FIDO2 Lab — Reference

lsusb
fido2-token -L     # expect: /dev/hidraw1: VENDOR MODEL FIDO+U2F

fido2-token -L                    # list tokens; note /dev/hidraw1
fido2-token -I /dev/hidraw1       # inspect: firmware, PIN state, retries
fido2-token -S /dev/hidraw1       # set a new PIN
fido2-token -C /dev/hidraw1       # change existing PIN

sudo apt update
sudo apt install libpam-u2f pamu2fcfg fido2-tools pamtester

rm -rf /tmp/fido2-login-test && mkdir -p /tmp/fido2-login-test && cd /tmp/fido2-login-test

echo "debian local login test challenge" | openssl sha256 -binary | base64 > cred_param
echo "localhost" >> cred_param
echo FIDO_USER >> cred_param
dd if=/dev/urandom bs=32 count=1 status=none | base64 >> cred_param

fido2-cred -M -t pin=true -i cred_param /dev/hidraw1 | fido2-cred -V -o cred

ls -l cred
cd && rm -rf /tmp/fido2-login-test

sudo groupadd --force fido-login
sudo usermod -aG fido-login FIDO_USER
id FIDO_USER              # fido-login must appear
getent group fido-login   # FIDO_USER must be listed

# Enroll primary token
pamu2fcfg -N -u FIDO_USER > /tmp/u2f_keys-FIDO_USER
cat /tmp/u2f_keys-FIDO_USER    # line must start with FIDO_USER:

sudo install -o root -g fido-login -m 0640 /tmp/u2f_keys-FIDO_USER /etc/security/u2f_keys
rm -f /tmp/u2f_keys-FIDO_USER
sudo python3 -c 'from pathlib import Path; p=Path("/etc/security/u2f_keys"); p.write_text(p.read_text().rstrip()+"\n")'
sudo ls -l /etc/security/u2f_keys            # expect: -rw-r----- root fido-login
sudo grep "^FIDO_USER:" /etc/security/u2f_keys

sudo cp /etc/security/u2f_keys /tmp/u2f_keys-FIDO_USER.new
sudo chown FIDO_USER:fido-login /tmp/u2f_keys-FIDO_USER.new
chmod 0640 /tmp/u2f_keys-FIDO_USER.new
printf ':' >> /tmp/u2f_keys-FIDO_USER.new
pamu2fcfg -N -n >> /tmp/u2f_keys-FIDO_USER.new
sudo install -o root -g fido-login -m 0640 /tmp/u2f_keys-FIDO_USER.new /etc/security/u2f_keys
rm -f /tmp/u2f_keys-FIDO_USER.new
sudo python3 -c 'from pathlib import Path; p=Path("/etc/security/u2f_keys"); p.write_text(p.read_text().rstrip()+"\n")'

sudo test -e /etc/pam.d/fido2-local-auth && \
  sudo cp -a /etc/pam.d/fido2-local-auth /etc/pam.d/fido2-local-auth.bak || true

sudo tee /etc/pam.d/fido2-local-auth >/dev/null <<'EOF'
{{EMBED:config/fido2-local-auth}}
EOF

sudo test -e /etc/pam.d/fido2-test && \
  sudo cp -a /etc/pam.d/fido2-test /etc/pam.d/fido2-test.bak || true

sudo tee /etc/pam.d/fido2-test >/dev/null <<'EOF'
{{EMBED:config/fido2-test}}
EOF

sudo pamtester fido2-test FIDO_USER authenticate       # FIDO PIN + touch
sudo pamtester fido2-test BREAKGLASS_USER authenticate # password only

sudo cp -a /etc/pam.d/lightdm /etc/pam.d/lightdm.bak
sudo editor /etc/pam.d/lightdm
# Insert @include fido2-local-auth immediately above @include common-auth

sudo mkdir -p /etc/lightdm/lightdm.conf.d
sudo tee /etc/lightdm/lightdm.conf.d/50-manual-login.conf >/dev/null <<'EOF'
{{EMBED:config/50-manual-login.conf}}
EOF

sudo pamtester lightdm FIDO_USER authenticate       # FIDO PIN + touch
sudo pamtester lightdm BREAKGLASS_USER authenticate # password

sudo cp -a /etc/pam.d/sudo /etc/pam.d/sudo.bak
sudo editor /etc/pam.d/sudo
# Insert @include fido2-local-auth immediately above @include common-auth

sudo -k && sudo -v   # test from FIDO_USER session

sudo tee /usr/local/sbin/fido2-sudo-pam-guard >/dev/null <<'EOF'
{{EMBED:scripts/fido2-sudo-pam-guard}}
EOF
sudo chmod 755 /usr/local/sbin/fido2-sudo-pam-guard

sudo tee /etc/apt/apt.conf.d/99-fido2-sudo-pam-guard >/dev/null <<'EOF'
{{EMBED:config/99-fido2-sudo-pam-guard}}
EOF

# Verify the guard works:
sudo grep fido2-local-auth /etc/pam.d/sudo
sudo sed -i '/fido2-local-auth/d' /etc/pam.d/sudo
sudo /usr/local/sbin/fido2-sudo-pam-guard
sudo grep fido2-local-auth /etc/pam.d/sudo
sudo -k && sudo -v

sudo cp -a /etc/pam.d/su /etc/pam.d/su.bak
sudo editor /etc/pam.d/su
# Keep pam_rootok.so FIRST, then @include fido2-local-auth above @include common-auth

su - FIDO_USER       # FIDO if token present
su - BREAKGLASS_USER # password

sudo cp -a /etc/pam.d/xfce4-screensaver \
     /etc/pam.d/xfce4-screensaver.bak.before-fido2-local-auth
sudo editor /etc/pam.d/xfce4-screensaver
# Content:
# auth include fido2-local-auth
# auth include common-auth
# auth optional pam_gnome_keyring.so
# account required pam_permit.so

sudo pamtester xfce4-screensaver FIDO_USER authenticate
sudo pamtester xfce4-screensaver FIDO_USER acct_mgmt
sudo pamtester xfce4-screensaver BREAKGLASS_USER authenticate
sudo pamtester xfce4-screensaver BREAKGLASS_USER acct_mgmt

xfconf-query -c xfce4-session -p /general/LockCommand \
  --create -t string -s "dm-tool switch-to-greeter"
xfconf-query -c xfce4-session -p /general/LockCommand  # verify output
xflock4                                                  # test manual lock

pgrep -a 'xfce4-screensaver|light-locker|xscreensaver|xsecurelock'  # active lockers?

sudo udevadm monitor --udev --environment
# Remove token → look for hidraw remove event with ID_FIDO_TOKEN=1
# Record ID_VENDOR_ID and ID_MODEL_ID

sudo tee /etc/udev/rules.d/85-fido-lock-on-remove-test.rules >/dev/null <<'EOF'
{{EMBED:config/85-fido-lock-on-remove-test.rules}}
EOF
sudo udevadm control --reload-rules

# Remove token, then:
sudo journalctl -b --since "2 minutes ago" | grep -i fido-udev-test

# If confirmed, remove test rule:
sudo rm -f /etc/udev/rules.d/85-fido-lock-on-remove-test.rules
sudo udevadm control --reload-rules

sudo tee /etc/udev/rules.d/85-fido-lock-on-remove.rules >/dev/null <<'EOF'
{{EMBED:config/85-fido-lock-on-remove.rules}}
EOF
sudo udevadm control --reload-rules

# Test helper manually:
sudo /usr/local/sbin/fido-remove-switch-to-greeter

# Post-removal log:
sudo journalctl -b --since "3 minutes ago" | \
  grep -Ei 'fido-switch-greeter|fido-udev|dm-tool|lightdm|greeter'

sudo passwd -l FIDO_USER              # lock password
sudo passwd -S FIDO_USER              # verify: field begins with !
sudo getent shadow FIDO_USER
id FIDO_USER                          # still in fido-login?

# Re-test after locking:
sudo -k && sudo -v
xflock4
sudo pamtester lightdm FIDO_USER authenticate
sudo pamtester lightdm BREAKGLASS_USER authenticate
sudo pamtester xfce4-screensaver FIDO_USER authenticate

# Restore if needed:
sudo passwd -u FIDO_USER

sudo apt install seahorse
seahorse   # Passwords and Keys → Login → Change Password → leave new password blank

# Token
fido2-token -L
lsusb

# Group / mapping
id FIDO_USER
getent group fido-login
sudo ls -l /etc/security/u2f_keys
sudo grep "^FIDO_USER:" /etc/security/u2f_keys

# PAM state
sudo cat /etc/pam.d/fido2-local-auth
sudo grep fido2-local-auth /etc/pam.d/lightdm
sudo grep fido2-local-auth /etc/pam.d/sudo

# Graphical session env — run from FIDO_USER XFCE terminal
echo "$DISPLAY" && echo "$XDG_RUNTIME_DIR" && echo "$DBUS_SESSION_BUS_ADDRESS"

# Active screen lockers
pgrep -a 'xfce4-screensaver|light-locker|xscreensaver|xsecurelock'

# dm-tool present?
command -v dm-tool

# Log tail — token removal / greeter / PAM events
sudo journalctl -b --since "5 minutes ago" | \
  grep -Ei 'fido-switch-greeter|fido-udev|dm-tool|lightdm|pam_u2f|greeter'

# sudo guard log
sudo journalctl -b | grep fido2-sudo-pam-guard

# Step 1: unplug the token
# Step 2: run the command — it blocks waiting for the device to appear
fido2-token -R /dev/hidraw1
# Step 3: plug the token back in — do this and the next step within 10 seconds
# Step 4: press the button when the LED flashes (same 10-second window from power-up)

fido2-token -L                 # confirm device path
fido2-token -I /dev/hidraw1    # PIN management should show no PIN set

ykman fido reset           # interactive: prompts to unplug/replug, then touch
ykman fido reset --force   # skip confirmation prompt (still requires physical touch)

sudo rm -f /etc/security/u2f_keys
sudo gpasswd -d FIDO_USER fido-login   # remove user from group
sudo passwd -u FIDO_USER               # unlock password if locked in §19