I’ve recently had a chance to check out some newer YubiKeys, and decided to make a video on it. In this video, I’ll show you how to set up the YubiKey on Linux, with examples that include setting it up on your local laptop/desktop as well as using it to secure OpenSSH to a remote server.
Using the YubiKey to protect local authentication
Make sure up to date
sudo apt update && sudo apt dist-upgrade
Install the required PAM package
sudo apt install libpam-u2f
Create a directory to store the configuration
mkdir -p ~/.config/Yubico
Associate the yubikey
pamu2fcfg > ~/.config/Yubico/u2f_keys
Enable the YubiKey for sudo
Open the sudo config file for PAM in an editor:
sudo nano /etc/pam.d/sudo
Underneath the line:
@include common-auth
Add:
auth required pam_u2f.so
Test sudo
In a new terminal, test any command with sudo (make sure the yubikey is inserted). For example:
sudo apt update
Set up the YubiKey for GDM (the desktop login screen)
Open the gdm-password file in an editor:
sudo nano /etc/pam.d/gdm-password
Underneath the line:
@include common-auth
Add:
auth required pam_u2f.so
Set up Yubikey to be required for TTY login
Open the PAM login file in an editor:
sudo nano /etc/pam.d/login
Underneath the line:
@include common-auth
Add:
auth required pam_u2f.so
Using the YubiKey to protect remote authentication
Add the required repository
sudo add-apt-repository ppa:yubico/stable
Install the required package
sudo apt install libpam-yubico
Set up the authorized_yubikeys file
sudo nano /etc/ssh/authorized_yubikeys
Add a line for each users, similar to:
jay:<first 12 characters
Get an API key
An API key is required to continue. Visit the following URL to get yours: https://upgrade.yubico.com/getapikey
Edit the sshd file for PAM
sudo vim /etc/pam.d/sshd
Add a line such as the following (This must be the first line in the file):
auth required pam_yubico.so id=<CLIENT ID> key=<SECRET> authfile=/etc/ssh/authorized_yubikeys
Replace the <CLIENT ID> and <SECRET> with the details you receive from the API key URL.
Configure OpenSSH
Open the sshd_config file in an editor:
sudo nano /etc/ssh/sshd_config
Look for the ChallengeResponseAuthentication line, uncomment it if necessary, and set it to yes:
ChallengeResponseAuthentication yes
Make sure the UsePAM option is set to yes:
UsePam yes
Restart OpenSSH:
sudo systemctl restart ssh
