Hi friends! Has anyone here had success using Yubikeys on Linux? I’ve been going back and forth with support to no avail, trying to get my Yubikey 5C NFC to play nicely on Ubuntu 22.04 LTS. Any suggestions are appreciated.
I have the following Yubikey-related packages on my system:
libyubikey-udev 1.20.0-3 [Ubuntu/jammy universe]
├── is installed
└── udev rules for unprivileged access to YubiKeys
libyubikey0 1.13-6 [Ubuntu/jammy universe]
├── is installed
└── Yubikey OTP handling library runtime
python3-yubikey-manager 4.0.7-1 [Ubuntu/jammy universe]
├── is installed
└── Python 3 library for configuring a YubiKey — transitional package
yubikey-manager 4.0.7-1 [Ubuntu/jammy universe]
├── is installed
└── Python library and command line tool for configuring a YubiKey
yubikey-manager-qt 1.2.4-1 [Ubuntu/jammy universe]
├── is installed
└── Graphical application for configuring a YubiKey
yubikey-personalization-gui 3.1.24-1build1 [Ubuntu/jammy universe]
├── is installed
└── Graphical personalization tool for YubiKey tokens
libfido2-1 1.10.0-1 [Ubuntu/jammy main]
├── is installed
└── library for generating and verifying FIDO 2.0 objects
python3-fido2 0.9.1-1 [Ubuntu/jammy universe]
├── is installed
└── Python library for implementing FIDO 2.0
pcscd 1.9.5-3ubuntu1 [Ubuntu/jammy universe]
├── is installed
└── Middleware to access a smart card using PC/SC (daemon side)
UPDATE: After working my way down the entire software stack, I contacted the vendor of my USB-C port and requested a replacement. It did the trick…
usually when I have problems with YubiKey being detected it is because the pcscd service has not been started, or I forgot to enable it so it would start automatically on boot.
You can follow the instructions here on how to do so: https://linuxhandbook.com/systemd-start-service-boot/
If that was really true, then most of the enterprise servers would have be using Windows/Mac OSX by now 🤭
There’s a difference between Linux on the desktop (a pile of shit) and Linux on the server (the way to go). Get over it. It hurts but it’s true.
For gnome login, (on Fedora at least) you need to install the packages and edit PAM config to enable the yubikey with login.
Thanks for your response. I am just looking to use the Yubikey for OTP/passkeys, not system login
yubikey works on every linux distro I have tried, and even on freebsd. Some people say it “works out of the box” but that part is not true on every distro. Every distro will recognize the device when it is plugged in, but not every distro will all 2FA actions out of the box, and almost no distro comes with the management tools.
On linux (and BSD) you can install a CCID tool to get the 2FA, which installs software that needs to be running (you can use the yubikey as a keyboard approach if you really need it) On Linux you can install a manager tool like ykman is easy, if you want to manage the tooling on your card On Linux you can setup PAM (authentication) so that yubikey can be used for logins, sudo auth etc On Linux you can use yubikey to do advanced things like manage the encryption keys for encrypted disks
As always, off to the Arch docs: https://wiki.archlinux.org/title/YubiKey
I appreciate the detailed response. I looked at the Arch wiki page and ensured that I have all packages listed. Still, the output of ykman info is “Error: No YubiKey detected!” :P
I have tried a yubikey on ubuntu without any problems. Could you please describe what exactly isn’t working
