1

I recently tried out systemd-homed and doing that I enrolled my Yubikey as FIDO2 device. When i try to authenticate against the created home via homectl authenticate <user> it correctly activates the Yubikey, asks for the PIN and waits for a touch then, followed by the usual password prompt.

But when I go ahead and log in to that account from a tty, I'm only prompted for the password, the U2F is completely omitted. Nevertheless, the previously locked home is decrypted and opened, even if the Yubikey is disconnected.

How can I enforce the U2F to be used for any authentication? I'm aware of pam-u2f, but if it is relevant here, i don't know how. I can't match the resources on securing 'traditional' user login with pam-u2f against this scenario, They always start with creating the keys, but these seem to be managed by systemd-homed in this case (I couldn't find definitive infos on that).

Improve this question

1 Answer 1

Reset to default
1

I figured it out and I'd like to share my findings with you, just in case someone stumbles upon the same problem.

It all has to do with the configuration of PAM. What I could tell from different findings on the web, this depends much on the Linux distribution used. In my case, on Arch Linux, the default system-auth file, responsible for user authentication, looked as follows:

$ cat /etc/pam.d/system-auth

#%PAM-1.0

auth       required                    pam_faillock.so      preauth
auth       [success=2 default=ignore]  pam_unix.so          try_first_pass nullok
-auth      [success=1 default=ignore]  pam_systemd_home.so
auth       [default=die]               pam_faillock.so      authfail
auth       optional                    pam_permit.so
auth       required                    pam_env.so
auth       required                    pam_faillock.so      authsucc
# ...

This means the pam_unix.so module (does authentication by password) is executed first and skips the following two modules on success. So if the password is correct, pam_systemd_home.so will never be executed, thus not query the U2F. As the account password is enrolled as LUKS key, it is sufficient to unlock the home partition container.

!!! CAUTION !!!

As always when fiddling around with PAM config, always keep a root shell open the whole time until you have successfully verified your changes, or you might lock yourself out of your PC!

I wanted to achieve authentication with my FIDO2 device only, so I did this:

cat /etc/pam.d/system-auth
#%PAM-1.0

auth       required                    pam_faillock.so      preauth
-auth      [success=2 default=ignore]  pam_systemd_home.so
auth       [success=1 default=ignore]  pam_unix.so          try_first_pass nullok
auth       [default=die]               pam_faillock.so      authfail
auth       optional                    pam_permit.so
auth       required                    pam_env.so
auth       required                    pam_faillock.so      authsucc

Now pam_systemd_home.so is executed first and will skip the default password prompt on success. For LUKS, this is sufficient, too, as the FIDO2 device is enrolled as a token there.

If you would like to have a 'real' 2FA, all you need to do is to change the [success=2 default=ignore] and [success=1... configurations to required ones.

Improve this answer
7
  • If I understand correctly, the ‘real 2FA’ you mention would only work for users that are ‘real’ users, not such ones managed by systemd-homed?
    – christoph
    Oct 28, 2021 at 18:29
  • I get the following errors: ``` login[7146]: pam_systemd_home(login:auth): Home for user {my-user} successfully acquired. unix_chkpwd[7253]: check pass; user unknown unix_chkpwd[7280]: check pass; user unknown unix_chkpwd[7280]: password check failed for user ({my-user}) login[7146]: pam_unix(login:auth): authentication failure; logname=LOGIN uid=0 euid=0 tty=/dev/tty4 ruser= rhost= user={my-user} login[7146]: FAILED LOGIN 1 FROM tty4 FOR {my-user}, Authentication service cannot retrieve authentication info ```
    – christoph
    Oct 28, 2021 at 18:30
  • What I mean by real 2FA is to really require two factors for the user to be authenticated, i.e. first factor is the password (factor knowledge) and second is factor the FIDO2 device (factor possession). In my case, one factor was sufficient.
    – Simon
    Oct 28, 2021 at 19:06
  • I'm sorry I can't tell much from the error you cite. What did you try beforehand? I guess it's best you ask a new question. Feel free to drop me the link, though.
    – Simon
    Oct 28, 2021 at 19:18
  • Do you have your user in /etc/passwd? My user, created using homectl, only, cannot log in when pam requires both pam_unix and pam_systemd_homed.
    – christoph
    Oct 29, 2021 at 14:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .