systemd-homed with FIDO2 - Login from tty still possible with password only

Question

I recently tried out systemd-homed and doing that I enrolled my Yubikey as FIDO2 device. When i try to authenticate against the created home via homectl authenticate <user> it correctly activates the Yubikey, asks for the PIN and waits for a touch then, followed by the usual password prompt.

But when I go ahead and log in to that account from a tty, I'm only prompted for the password, the U2F is completely omitted. Nevertheless, the previously locked home is decrypted and opened, even if the Yubikey is disconnected.

How can I enforce the U2F to be used for any authentication? I'm aware of pam-u2f, but if it is relevant here, i don't know how. I can't match the resources on securing 'traditional' user login with pam-u2f against this scenario, They always start with creating the keys, but these seem to be managed by systemd-homed in this case (I couldn't find definitive infos on that).

Answer 1

I figured it out and I'd like to share my findings with you, just in case someone stumbles upon the same problem.

It all has to do with the configuration of PAM. What I could tell from different findings on the web, this depends much on the Linux distribution used. In my case, on Arch Linux, the default system-auth file, responsible for user authentication, looked as follows:

$ cat /etc/pam.d/system-auth

#%PAM-1.0

auth       required                    pam_faillock.so      preauth
auth       [success=2 default=ignore]  pam_unix.so          try_first_pass nullok
-auth      [success=1 default=ignore]  pam_systemd_home.so
auth       [default=die]               pam_faillock.so      authfail
auth       optional                    pam_permit.so
auth       required                    pam_env.so
auth       required                    pam_faillock.so      authsucc
# ...

This means the pam_unix.so module (does authentication by password) is executed first and skips the following two modules on success. So if the password is correct, pam_systemd_home.so will never be executed, thus not query the U2F. As the account password is enrolled as LUKS key, it is sufficient to unlock the home partition container.

!!! CAUTION !!!

As always when fiddling around with PAM config, always keep a root shell open the whole time until you have successfully verified your changes, or you might lock yourself out of your PC!

I wanted to achieve authentication with my FIDO2 device only, so I did this:

cat /etc/pam.d/system-auth
#%PAM-1.0

auth       required                    pam_faillock.so      preauth
-auth      [success=2 default=ignore]  pam_systemd_home.so
auth       [success=1 default=ignore]  pam_unix.so          try_first_pass nullok
auth       [default=die]               pam_faillock.so      authfail
auth       optional                    pam_permit.so
auth       required                    pam_env.so
auth       required                    pam_faillock.so      authsucc

Now pam_systemd_home.so is executed first and will skip the default password prompt on success. For LUKS, this is sufficient, too, as the FIDO2 device is enrolled as a token there.

If you would like to have a 'real' 2FA, all you need to do is to change the [success=2 default=ignore] and [success=1... configurations to required ones.