I experimented on a Ubuntu 19.04 system a bit and took a look here: https://schulz.dk/2019/08/23/using-solokey-for-linux-login/ and here: https://wiki.gnome.org/Projects/GnomeKeyring/Pam#Advanced_configuration

After this created a file named common-fido-auth and included it in


and /etc/pam.d/gdm-password

The last one looks like this

session required pam_env.so readenv=1 user_readenv=0
session required pam_env.so readenv=1 envfile=/etc/default/locale user_readenv=0
@include common-fido-auth #instead of @include common-auth
@include common-account
@include common-session-noninteractive

I assumed that common-auth has modules which unlocks the gnome keyring and copied some lines from common-auth

auth include common-fido
auth requisite pam_deny.so
auth required pam_permit.so
auth optional pam_cap.so

Where as common-fido looks like

auth sufficient pam_u2f.so
auth [success=1 default=ignore] pam_unix.so nullok_secure

But it seems to be wrong. The pam_unix.so is not interpereted properly and with the Solokey I have to type in my password for the Gnome Keyring

Has someone any ideas?

  • I m having the same problem. Using Fedora MATE 31. Key changes I made are: # diff passwd passwd.bk0 4c4 < password optional pam_gnome_keyring.so use_authtok --- > -password optional pam_gnome_keyring.so use_authtok # diff lightdm lightdm.bk0 3d2 < auth sufficient pam_u2f.so authfile=/etc/u2f_mappings cue 6c5 < auth optional pam_gnome_keyring.so --- > -auth optional pam_gnome_keyring.so 21c20 < session optional pam_gnome_keyring.so auto_start --- > -session optional pam_gnome_keyring.so auto_start but still no luck. – Karsus Apr 27 at 0:26
  • MAybe this helps. Had a longer discussion here: github.com/Yubico/pam-u2f/issues/130 – Twinkybot Apr 28 at 7:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.