At least I found a clue myself, it is SELinux denying access:


type=AVC msg=audit(25-11-19 17:14:33.367:689) : avc:  denied  { read } for  pid=48804 comm=login name=u2f_keys dev="dm-4" ino=28953 scontext=system_u:system_r:local_login_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:config_home_t:s0 tclass=file permissive=0 
----
type=AVC msg=audit(25-11-19 17:16:56.497:728) : avc:  denied  { read } for  pid=49470 comm=login name=u2f_keys dev="dm-4" ino=28953 scontext=system_u:system_r:local_login_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:config_home_t:s0 tclass=file permissive=0 

I was able to make it work by using:

semenage fcontext -a -f a -t auth_home_t -r 's0' '/home(/.*)/.config/Yubico/u2f_keys'
semanage fcontext -a -f a -t auth_home_t -r 's0' '/root/.config/Yubico/u2f_keys'

Nevertheless, it feels more like "feature" in the SELinux policy. Anyone familiar with this?

Winfried



-----Oorspronkelijk bericht-----
Van: Winfried de Heiden <wdh@dds.nl>
Antwoord-naar: Community support for Fedora users <users@lists.fedoraproject.org>
Aan: Community support for Fedora users <users@lists.fedoraproject.org>
Onderwerp: Fedora 31 - pam_u2f - Yubikey 5
Datum: Mon, 25 Nov 2019 16:44:15 +0100

Hi all,

Using Fedora 31, pam_u2f and a Yubikey5 works well after:

authselect select sssd with-mkhomedir with-pam-u2f with-sudo without-nullok

and

pamu2fcfg –u[username] > ~/.config/Yubico/u2f_keys

However, from the console (without GDM, multi-user.target for example) it does not work: Linux will ask for my password where the yubikey should be sufficient.

Any ideas what could be wrong?

Winfried
_______________________________________________
users mailing list -- 
users@lists.fedoraproject.org

To unsubscribe send an email to 
users-leave@lists.fedoraproject.org

Fedora Code of Conduct: 
https://docs.fedoraproject.org/en-US/project/code-of-conduct/

List Guidelines: 
https://fedoraproject.org/wiki/Mailing_list_guidelines

List Archives: 
https://lists.fedoraproject.org/archives/list/users@lists.fedoraproject.org