You can use your Yubikey 4 or 5 for the rest of the tutorial.

Why?

If you mark your Yubikey presence is required to unlock your computer, then onenot only needs your password, they will have to gain physical access to yourYubikey.

Install the required packages

$ sudo dnf install ykclient* ykpers* pam\_yubico*

Getting the Yubikey(s) ready

Connect the Yubikey to your system, and see if it is not getting detected.

$ ykinfo -vversion: 5.2.7

If the system can not find the Yubikey, then it will show the following error.

Yubikey core error: no yubikey present

Then, for each of the Yubikey, we have the run the following command once:

$ ykpersonalize -2 -ochal-resp -ochal-hmac -ohmac-lt64 -ochal-btn-trig -oserial-api-visibleFirmware version 4.2.7 Touch level 517 Program sequence 1Configuration data to be written to key configuration 2:fixed: m:uid: n/akey: h:9d97972ff90267d7cff02b49d41f85a68325805cacc\_code: h:000000000000OATH IMF: h:0ticket\_flags: CHAL\_RESPconfig\_flags: CHAL\_HMAC|HMAC\_LT64|CHAL\_BTN\_TRIGextended\_flags: SERIAL\_API\_VISIBLECommit? (y/n) [n]: y

Here we are configuring the slot 2, with challenge-response mode, and HMAC(even less than 64 bytes), and also saying that the human has to touch thephysical key by providing CHAL\_BTN\_TRIG, also making the serial API visible.

$ ykpamcfg -2 -vdebug: util.c:219 (check\_firmware\_version): YubiKey Firmware version: 5.2.7Sending 63 bytes HMAC challenge to slot 2Sending 63 bytes HMAC challenge to slot 2Stored initial challenge and expected response in '/home/kdas/.yubico/challenge-16038846'.

Remember to touch the key button twice after the command sends in 63 bytes, theLED on the key should blink that that time.

Setting up GDM

Now, we can mark that the Yubikey must be present during login, and aftertouching the key, one still has to type in the password, or for lesser securitycontext, one needs either the Yubikey or password to login.

For the first scenario, add the following to the /etc/pam.d/gdm-passwordfile, just above the auth substack password-auth line.

auth required pam\_yubico.so mode=challenge-response

If you want either password or Yubikey to work, then replace required with sufficient.

Verify the setup

You will have to logout of Gnome, and then when you click your username whilerelogin, you will notice that the Yubikey is blinking. Touch it, and then enterpassword to complete login.

To setup sudo

The similar configuration changes required to be made in /etc/pam.d/sudo.But, remember to keep the sudo session open in one terminal, then try to testthe sudo command in another one. Just in case :)

To learn more about the pam configuration, read man pam.conf.