1

I am trying to add a security key with button (Fido U2F) in Debian. I think the problem may be with the button because of my previous experience with such buttons in Transcend HDDs where no good support ever for such buttons in Linux. My test target is Gmail here with the internet browser Chrome, where I try to add the key as the authenticated key for Gmail. However, it fails all the time. Steps in Gmail

  • 2-step verification > Security Key > A Security Key is a small physical device used for signing in. It plugs into your computer's USB port. and go to the settings then and try to add
  • I plug it in as instructed. Repeat the iteration many times in different settings but nothing works as show by the following error.

    Something went wrong. Try again.

Because of the persintance of the error, I am thinking this is a Linux issue, probably because of the button of my security key. I have two security keys tested so there should be no malfunction in the key itself, reproducing the same error as described above. Bought from the manufacturer directly.
A few iterations about inserting the key and pressing the button in sudo dmesg

[51267.833520] usb 1-3: new full-speed USB device number 9 using xhci_hcd
[51267.975180] usb 1-3: New USB device found, idVendor=1050, idProduct=0407
[51267.975182] usb 1-3: New USB device strings: Mfr=1, Product=2, SerialNumber=0
[51267.975184] usb 1-3: Product: Yubikey 4 OTP+U2F+CCID
[51267.975185] usb 1-3: Manufacturer: Yubico
[51267.976497] input: Yubico Yubikey 4 OTP+U2F+CCID as /devices/pci0000:00/0000:00:14.0/usb1/1-3/1-3:1.0/0003:1050:0407.0009/input/input195
[51268.034276] hid-generic 0003:1050:0407.0009: input,hidraw0: USB HID v1.10 Keyboard [Yubico Yubikey 4 OTP+U2F+CCID] on usb-0000:00:14.0-3/input0
[51268.035070] hid-generic 0003:1050:0407.000A: hiddev0,hidraw1: USB HID v1.10 Device [Yubico Yubikey 4 OTP+U2F+CCID] on usb-0000:00:14.0-3/input1
[51272.394447] usb 1-3: USB disconnect, device number 9
[51277.307216] usb 1-3: new full-speed USB device number 10 using xhci_hcd
[51277.448615] usb 1-3: New USB device found, idVendor=1050, idProduct=0407
[51277.448619] usb 1-3: New USB device strings: Mfr=1, Product=2, SerialNumber=0
[51277.448621] usb 1-3: Product: Yubikey 4 OTP+U2F+CCID
[51277.448623] usb 1-3: Manufacturer: Yubico
[51277.450072] input: Yubico Yubikey 4 OTP+U2F+CCID as /devices/pci0000:00/0000:00:14.0/usb1/1-3/1-3:1.0/0003:1050:0407.000B/input/input196
[51277.507682] hid-generic 0003:1050:0407.000B: input,hidraw0: USB HID v1.10 Keyboard [Yubico Yubikey 4 OTP+U2F+CCID] on usb-0000:00:14.0-3/input0
[51277.508561] hid-generic 0003:1050:0407.000C: hiddev0,hidraw1: USB HID v1.10 Device [Yubico Yubikey 4 OTP+U2F+CCID] on usb-0000:00:14.0-3/input1
...

I made also a support ticket about the case with a link here for the case in Yubico.com.

[GAD3R] Yubico's instructions here

  1. If you have a Security Key by Yubico (blue color), U2F is enabled by default (only U2F mode is supported on this product). I have white YubiKey 4 (special edition), so I think the U2F feature should be applied by default.
  2. Go to https://github.com/Yubico/libu2f-host/blob/master/70-u2f.rules and download or create a copy of the file named 70-u2f.rules into the Linux directory: /etc/udev/rules.d/
  3. .... [rebooting, waiting, testing]

OS: Debian 8.7
Hardware: Asus Zenbook UX303UB
Fido U2F key: YubiKey 4
Chrome: 56.0.2924.87 (Official Build) (64-bit)
Ticket #00019479: How to use YubiKey 4 in Debian 8.7 with Google Chrome 56.x?

3

GAD3R's link sources work with the latest 70-u2f-rules when udev > 188. My dmesg now

[   54.329164] usb 1-1: new full-speed USB device number 4 using xhci_hcd
[   54.470555] usb 1-1: New USB device found, idVendor=1050, idProduct=0407
[   54.470557] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0
[   54.470558] usb 1-1: Product: Yubikey 4 OTP+U2F+CCID
[   54.470558] usb 1-1: Manufacturer: Yubico
[   54.483218] usbcore: registered new interface driver usbhid
[   54.483219] usbhid: USB HID core driver
[   54.486632] input: Yubico Yubikey 4 OTP+U2F+CCID as /devices/pci0000:00/0000:00:14.0/usb1/1-1/1-1:1.0/0003:1050:0407.0001/input/input23
[   54.545330] hid-generic 0003:1050:0407.0001: input,hidraw0: USB HID v1.10 Keyboard [Yubico Yubikey 4 OTP+U2F+CCID] on usb-0000:00:14.0-1/input0
[   54.545796] hid-generic 0003:1050:0407.0002: hiddev0,hidraw1: USB HID v1.10 Device [Yubico Yubikey 4 OTP+U2F+CCID] on usb-0000:00:14.0-1/input1

Testing the result in different internet browsers

The support comes right after you complete the above steps, as described in the page

You'll sign in with a Security Key whenever you use a new computer. You can choose to use your key each time you sign in or skip using it on trusted devices.

  1. The added key is not added to the rules of trusted way for the second step authentication right away if you use Firefox because Firefox is not supported.
  2. It works like charm if you use Google Chrome 56.x.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.