https://bitlex.li/tags/pam/Recent content in Pam on Learning Journey of Alexander AllgäuerHugoen-usTue, 14 Apr 2026 00:00:00 +0000https://bitlex.li/tutorials/yubikey-passwordless-sudo/Tue, 14 Apr 2026 00:00:00 +0000https://bitlex.li/tutorials/yubikey-passwordless-sudo/<p>Use a YubiKey touch to replace your password for sudo .</p> <h2 id="install-pam-u2f">Install pam-u2f</h2> <div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;-webkit-text-size-adjust:none;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>sudo pacman -S pam-u2f </span></span><span style="display:flex;"><span>mkdir -p ~/.config/Yubico </span></span></code></pre></div><h2 id="register-the-keys">Register the keys</h2> <div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;-webkit-text-size-adjust:none;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>pamu2fcfg &gt; ~/.config/Yubico/u2f_keys <span style="color:#75715e"># primary key</span> </span></span><span style="display:flex;"><span>pamu2fcfg -n &gt;&gt; ~/.config/Yubico/u2f_keys <span style="color:#75715e"># append backup key</span> </span></span></code></pre></div><h2 id="edit-pam">Edit PAM</h2> <blockquote> <p><strong>⚠️ Warning:</strong> Keep a root session open in another terminal in case something goes wrong.</p> </blockquote> <div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;-webkit-text-size-adjust:none;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>sudo nano /etc/pam.d/sudo </span></span></code></pre></div><p>Add at the top:</p> <pre tabindex="0"><code>auth sufficient pam_u2f.so cue </code></pre><ul> <li><code>sufficient</code> → the YubiKey alone is enough to authenticate.</li> <li>Change to <code>required</code> if you want 2FA (YubiKey <strong>and</strong> password).</li> <li><code>cue</code> prints a hint when a touch is needed.</li> </ul> <h2 id="test-it">Test it</h2> <div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;-webkit-text-size-adjust:none;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>sudo -s </span></span><span style="display:flex;"><span>Please touch the FIDO authenticator. </span></span></code></pre></div>