PAM_U2F(8) PAM U2F Module Manual PAM_U2F(8) (NAME) pam_u2f - PAM U2F (SYNOPSIS) pam_u2f [...] (DESCRIPTION) U2F YubiKey . (OPTIONS) debug (). debug_file . . . pam-u2f ( ). "stderr" () "stdout" "syslog" . origin=origin (relying party ID) FIDO. "pam://" . appid=appid (application ID) FIDO. origin ( origin "pam://"). FIDO v1.0.8 pamu2fcfg . v1.1.0 v1.1.1 pam-u2f origin . authfile=file keyHandle . ( ) ".ssh/u2f_keys". /Yubico/u2f_keys . /home/ahoura/.config/Yubico/u2f_keys . authfile : :,,,:,,,:... expand authfile: %u (PAM_USER) %% % . . openasuser . authpending_file=file . pam-u2f FIDO . inotify yubikey-touch-detector . : /var/run/user/1001/pam-u2f-authpending. : "authpending_file=". nouserok authfile authfile . openasuser (Setuid) authfile. NFS root_squash ( root nobody ). 1.0.8 authfile ( ) XDG_CONFIG_HOME . alwaysok ( presentation mode). max_devices=n_devices FIDO ( ). FIDO . interactive FIDO. . [prompt=your prompt here] . PAM . manual . SSH FIDO / SSH . . cue FIDO. [cue_prompt=your prompt here] cue. PAM . nodetect FIDO . NOTES . userpresence=int . . . userverification=int ( ) . . . FIDO2 . pinverification=int PIN . . . PIN FIDO2 . sshformat OpenSSH FIDO . SSH . SSH . conf=path/to/pam_u2f.conf . . CONFIGURATION FILE . (EXAMPLES) . auth required pam_u2f.so authfile=/etc/u2f_mappings cue PIN. auth sufficient pam_u2f.so authfile=/etc/u2f_mappings cue pinverification=1 userverification=0 UV ( ) PIN. auth sufficient pam_u2f.so authfile=/etc/u2f_mappings cue pinverification=0 userverification=1 auth sufficient pam_u2f.so authfile=/etc/u2f_mappings cue pinverification=1 userverification=0 (CAVEATS) authfile "root" . "XDG_CONFIG_HOME" "openasuser" . pam-u2f . . (CONFIGURATION FILE) . o name = value # . o = . o conf . o . o /etc/security/pam_u2f.conf . . . o . (NOTES) Nodetect "nodetect" . pam_u2f . " " (check-only) . pam_u2f "cue" ( ) . libu2f-host <= 1.1.5 . pam_u2f "cue" "nodetect" U2F pam_u2f . . " " . "cue" . "nodetect" (sleep) libu2f-host . "nodetect" "cue" . SELinux Fedora Linux SELinux pam-u2f . nouserok FIDO . (security context) fixfiles onboot . authfile # chcon -R -t auth_home_t /path/to/authfile . https://access.redhat.com/security/cve/CVE-2020-24612 . (BUGS) pam-u2f : https://github.com/Yubico/pam-u2f/issues (SEE ALSO) pam(7) pam-u2f: https://developers.yubico.com/pam-u2f YubiKey Yubico : http://www.yubico.com pam-u2f Version\ 1.4.0 PAM_U2F(8)