Using Yubikeys with Fedora 24, for example for Github two-factor authentication

Tags: , , , , , , — Jeff @ 17:17

My old laptop’s wifi went on the fritz, so I got a new Lenovo P50. Fedora 23 wouldn’t work with the Skylake architecture, so I had to jump headfirst into the Fedora 24 beta.

I’ve since hit one new issue: Yubikeys wouldn’t work for FIDO U2F authentication. Logging into a site using a Yubikey (inserting a Yubikey USB device and tapping the button when prompted) wouldn’t work. Attempting this on Github would display the error message, “Something went really wrong.” Nor would registering Yubikeys with sites work. On Github, attempting to register Yubikeys would give the error message, “This device cannot be registered.”

Interwebs sleuthing suggests that Yubikeys require special udev configuration to work on Linux. The problem is that udev doesn’t grant access to the Yubikey, so when the browser tries to access the key, things go Bad. A handful of resources pointed me toward a solution: tell udev to grant access to the device.

As root, go to the directory /etc/udev/rules.d. It contains files with names of the form *.rules, specifying rules for how to treat devices added and removed from the system. In that directory create the file 70-u2f.rules. Its contents should be those of 70-u2f.rules, from Yubico‘s libu2f-host repository. (Most of this file is just selecting various Yubikey devices to apply rules against. The important part of this file is the TAG+="uaccess" ending the various lines. This adds the “uaccess” tag to those devices; systemd-logind recognizes this tag and will grant access to the device to the current logged-in user.) Finally, run these two commands to refresh udev state:

udevadm control --reload
udevadm trigger

Yubikeys should now work for authentication.

These steps work for me, and they appear to me a sensible way to solve the problem. But I can’t say for sure that they’re the best way to solve it. (Nor am I sure why Fedora doesn’t handle this for me.) If anyone knows a better way, that doesn’t involve modifying the root file system, I’d love to hear it in comments.


  1. I can’t offer you any better option, I’m afraid, but I did write a bit about U2F and Yubikeys for Linux Voice magazine a while back – although it was more from a Ubuntu/Mint perspective, rather than Fedora.

    In particular, issue #18 (available to download under a CC license) had a FAQ about U2F and a review of the Yubikey Edge. More usefully, in issue #20 I wrote a tutorial about how to use a Yubikey to add second factor authentication to the Linux login system (PAM). That article also included a boxout about the need to add a udev rule (with the forlorn hope that more recent distros might include it by default). Unfortunately issue #20 isn’t due to be released as CC for another month, but I figured my comment might be useful to visitors from the future.

    Comment by MarkC — 31.05.16 @ 04:57

  2. Thanks for the comment! I’ll add a comment whenever #20 goes CC linking to it, for those future readers. [Edit: issue #20 is now available for download.]

    In the abstract I can see how device-specific rules about how to mediate access, based on the effective user or whatever, make things more secure. But it makes me wonder how it works if every other OS gets by without device-specific tweaks, and why that isn’t “good enough”. :-\ Or maybe they do, and Apple and Microsoft are just more on the ball about shipping their equivalent of rules. Cathedrals make some decisions a whole lot easier sometimes.

    Comment by Jeff — 31.05.16 @ 08:31

  3. `dnf install u2f-hidraw-policy` solves this problem.

    Comment by Rayson — 28.12.16 @ 22:52

RSS feed for comments on this post. TrackBack URI

Leave a comment

HTML: You can use these tags: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>