Dear Maintainer,
I was mildly surprised to have pam_u2f not pop up in pam-auth-update(8)
after installation ‒ I was hoping to be able to use it like on my other
systems with other authenticators.
Here's the config shard I used in /usr/share/pam-configs/u2f,
modelled after fprintd's:
-- >8 --
Name: Universal second factor (U2F)
Default: no
Priority: 270
Auth-Type: Primary
Auth:
[success=end default=ignore] pam_u2f.so cue
-- >8 --
And it shows up like this:
┌────────────────────────────────┤ PAM configuration ├────────────────────────────────┐
│ Pluggable Authentication Modules (PAM) determine how authentication, │
│ authorization, and password changing are handled on the system, as well as │
│ allowing configuration of additional actions to take when starting user sessions. │
│ │
│ Some PAM module packages provide profiles that can be used to automatically adjust │
│ the behavior of all PAM-using applications on the system. Please indicate which │
│ of these behaviors you wish to enable. │
│ │
│ PAM profiles to enable: │
│ │
│ [*] Universal second factor (U2F) │
│ [ ] Fingerprint authentication │
│ [*] Unix authentication │
│ [*] Register user sessions in the systemd control group hierarchy │
│ [ ] Create home directory on login │
│ │
│ │
│ <Ok> <Cancel> │
│ │
└─────────────────────────────────────────────────────────────────────────────────────┘
Best,
наб