Secure Your Fedora System with Smart Card U2F Authentication // First Mission

Passwords have a structural problem: they can be guessed, phished, leaked, and reused, and no amount of “please use a strong password” fixes that. The answer that security professionals keep coming back to is something you have, not something you know: a physical key. In today’s digital world, securing our systems is more important than ever, and one effective way to enhance your system’s security is by using a YubiKey for U2F (Universal 2nd Factor) authentication.

This guide will walk you through setting up smart card U2F authentication on a Fedora system. It’s easier than you might think, and once it is done, logging into your machine without the key becomes impossible, which means a stolen laptop is no longer a stolen identity.

Step 1: 📦 Install the U2F Packages

First, you’ll need to install the necessary U2F packages. Open your terminal and run the following command:

sudo dnf install pam-u2f pamu2fcfg

The pam-u2f package adds the PAM module that actually performs the authentication, and pamu2fcfg is the helper that records your key’s credentials. You need both.

Note: If your system can’t find the YubiKey as a U2F device, you may need to download an additional udev rule. You can do this by running:

sudo wget https://raw.githubusercontent.com/Yubico/libu2f-host/master/70-u2f.rules -O /etc/udev/rules.d/70-u2f.rules

The udev rule tells Linux how to recognize the key as a U2F device instead of a generic USB gadget. After installing it, reload the rules with sudo udevadm control --reload and replug the key.

Step 2: 📝 Create PAM Configuration Files

Next, you’ll create two PAM configuration files: u2f-required and u2f-sufficient. These files will help manage the authentication process, and the difference between them is the difference between a lock and a backup lock.

Create the u2f-required file:

sudo nano /etc/pam.d/u2f-required

Add the following content:

#%PAM-1.0
auth required pam_u2f.so

Now, create the u2f-sufficient file:

sudo nano /etc/pam.d/u2f-sufficient

Add the following content:

#%PAM-1.0
auth sufficient pam_u2f.so

Use u2f-required where you want the key to be the only way in, and u2f-sufficient where you want the key to be enough on its own but the password to remain a fallback. Naming matters here: PAM will look for these filenames when you include them in other configurations.

Note: If you’ve moved the u2f_keys file to /etc/Yubico/u2f_keys as mentioned in the next steps, you’ll need to append authfile and the path to the PAM configuration, like so:

auth required pam_u2f.so authfile=/etc/Yubico/u2f_keys

Step 3: 🗝️ Configure User Authentication

To retrieve a configuration line for your YubiKey, use the pamu2fcfg tool. This line will go into your ~/.config/Yubico/u2f_keys file. Run the following commands:

mkdir -p ~/.config/Yubico
pamu2fcfg > ~/.config/Yubico/u2f_keys

When you run pamu2fcfg, the key will blink, and you must touch it. That physical touch is the whole point: it proves a human is present, not just a stolen password file.

If you have a backup key, add it using the --nouser option and append it to the existing key (line):

pamu2fcfg -n >> ~/.config/Yubico/u2f_keys

Do not skip the backup key. The day your primary key is lost, bent, or dead is the day you will be very glad the second one is already registered.

Step 4: 🔗 Integrate YubiKey Authentication with PAM

There are several PAM configuration files where you can integrate YubiKey authentication. Some common use cases include:

/etc/pam.d/login
/etc/pam.d/gdm-password
/etc/pam.d/lightdm
/etc/pam.d/sudo
/etc/pam.d/sudo-i
/etc/pam.d/sshd (non-u2f using pam-yubico)
/etc/pam.d/runuser
/etc/pam.d/runuser-l
/etc/pam.d/su
/etc/pam.d/su-l

Update the necessary files in /etc/pam.d to add YubiKey authentication:

auth include system-auth
auth include u2f-required

auth include u2f-sufficient
auth include system-auth

The order of the two lines decides the behavior: with u2f-required after system-auth, both factors are demanded. With u2f-sufficient first, the key alone unlocks the session. For sudo, I personally recommend the required variant, since that is the command with the power to break the whole machine.

🧠 Final Thoughts

Hardware authentication is one of those upgrades that feels like a hassle for the first week and like a superpower after that. The key always works, it cannot be phished, and the moment someone steals your laptop, they get a brick instead of an identity.

Start with one service, probably sudo or your login screen, live with it for a few days, and then expand to the rest. And keep that backup key somewhere safe. Give these steps a try, and feel free to ask if you encounter any issues along the way! 😃