Post cover image
[Fig. 1] YubiKeys with support for device-bound passkeys.

March 5, 2025

FIDO2 security key sign-in on Linux

Need to implement MFA for Linux but unsure what’s possible? This guide walks you through securing Linux logins and privilege escalation…

By Jonas Markström

5 min read

Need to implement MFA for Linux but not sure what's possible? This guide walks you through securing Linux logins and privilege escalation with security keys as device-bound passkeys, delivering phishing resistance and a near seamless user experience.

Table of Contents

– Background and Scope – Prerequisites – Installation – Basic configuration – Verification – Advanced configuration – End-user experience – Further reading

Background and Scope

Multi-Factor Authentication (MFA) is now widely accepted as essential, and we've moved past debating whether passwords should be replaced. The real challenge is choosing the right MFA method(s) and implementing them effectively across diverse IT environments.

Security keys, such as the YubiKey, offer a strong, phishing-resistant authentication method, supporting multiple credential types, including FIDO2, U2F and PIV. Moreover, with USB and NFC connectivity, they integrate seamlessly across various user endpoints.

However, translating these capabilities into a practical, organization-wide strategy can be complex. IT environments often have varied authentication supporting capabilities, and in some cases, a lack of visibility of options makes implementation more challenging. MFA for Linux is a prime example of where it's less clear what can be done, and how.

This guide aims to bridge the gap between what's known and what's possible. It details how to implement passwordless authentication on Linux using security keys, securing both interactive logins and privilege escalation (e.g., su / sudo) to deliver a user experience similar to modern Windows environments. The guide walks through installing the pam-u2f module, configuring passwordless sign-in with FIDO2 device-bound passkeys (resident keys), and exploring advanced customization options. Finally, it provides verification steps to ensure correct configuration and a smooth deployment.

📅 Last updated on: June 28 2025

Prerequisites

The following are prerequisites towards following this guide:

  • Linux*
  • Security key with PIN set

*This guide uses Ubuntu Desktop 24.04.2 LTS, but feel free to try the distribution of your preference, and make sure to provide your results in the comments section of this article 🙇🏻‍♂️

None

Installation

To install the pam-u2f module:

  1. Login to the target Linux host (and open a terminal)
  2. Add the requisite PPA repository to the system's package manager: sudo add-apt-repository ppa:yubico/stable [Fig. 2]
  3. Install pam-u2f: sudo apt-get install libpam-u2f [Fig. 3].
None None

Basic configuration

With pam-u2f installed, let's configure it for passwordless sign-in:

  1. Make a directory: sudo mkdir -p /etc/yubico [Fig. 4]
  2. Create a public key file: sudo touch /etc/yubico/credentials [Fig. 5]
  3. Register a device-bound passkey (for a user called "bob"): pamu2fcfg -ubob -r -N | sudo tee -a /etc/yubico/credentials [Fig. 6]
  4. When prompted, insert a security key, provide PIN and then touch it(!)
  5. Open the PAM configuration: sudo nano /etc/pam.d/common-auth [Fig. 7]
  6. Implement support for pam-u2f with the following line [Fig. 8]: auth sufficient pam_u2f.so authfile=/etc/yubico/credentials cue
  7. Save exiting the file (Ctrl + x followed by Y).

⚠️ Before doing anything else, refer to the Verification section.

None None None None None

Verification

The following can be performed for verification or troubleshooting purposes:

Confirm pam-u2f version

In order to take advantage of the latest and greatest features (and fixes), make sure you are using current version of pam-u2f with command: pamu2fcfg --version [Fig. 9]

✅ You should see version 1.4 or higher. If the version is lower, you might be using an older release from your distribution's repository instead of the latest stable version from Yubico.

None

Verify credential creation

To confirm that a public key has been generated as part of your pam-u2f configuration, display the contents of the credentials file by running: sudo cat /etc/yubico/credentials [Fig. 10].

✅ You should see username, a credential and any requirement on User Presence and User Verification / PIN.

None

Verify security key authentication

To check whether security key authentication is enabled for privileged access or login, open a new terminal and run: su bob (replace 'bob' with the actual username) [Fig. 11].

✅ You should see a PIN prompt followed by a touch prompt.

None

Advanced configuration

Assuming you have the basics working here are some additional considerations:

Register a backup authenticator

Pam-u2f allows you to register one or more backup authenticators, which is especially important if you disable password fallback (see below). To add a second security key for a user named 'bob', run: pamu2fcfg -ubob -r -N -n | sudo tee -a /etc/yubico/credentials [Fig. 12].

None

Enforce security key usage

While there are multiple ways to configure this, following this guide would result in PAM being set up with an auth sufficient statement for pam-u2f. This setup allows fallback to a password (or some other credential) if security key authentication fails or times out. To disable this fallback, comment out (#) the other supported authentication methods [Fig. 13].

💀 See notes on registering a backup authenticator!

None

Support additional users

If multiple users need access to the target system, you can register security keys on their behalf. This can be done as follows (see comments):

# Add a primary security key for user "alice"
pamu2fcfg -ualice -r -N | sudo tee -a /etc/yubico/credentials

# Add a backup security key for user "alice"
pamu2fcfg -ualice -r -N -n | sudo tee -a /etc/yubico/credentials

Consolidating to an existing passkey credential

If enrolling security keys for users seems cumbersome — or if you prefer a single credential for all Linux access — know that it is technically possible to configure pam-u2f to accept a customer-defined Relying Party (RP) using the -origin switch. This is particularly appealing considering SSH authentication, as users may already have an SSH credential on their security key or be in scope to register one.

By consolidating pam-u2f with the SSH credential, Linux authentication can be treated as a unified use case rather than two separate ones. This also improves the Enrollment On Behalf Of (EOBO) scenario: since the administrator can use a user's existing public key, there's no need for direct access to the user's YubiKey during account setup.

To streamline this process, I have created a utility that exports a YubiKey SSH public key and converts it into a pam-u2f-compatible credential. Users only need to run the tool and share the output to facilitate onboarding.

⛔ The SSH public key is not compatible with pam-u2f without conversion!

The administrator would have to add entries to the 'credentials' file as well as update the PAM configuration [Fig. 14] providing the origin as follows:

auth sufficient pam_u2f.so authfile=/etc/yubico/credentials cue origin=ssh:
None

End-user experience

On Ubuntu Desktop, the user sign-in experience appears as shown below [Fig. 15]. See the Verification section above for additional UX examples.

None

Further reading