FIDO2 potential to brick #819

Open
opened 2025-03-06 13:35:41 +00:00 by lokan · 0 comments

When following the instructions for adding a Yubikey with u2f authentication, the instructions could perhaps be a bit clearer or expanded. Because before adding a line to a PAM module, you need to also either:
run: sudo authselect select sssd with-pam-u2f
or really make sure the line you add is below system-auth.

I did both the second time around so I can't verify which one fixes it, but if you don't properly do this but set it in: /etc/pam.d/sudo, your machine is now "bricked" because you can't authenticate as root anymore.

Fairly easily fixable if you plug a live cd usb in, but still.
Would be nice if anyone knows which of the above mentioned causes the issue and maybe we could add either like a CAUTION: line or the additional install line.

When following the instructions for adding a Yubikey with u2f authentication, the instructions could perhaps be a bit clearer or expanded. Because before adding a line to a PAM module, you need to also either: run: sudo authselect select sssd with-pam-u2f or really make sure the line you add is below system-auth. I did both the second time around so I can't verify which one fixes it, but if you don't properly do this but set it in: /etc/pam.d/sudo, your machine is now "bricked" because you can't authenticate as root anymore. Fairly easily fixable if you plug a live cd usb in, but still. Would be nice if anyone knows which of the above mentioned causes the issue and maybe we could add either like a CAUTION: line or the additional install line.
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: Docs/quick-docs#819
No description provided.