Yubikey on Linux?

Hi friends! Has anyone here had success using Yubikeys on Linux? I’ve been going back and forth with support to no avail, trying to get my Yubikey 5C NFC to play nicely on Ubuntu 22.04 LTS. Any suggestions are appreciated.

I have the following Yubikey-related packages on my system:


<span style="color:#323232;">libyubikey-udev 1.20.0-3 [Ubuntu/jammy universe]
</span><span style="color:#323232;">├── is installed
</span><span style="color:#323232;">└── udev rules for unprivileged access to YubiKeys
</span><span style="color:#323232;">
</span><span style="color:#323232;">libyubikey0 1.13-6 [Ubuntu/jammy universe]
</span><span style="color:#323232;">├── is installed
</span><span style="color:#323232;">└── Yubikey OTP handling library runtime
</span><span style="color:#323232;">
</span><span style="color:#323232;">python3-yubikey-manager 4.0.7-1 [Ubuntu/jammy universe]
</span><span style="color:#323232;">├── is installed
</span><span style="color:#323232;">└── Python 3 library for configuring a YubiKey — transitional package
</span><span style="color:#323232;">
</span><span style="color:#323232;">yubikey-manager 4.0.7-1 [Ubuntu/jammy universe]
</span><span style="color:#323232;">├── is installed
</span><span style="color:#323232;">└── Python library and command line tool for configuring a YubiKey
</span><span style="color:#323232;">
</span><span style="color:#323232;">yubikey-manager-qt 1.2.4-1 [Ubuntu/jammy universe]
</span><span style="color:#323232;">├── is installed
</span><span style="color:#323232;">└── Graphical application for configuring a YubiKey
</span><span style="color:#323232;">
</span><span style="color:#323232;">yubikey-personalization-gui 3.1.24-1build1 [Ubuntu/jammy universe]
</span><span style="color:#323232;">├── is installed
</span><span style="color:#323232;">└── Graphical personalization tool for YubiKey tokens
</span><span style="color:#323232;">
</span><span style="color:#323232;">libfido2-1 1.10.0-1 [Ubuntu/jammy main]
</span><span style="color:#323232;">├── is installed
</span><span style="color:#323232;">└── library for generating and verifying FIDO 2.0 objects
</span><span style="color:#323232;">
</span><span style="color:#323232;">python3-fido2 0.9.1-1 [Ubuntu/jammy universe]
</span><span style="color:#323232;">├── is installed
</span><span style="color:#323232;">└── Python library for implementing FIDO 2.0
</span><span style="color:#323232;">
</span><span style="color:#323232;">pcscd 1.9.5-3ubuntu1 [Ubuntu/jammy universe]
</span><span style="color:#323232;">├── is installed
</span><span style="color:#323232;">└── Middleware to access a smart card using PC/SC (daemon side)
</span>
Sarcasmo220,

usually when I have problems with YubiKey being detected it is because the pcscd service has not been started, or I forgot to enable it so it would start automatically on boot.

You can follow the instructions here on how to do so: linuxhandbook.com/systemd-start-service-boot/

vhstape,
@vhstape@lemmy.sdf.org avatar

Unfortunately, pcscd is running… At this point I am thinking it is a hardware issue with my setup

TCB13,
@TCB13@lemmy.world avatar

Now I’m gonna tell you what nobody talks about when moving to Linux:

  1. Proprietary/non-Linux apps provide good features, support and have tons of hours of dev time and continuous updates that the FOSS alternatives can’t just match.

Read the rest here: lemmy.world/comment/6584073

KarnaSubarna,
@KarnaSubarna@lemmy.ml avatar

If that was really true, then most of the enterprise servers would have be using Windows/Mac OSX by now 🤭

TCB13, (edited )
@TCB13@lemmy.world avatar

There’s a difference between Linux on the desktop (a pile of shit) and Linux on the server (the way to go). Get over it. It hurts but it’s true.

KarnaSubarna,
@KarnaSubarna@lemmy.ml avatar

And, the difference is?

TCB13, (edited )
@TCB13@lemmy.world avatar

The difference is that there’s a lot of commercial support when it comes to supporting Linux servers due to many reasons, when it comes to the desktop it simply isn’t there.

If you require “professional” software such as MS Office, Adobe Apps, Autodesk, NI Circuit Design and whatnot Linux isn’t a viable options. The alternatives wont cut it if you require serious collaboration… virtualization, emulation (wine) may work but won’t be nice. Going for Linux kinda adds the same pains of going macOS but 10x. Once you open the virtualization door your productivity suffers greatly, your CPU/RAM requirements are higher and suddenly you’ve to deal with issues in two operating systems instead of just one. And… let’s face it, nothing with GPU acceleration will ever run decently unless big companies start fixing things - GPU passthroughs and getting video back into the main system are a pain and add delays.

To make things worse the Linux desktop development ecosystem is essentially non existent. The success of Windows and macOS is the fact that they provide solid and stable APIs and development tools that “make it easy” to develop for those platforms and Linux is very bad at that. The major pieces of Linux are constantly and ever changing requiring large and frequent re-works of apps. There aren’t distribution “sponsored” IDEs (like Visual Studio or Xcode), userland API documentation, frameworks etc.

wesker,
@wesker@lemmy.sdf.org avatar

Is there a Lemmy version of lostredditors?

giacomo,

I don’t think you are correct. You will need to get over this. Thanks in advance.

jaxxed,

yubikey works on every linux distro I have tried, and even on freebsd. Some people say it “works out of the box” but that part is not true on every distro. Every distro will recognize the device when it is plugged in, but not every distro will all 2FA actions out of the box, and almost no distro comes with the management tools.

On linux (and BSD) you can install a CCID tool to get the 2FA, which installs software that needs to be running (you can use the yubikey as a keyboard approach if you really need it) On Linux you can install a manager tool like ykman is easy, if you want to manage the tooling on your card On Linux you can setup PAM (authentication) so that yubikey can be used for logins, sudo auth etc On Linux you can use yubikey to do advanced things like manage the encryption keys for encrypted disks

As always, off to the Arch docs: wiki.archlinux.org/title/YubiKey

vhstape,
@vhstape@lemmy.sdf.org avatar

I appreciate the detailed response. I looked at the Arch wiki page and ensured that I have all packages listed. Still, the output of ykman info is “Error: No YubiKey detected!” :P

jaxxed,

What was your mesg/jpurnalctl output when you plugged in the key?

vhstape,
@vhstape@lemmy.sdf.org avatar

I do not get any messages. I’m starting to think there is an issue with my motherboard’s USB-C port. If I can get my hands on a USB-C to USB-A adapter, I can test this theory…

AutumnSpark1226,
@AutumnSpark1226@lemmy.today avatar

I have tried a yubikey on ubuntu without any problems. Could you please describe what exactly isn’t working

pineapplelover,

It works fine straight out of the box. If you need the totp codes, personalization, setting it up download the yubikey apps (probably in your apt repo or check documentation)

8osm3rka, (edited )

Are you talking about 2FA login for your own user account or U2F/PIV/WebAuthn in your browser? The latter seems to work out of the box on any non-snap or flatpak browser, but the former needs a bit more setup as that is not a standard feature in Ubuntu yet. I recommend using ykman and yubico-piv-tool for configuring yubikeys in linux, but Yubico also provides a GUI application on their website

vhstape,
@vhstape@lemmy.sdf.org avatar

Definitely the latter. I have only tried using the Flatpak version of Firefox, but the system won’t even detect the key so it’s no shock Firefox can’t either…

berg,

I used to use one without any issues, it wasn’t the 5 series but it had NFC. The worst part was setting up to use it as an ssh key. Just normal 2FA with it worked straight out of the box (firefox/arch). Is that what you’re trying to do?

floofloof, (edited )

I use my Yubikeys all the time in OpenSUSE Tumbleweed and Linux Mint - a Yubikey 5 NFC and a Yubikey 5C NFC (mostly with Firefox). I have never had any problems with them. Mint is Ubuntu-based so they ought to work in Ubuntu. Sorry I can’t advise you on why yours isn’t working, but it should definitely be possible to get it working.

WeAreAllOne,

Tumbleweed user here. Thinking of buying a yubikey; is it easy to setup for logins etc or does it involve terminal commands etc. I mean is there a repository app?

floofloof,

I’m afraid I can’t remember how I did it, it was some time ago on a machine I no longer have. There is some advice here:

…yubico.com/…/360016649039-Installing-Yubico-Soft…

There’s an appimage for their manager app there. You might also try using Distrobox to give yourself access to a distro that uses apt, and then add Yubico’s PPA and install the software from there. I don’t know whether it would work but in principle it should.

wesker, (edited )
@wesker@lemmy.sdf.org avatar

I’m on Debian, but I think I’ve only ever used mine in Librewolf. But I can verify it works fine for me in the browser.

dotslashme,

Did you check their support guides …yubico.com/…/360016649099-Ubuntu-Linux-Login-Gui…! ?

  • All
  • Subscribed
  • Moderated
  • Favorites
  • •
  • linux@lemmy.ml
  • localhost
  • All magazines
    •
    Loading…
    Loading the web debug toolbar…
    Attempt #