4

I'm running i3 window manager and have 2-factor authentication on my system. It appears that i3 and i3lock do NOT support the additional prompt for 2-factor authentication, but merely pipes the password I entered in as the verification code.

That obviously doesn't work, short of modifying my pam configuration and disabling 2-factor authentication (for i3lock), is there a better way that will let me leverage 2-factor authentication for i3lock as well?

5

i3lock supports PAM, which means that it has support for 2FA, though it may not support visual prompts for user input. Most Yubico products offer different types of 2FA. See Here for example.

The most common methods for 2FA at login is U2F and Challenge-Response (OTP). i3lock works with both.

The different 2FA methods require different steps from the user at login:

  • U2F requires the user to press the physical key on the USB after being prompted by the USB flashing.
  • Challenge-Response (OTP) only requires the Yubikey be plugged into the computer. (This is how the default login 2FA on Windows and Mac works)

Setup Yubikey U2F for i3lock

  1. Build your pam module (e.g. pam_u2f.so) and place it in the right spot (e.g. /lib/security). If you have a yubikey then follow Yubico's guide.
  2. Create /etc/pam.d/i3lock if it does not already exist. Here is the default file, which simply requires a password.
#
# PAM configuration file for the i3lock screen locker. By default, it includes
# the 'login' configuration file (see /etc/pam.d/login)
#

auth    include     login

You now have the following options for authenticating with your Yubikey, though the first one (password fallback) is only single factor authentication.

Option 1: Yubikey with password fallback

Add the following line before the auth include login line.

auth    sufficient      pam_u2f.so nouserok cue

This will unlock your computer if you hit enter, which triggers PAM authentication in i3lock (prompt will hang on "verifying") and then press the Yubikey, which should be flashing.

You can also unlock your computer simply by typing the correct password while the yubikey is not plugged in. If it is plugged in, the module will wait for the yubikey to fail, which will require you to unplug it, or wait for it to timeout (the boring way to gain access to your computer!).

Option 2: Require Yubikey and password

Add the following line after the auth include login line.

auth    required      pam_u2f.so nouserok cue

This will unlock your computer if you enter the correct password, hit enter, and then press the Yubikey (it should be flashing) to provide the required second factor.

Setup Yubikey Challenge-Response for i3lock

  1. Build the pam module. See Yubico's guide steps 2 and 4.
  2. Create /etc/pam.d/i3lock if it does not already exist. (See step 2 from U2F)

Option 1: Yubikey with password fallback

Add the following line before the auth include login line.

auth    sufficient      pam_yubico.so mode=challenge-response

This triggers PAM when the user presses enter on the lockscreen and if the Yubikey is inserted, the computer unlocks.

Similarly to Option 1 for U2F, you can also unlock your computer simply by typing the correct password while the yubikey is not plugged in.

Option 2: Require Yubikey and password

Add the following line after the auth include login line.

auth    required      pam_yubico.so mode=challenge-response

This requires both the yubikey to be plugged in and the correct password.

Debugging

If you get locked out, login on a virtual terminal (TTY). You can get to one with the ctrl+alt+f2 key combination. You can then kill i3lock with killall i3lock or find more information about what went wrong by looking through the output of journalctl -x.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.