Setup YubiKey Authentication

Installation

sudo apt install fido2-tools libpam-u2f pcscd
sudo apt install yubikey-manager yubikey-personalization

Install and Configure Dracut

sudo apt install dracut dracut-core

sudo cat > /etc/dracut.conf.d/60hostonly.conf <<'EOF'
hostonly=yes
hostonly_cmdline=yes
EOF

sudo dracut --regenerate-all --force

Configuration

mkdir -p ~/.config/Yubico
pamu2fcfg > ~/.config/Yubico/u2f_keys

sudo systemd-cryptenroll /dev/nvme0n1p5 --fido2-device=auto --fido2-with-client-pin=no

auth       sufficient   pam_u2f.so cue [cue_prompt=🔑 Tap the security key now...] openasuser userpresence=1

@include common-yubico

@include common-yubico

auth       sufficient   pam_u2f.so nodetect cue [cue_prompt=🔑 Tap the security key now...] openasuser

Set PIN

ykman fido access change-pin

Disable OTP

ykman config usb --disable OTP