FIDO is the next big thing in multi factor authentication. Here is how I started using it to login my personal Linux computer.
VERY IMPORTANT: You are going to change a very critical system file (/etc/pam.d/common-auth) in this tutorial. If anything goes wrong, you may not be able to login to your computer anymore. Test what you are doing first in another system. No liability is assumed.
23.07.2018: I have updated the steps in this tutorial for a clean Ubuntu 18.04 installation on a linux container and to use libpam version 1.0.7.
a Linux computer. I am using Ubuntu 18.04 LTS. In your distro, there might be differences on the locations of files. For this tutorial, I have installed a clean Ubuntu 18.04 on a linux container.
a FIDO U2F device. I am using a Yubico Security Key.
Linux uses PAM (Pluggable Authentication Modules) to handle all authentication tasks. Since I am going to modify how I login (authenticate) to the system, using FIDO U2F, I need a PAM module providing this functionality.
libpam-u2f package is what I need. However, version 1.0.4 is released in 2016, and I really need some of the patches done after that, so I will use the latest version, which is 1.0.7 at the moment (23.07.2018), and build it from the source.
Before using the PAM library, I create a new user in sudo group, with a very long/complex password and keep this in a secure place. I will not use this user normally, but keep it as a backup in case U2F authentication fails or the U2F device is broken or lost.
This path is the default path pam_u2f.so will look for each user.
Since I set the origin and appid when using pamu2fcfg, I also use origin and appid parameters here.
This configuration will make use of U2F device, if $HOME/.config/Yubico/u2f_keys file is present, and if it is not present (or invalid) authentication will succeed (nouserok parameter). If you use the 1.0.4 version, this is not going to work, so make sure you use the latest version of pam_u2f. Parameter cue prompts a message to remind to touch U2F device.
Very Important: The u2f_keys file should not be under an encrypted file system, because files can be decrypted only after a successful authentication which requires u2f_keys file.
It is also possible to use a single system wide configuration (single u2f_keys file) rather than using per-user u2f_keys file using the authfile parameter of pam_u2f.
Note: when you have debug in pam_u2f.so configuration line in common-auth, you will see some debug output as well. Below, I omit that output.
So it seems like the setup is working.
I actually tried not only sudo, but normal login and lock screen as well.
As everything is working as expected, I modify the U2F config in common-auth and change sufficient to required and remove the debug parameter.
there is no U2F registration (no u2f_keys file) for the user trying to authenticate (nouserok parameter).
there is a U2F registration given under $HOME/.config/Yubico/u2f_keys of the user trying to authenticate and U2F device is plugged, touched and U2F authentication process completes successfully.