H. Dale McBane dmcbane

Universal Two Factor (U2F) Authentication for Debian 10 Buster

This document describes how I setup two factor authentication (what I know, my password, and what I have, my U2F device) on my Debian 10 laptop. My goal was to provide two factor protection for local login and for sudo authentication. The following proceedure was tested using a Google Titan version T3 and a YubiKey 4.

NOTE: While this procedure is simple, you can lock yourself out of your system if you mistype commands or skip steps. A good way to prevent this from happening is to create another user that you can use to log into your system in the event that your key file is configured incorrectly. This user should have the ability to become the root user (using su or sudo) in order to repair any mistakes that you might make. You might also want to secure one PAM authorization module (sudo, gdm-password

	#!/usr/bin/env bash
	# Base16 - Gnome Terminal color scheme install script

	[[ -z "$PROFILE_NAME" ]] && PROFILE_NAME="terminal.sexy"
	[[ -z "$PROFILE_SLUG" ]] && PROFILE_SLUG="terminal-dot-sexy"
	[[ -z "$DCONF" ]] && DCONF=dconf
	[[ -z "$UUIDGEN" ]] && UUIDGEN=uuidgen

	dset() {
	local key="$1"; shift

	wget http://mirrors.ibiblio.org/gnu/ftp/gnu/emacs/emacs-25.1.tar.xz
	tar xJvfp emacs-25.1.tar.xz
	cd emacs-25.1/
	sudo yum -y install libXpm-devel libjpeg-turbo-devel openjpeg-devel openjpeg2-devel turbojpeg-devel giflib-devel libtiff-devel gnutls-devel libxml2-devel GConf2-devel dbus-devel wxGTK-devel gtk3-devel libselinux-devel gpm-devel librsvg2-devel ImageMagick-devel
	./configure
	make
	sudo make install

	#! /usr/bin/env bash
	# install prerequisits

	sudo apt install build-essential binutils flex bison autoconf automake libtool pkg-config gettext texinfo gdb git libunistring-dev libgc-dev libgmp-dev libiconv-hook-dev libltdl-dev libffi-dev libreadline-dev

	# optional
	sudo apt install libmysqlclient-dev libsqlite3-dev libpq-dev

	# clone the source repo
	if [ ! -d ~/src ]; then

	#! /usr/bin/env bash

	# install apt-cyg

	lynx -source rawgit.com/transcode-open/apt-cyg/master/apt-cyg > apt-cyg
	install apt-cyg /bin
	rm apt-cyg

	# install dependencies
	apt-cyg install gcc-g++ binutils flex bison autoconf automake libtool \

	#! /usr/bin/env bash

	# install dependencies
	pacman -S --noconfirm gcc binutils flex bison autoconf automake-wrapper libtool \
	pkg-config gettext texinfo gdb git libunistring-devel libgc-devel \
	gmp-devel libiconv-devel libffi-devel libreadline-devel intltool \
	gettext-devel

	# optional
	pacman -S --noconfirm libsqlite-devel # libmysqlclient-devel libsqlite3-devel libpq-devel

	# Thank you Steve, https://blog.stevegriffith.nyc/posts/titan-key-arch/

	#Go to the udev rules folder
	cd /etc/udev/rules.d

	# install the Google provided UDEV rule
	echo 'KERNEL=="hidraw*", SUBSYSTEM=="hidraw", ATTRS{idVendor}=="18d1", ATTRS{idProduct}=="5026", TAG+="uaccess"' \| sudo tee '71-titan-key.rultes'

	#Pull down the file from the yubikey github
	sudo wget https://raw.githubusercontent.com/Yubico/libu2f-host/master/70-u2f.rules

	#!/bin/sh

	set -e

	#### on some installations you may need to change /bin/sh above to /bin/bash

	# Adding the following lines, makes the pcgen script work from any directory
	############################################################################
	rreadlink() (
	target=$1 fname= targetDir= CDPATH=

	# /etc/udev/rules.d/70-u2f.rules
	#
	# sudo chmod 644 /etc/udev/rules.d/70-u2f.rules
	# sudo udevadm control --reload
	#
	# Copyright (C) 2013-2015 Yubico AB
	#
	# This program is free software; you can redistribute it and/or modify it
	# under the terms of the GNU Lesser General Public License as published by
	# the Free Software Foundation; either version 2.1, or (at your option)

	#! /bin/sh

	#based on https://stackoverflow.com/questions/29832037/how-to-get-script-directory-in-posix-sh

	rreadlink() ( # Execute the function in a subshell to localize variables and the effect of `cd`.

	target=$1 fname= targetDir= CDPATH=

	# Try to make the execution environment as predictable as possible:
	# All commands below are invoked via `command`, so we must make sure that `command`