I figured it out and I'd like to share my findings with you, just in case someone stumbles upon the same problem.
It all has to do with the configuration of PAM. What I could tell from different findings on the web, this depends much on the Linux distribution used. In my case, on Arch Linux, the default system-auth
file, responsible for user authentication, looked as follows:
$ cat /etc/pam.d/system-auth
#%PAM-1.0
auth required pam_faillock.so preauth
auth [success=2 default=ignore] pam_unix.so try_first_pass nullok
-auth [success=1 default=ignore] pam_systemd_home.so
auth [default=die] pam_faillock.so authfail
auth optional pam_permit.so
auth required pam_env.so
auth required pam_faillock.so authsucc
# ...
This means the pam_unix.so
module (does authentication by password) is executed first and skips the following two modules on success. So if the password is correct, pam_systemd_home.so
will never be executed, thus not query the U2F. As the account password is enrolled as LUKS key, it is sufficient to unlock the home partition container.
!!! CAUTION !!!
As always when fiddling around with PAM config, always keep a root shell open the whole time until you have successfully verified your changes, or you might lock yourself out of your PC!
I wanted to achieve authentication with my FIDO2 device only, so I did this:
cat /etc/pam.d/system-auth
#%PAM-1.0
auth required pam_faillock.so preauth
-auth [success=2 default=ignore] pam_systemd_home.so
auth [success=1 default=ignore] pam_unix.so try_first_pass nullok
auth [default=die] pam_faillock.so authfail
auth optional pam_permit.so
auth required pam_env.so
auth required pam_faillock.so authsucc
Now pam_systemd_home.so
is executed first and will skip the default password prompt on success. For LUKS, this is sufficient, too, as the FIDO2 device is enrolled as a token there.
If you would like to have a 'real' 2FA, all you need to do is to change the [success=2 default=ignore]
and [success=1...
configurations to required
ones.