Home / ubuntu / Questions / 1062796
Accepted
Hamish W
Asked: 2018-08-07 00:18:56 +0800 CST

Locked out from system after adding Yubikey 2FA

  • 772

I followed the official Yubico guide to enable Challenge-Response 2FA on my account, However on a reboot the login prompts for the Yubikey, then asks for my password, and then repeats these 2 prompts with no end. If I switch to a TTY and attempt to login with root, I get an Authentication Failure message after it prompt for both the Yubikey and my password. For now, I just want to find a way to disable 2FA so that I can diagnose and fix the problem in my own time.
My question is, If I boot with a live CD and simply comment out the line in the PAM configuration file, will that be sufficient to allow me to get back into my laptop?

password login yubikey

2 Answers

  1. Best Answer

    Boot rom a live CD.

    Mount your root file system at some place, and bind mount /dev, /proc and /sys. Assuming your root file system is mounted at /mnt in the live session, the following commands will do this:

    sudo mount --bind /proc /mnt/proc
sudo mount --bind /dev /mnt/dev
sudo mount --bind /sys /mnt/sys

    Then you have to chroot to your system

    sudo chroot /mnt

    Edit your PAM configuration and comment out the relevant line, like you suggested - and after saving the file, run pam-auth-update and disable the yubikey module.

    • 4

  2. For my case, if I pulled the Yubikey out, I could get in using regular password login. I then moved the following files to /etc/pam.disabled:

    lrwxrwxrwx   1 root root   31 Apr 29 23:40 gdm-smartcard -> /etc/alternatives/gdm-smartcard
-rw-r--r--   1 root root 1.3K Feb 25 11:42 gdm-smartcard-pkcs11-exclusive
-rw-r--r--   1 root root 1.4K Feb 25 11:42 gdm-smartcard-sssd-exclusive
-rw-r--r--   1 root root 1.4K Feb 25 11:42 gdm-smartcard-sssd-or-password

    i.e.,

    sudo -i
mkdir /etc/pam.disabled
cd /etc/pam.d
mv *smartcard* ../pam.disabled/

    You can then test by plugging in the Yubikey, locking the screen (Super+L or Lock if your keyboard has it), and you should see your happy familiar password prompt instead of the smartcard prompt.

    Nit: Just because I install smartcard software doesn't mean I want to login that way. This wasn't happening just a few versions ago. There should be a way to install the PKCS11 drivers without enabling them for PAM challenges.

    • 1