuration.}}<syntaxhighlight lang="nixos">
			security.pam.services = {
			login = {
			u2fAuth = true;
			unixAuth = false;
			};
			sudo = {
			u2fAuth = true;
			unixAuth = false;
			};
			};

			</syntaxhighlight>

	=== yubico-pam ===		=== yubico-pam ===

Picnoir at 17:13, 29 October 2024

2024-10-29T17:13:03Z

← Older revision		Revision as of 17:13, 29 October 2024
Line 62:		Line 62:
	Use this page to check whether your Yubikey supports '''Yubico OTP''' before starting: https://www.yubico.com/products/identifying-your-yubikey/		Use this page to check whether your Yubikey supports '''Yubico OTP''' before starting: https://www.yubico.com/products/identifying-your-yubikey/

	You can enable challenge-response logins with the following commands:		You'll first need to install the necessary udev packages to your NixOS configuration:<syntaxhighlight lang="nix">
			services.udev.packages = [ pkgs.yubikey-personalization ];
			</syntaxhighlight>You can program the Yubikey for challenge-response on slot 2 and setup the current user for logon:
			# <code>nix-shell -p yubico-pam -p yubikey-manager</code>
			# <code>ykman otp chalresp --touch --generate 2</code>
			# <code>ykpamcfg -2 -v</code>
			Finally, you can enable challenge-response logins with the following commands:

	'''1.)'''		'''1.)'''
Line 78:		Line 84:
	};		};
	</syntaxHighlight>		</syntaxHighlight>

	~~You'll also need to program the Yubikey for challenge-response on slot 2 and setup the current user for logon:~~

	~~# <code>nix-shell -p yubico-pam -p yubikey-manager</code>~~
	~~# <code>ykman otp chalresp --touch --generate 2</code>~~
	~~# <code>ykpamcfg -2 -v</code>~~

Fidgetingbits: /* yubico-pam */

2024-10-07T00:32:06Z

yubico-pam

← Older revision		Revision as of 00:32, 7 October 2024
Line 68:		Line 68:
	to get the serial code and enter it into <code>yubico.id = [ "12345678" ];</code>		to get the serial code and enter it into <code>yubico.id = [ "12345678" ];</code>

	{{warning\|1 Ignoring step 1 is considered insecure, any user could just plugin a yubikey and gain root access!}}		{{warning\|1=Ignoring step 1 is considered insecure, any user could just plugin a yubikey and gain root access!}}

	'''2.)'''<syntaxHighlight lang=nix>		'''2.)'''<syntaxHighlight lang=nix>

Fidgetingbits: Improved formatting

2024-10-07T00:31:13Z

Improved formatting

← Older revision		Revision as of 00:31, 7 October 2024
Line 20:		Line 20:
	=== pam_u2f ===		=== pam_u2f ===

	The `pam_u2f` module implements the U2F (universal second factor) protocol. The protocol was initially developed by Yubico, Google and NXP and is nowadays hosted as an open-standard by the FIDO Alliance. All current and most legacy Yubikeys support the U2F protocol making this the preferred way to use Yubikeys for user login.		The <code>pam_u2f</code> module implements the U2F (universal second factor) protocol. The protocol was initially developed by Yubico, Google and NXP and is nowadays hosted as an open-standard by the FIDO Alliance. All current and most legacy Yubikeys support the U2F protocol making this the preferred way to use Yubikeys for user login.

	Use this page to check whether your Yubikey supports '''FIDO U2F''' before starting: https://www.yubico.com/products/identifying-your-yubikey/		Use this page to check whether your Yubikey supports '''FIDO U2F''' before starting: https://www.yubico.com/products/identifying-your-yubikey/
Line 26:		Line 26:
	1. Connect your Yubikey		1. Connect your Yubikey

	2. Create an authorization mapping file for your user. The authorization mapping file is like `~/.ssh/known_hosts` but for Yubikeys.		2. Create an authorization mapping file for your user. The authorization mapping file is like <code>~/.ssh/known_hosts</code> but for Yubikeys.

	# <code>nix-shell -p pam_u2f</code>		# <code>nix-shell -p pam_u2f</code>
Line 34:		Line 34:


	3. Verify that `~/.config/Yubico/u2f_keys` contains one line in the following style:		3. Verify that <code>~/.config/Yubico/u2f_keys</code> contains one line in the following style:

	<syntaxHighlight>		<syntaxHighlight>
Line 58:		Line 58:
	=== yubico-pam ===		=== yubico-pam ===

	The `yubico-pam` module uses a OTP (one time password) challenge response to authenticate users.		The <code>yubico-pam</code> module uses a OTP (one time password) challenge response to authenticate users.

	Use this page to check whether your Yubikey supports '''Yubico OTP''' before starting: https://www.yubico.com/products/identifying-your-yubikey/		Use this page to check whether your Yubikey supports '''Yubico OTP''' before starting: https://www.yubico.com/products/identifying-your-yubikey/
Line 68:		Line 68:
	to get the serial code and enter it into <code>yubico.id = [ "12345678" ];</code>		to get the serial code and enter it into <code>yubico.id = [ "12345678" ];</code>

	~~'''WARNING, ignoring~~ step 1 is considered insecure, any user could just plugin a yubikey and gain root access!~~'''~~		{{warning\|1 Ignoring step 1 is considered insecure, any user could just plugin a yubikey and gain root access!}}

	'''2.)'''<syntaxHighlight lang=nix>		'''2.)'''<syntaxHighlight lang=nix>

Mic92: /* OTP */

2024-08-18T15:14:54Z

OTP

← Older revision		Revision as of 15:14, 18 August 2024
Line 104:		Line 104:
	== OTP ==		== OTP ==

	In order to manage OTP keys, you should install the <code>yubioath-~~desktop~~</code> package in your profile.		In order to manage OTP keys, you should install the <code>yubioath-flutter</code> package in your profile.
	This application will also require both the udev rules as well as pcscd enabled.		This application will also require both the udev rules as well as pcscd enabled.

Remedan: /* Smartcard mode */ Mention how to solve the gpg-agent/scdaemon conflict

2024-07-08T13:30:57Z

Smartcard mode: Mention how to solve the gpg-agent/scdaemon conflict

← Older revision		Revision as of 13:30, 8 July 2024
Line 100:		Line 100:
	</syntaxHighlight>		</syntaxHighlight>

	Please note that the PCSC-Lite daemon [https://ludovicrousseau.blogspot.com/2019/06/gnupg-and-pcsc-conflicts.html sometimes conflicts] with gpg-agent.		Please note that the PCSC-Lite daemon [https://ludovicrousseau.blogspot.com/2019/06/gnupg-and-pcsc-conflicts.html sometimes conflicts] with gpg-agent. This can be solved by putting the line <code>disable-ccid</code> into <code>~/.gnupg/scdaemon.conf</code>. There is also a [https://nix-community.github.io/home-manager/options.xhtml#opt-programs.gpg.scdaemonSettings Home Manager Option] for that.

	== OTP ==		== OTP ==

Klinger at 19:47, 24 April 2024

2024-04-24T19:47:26Z

← Older revision		Revision as of 19:47, 24 April 2024
Line 163:		Line 163:
	[[Category:Cookbook]]		[[Category:Cookbook]]
	[[Category:Security]]		[[Category:Security]]
	[[Hardware]]		[[Category:Hardware]]

Klinger: Category:Cookbook Category:Security Hardware

2024-04-24T19:46:50Z

Category:Cookbook Category:Security Hardware

← Older revision		Revision as of 19:46, 24 April 2024
Line 163:		Line 163:
	[[Category:Cookbook]]		[[Category:Cookbook]]
	[[Category:Security]]		[[Category:Security]]
			[[Hardware]]

Klinger: Category:Cookbook Category:Security

2024-04-19T20:19:51Z

Category:Cookbook Category:Security

← Older revision		Revision as of 20:19, 19 April 2024
Line 160:		Line 160:
	* [https://rzetterberg.github.io/yubikey-gpg-nixos.html GPG-keys for SSH authentication on NixOS]		* [https://rzetterberg.github.io/yubikey-gpg-nixos.html GPG-keys for SSH authentication on NixOS]
	* [[Yubikey_based_Full_Disk_Encryption_(FDE)_on_NixOS]]		* [[Yubikey_based_Full_Disk_Encryption_(FDE)_on_NixOS]]

			[[Category:Cookbook]]
			[[Category:Security]]