pam-u2f mit Homebrew, apk, dnf, MacPorts, pacman, apt, Nix, zypper installieren

Projektlinks

• Homepage
• Repository
• Paketmanager-Seite

Befehle und Aliase

• pamu2fcfg

Projektgeschichte

Yubico released the initial pam-u2f version in December 2014. Version 1.0.0 followed in June 2015 with XDG-based per-user mappings plus manual and interactive modes.

Version 1.1.0 migrated the implementation from the older U2F libraries to libfido2 in September 2020, adding FIDO2 capabilities including user verification, PIN verification, resident credentials, and SSH credential format.

Version 1.4.0 in March 2025 introduced the default /etc/security/pam_u2f.conf module configuration file and began a build-system transition from Autotools to CMake.

Adoptionsgeschichte

Yubico documents packages for Ubuntu, Fedora, and macOS/Homebrew, while the input metadata additionally records packages for Alpine, Debian, MacPorts, Nix, Arch, Ubuntu, and openSUSE.

The module originally targeted U2F authenticators and broadened into FIDO2, PIN, user-verification, resident-credential, and OpenSSH security-key workflows.

Wie es verwendet wird

Administrators add pam_u2f.so to the relevant files under /etc/pam.d, typically as a required second factor after primary authentication or as a sufficient module for passwordless PIN or biometric authentication.

Users enroll a connected authenticator with pamu2fcfg and store its mapping in the per-user XDG location, while administrators can instead maintain a central mapping such as /etc/u2f_mappings.

Warum Paket-Nerds sich dafür interessieren

pam-u2f connects hardware-backed FIDO authentication to the traditional Unix PAM stack. It is attractive to system integrators because it supports both per-user and centrally administered mappings and can provide either a second factor or passwordless authentication.

Its authentication-critical placement makes packaging and upgrades unusually sensitive: incorrect PAM configuration can cause lockouts, and its release history includes security hardening and fixes for authentication bypass or unsafe debug handling.

Zeitleiste

• 2014-12-16: Initial release.
• 2015-06-17: Version 1.0.0 added XDG-based mappings and manual and interactive modes.
• 2020-09-17: Version 1.1.0 migrated to libfido2 and added major FIDO2 features.
• 2021-05-19: Version 1.1.1 fixed a PIN-authentication bypass.
• 2023-03-14: Version 1.3.0 added username expansion in authorization-file paths.
• 2025-03-25: Version 1.4.0 added module configuration-file support and CMake builds.

Related projects

• libfido2 supplies current FIDO device support. pamu2fcfg enrolls authenticators and emits authorization mappings. OpenSSH security-key credentials can be consumed with sshformat. YubiKey Touch Detector is related to user-presence notifications.

Quellen

• https://developers.yubico.com/pam-u2f/
• https://developers.yubico.com/pam-u2f/Manuals/
• https://developers.yubico.com/pam-u2f/Release_Notes.html
• https://github.com/Yubico/pam-u2f
• source_facts.package-manager