Trezor recently upgraded the firmware for their handy devices to include U2F functionality. This is great for securing online resources, but what about using your Trezor and U2F to help secure Ubuntu/Mint workstations? Is it possible to add two factor authentication to things like MDM logins and sudo?

Warning

Be aware that if you mess things up, or don't have your Trezor handy after you finish configuring U2F on your workstation you'll be locked out. Caveat Emptor!

Update Reddit User /u/stickac adds:

Cool thing about TREZOR is that you can recover the seed used to generate U2F secret, so even if you lose TREZOR you can still log in to your machine after recovery (as opposed when using other U2F tokens).

See: https://doc.satoshilabs.com/trezor-user/recovery.html

Installation

You'll need your Trezor be be running firmware 1.4 or greater. See: https://blog.trezor.io/secure-two-factor-authentication-with-trezor-u2f-e940fd5a60af#.9ys8d47f3 for details. Once your Trezor is ready and you'll need to add U2F authentication as an option on your machine. To do so install the needed U2F packages by running:

$ sudo apt-get install libpam-u2f pamu2fcfg

U2F_Mappings File

Next you'll need to generate your U2F mappings file. Plug in your Trezor and run:

$ pamu2fcfg -u yourusername > /tmp/u2f_mappings

You'll need to confirm on your Trezor at this point.

Now move the u2f_mappings file into /etc:

$ sudo mv /tmp/u2f_mappings /etc/u2f_mappings

Configuring Pam to Use U2F

The u2f_mappings file you've put into /etc will be used by pam to add two factor authentication to your system by adding a couple of config lines to the appropriate pam files.

Here's some of the things you'll want to add U2F authentication to:

sudo
login
su
mdm, lightdm or gdm
cinnamon-screensaver

You can see the various things on your system which require authentication by looking in /etc/pam.d/ If you're a hacker like me, you can try configuring U2F for other things using the information in this article. If you do, I suggest trying it out on a Virtual Machine first.

$ ls /etc/pam.d

Examples

Time to fire up your favorite text editor!

sudo

First add two factor authentication to the sudo command.

$ sudo emacs -nw /etc/pam.d/sudo

Add this at the end of the file:

# u2f authentication

auth required pam_u2f.so authfile=/etc/u2f_mappings cue

You can test at this point by firing up another terminal and running a sudo command. If you've done things correctly you'll be asked for your password and then prompted to "Please touch the device." Your Trezor will also be prompting you to authorize. Congratulations your system now requires your Trezor to run sudo. Pretty neat eh?

login
Next lets secure login. I don't want anyone besides me getting onto my system using a virtual console. If you're not aware of what this means check out: https://en.wikipedia.org/wiki/Virtual_console

$ sudo emacs -nw /etc/pam.d/login

Add this at the end of the file:

# u2f authentication

auth required pam_u2f.so authfile=/etc/u2f_mappings cue

Test by bringing up a virtual console. Again you'll be prompted to touch your Trezor after you've authenticated.

su

By now you should see what is being done here. Lets lock down the su command now: https://en.wikipedia.org/wiki/Su_(Unix)

$ sudo emacs -nw /etc/pam.d/su

Add this at the end of the file:

# u2f authentication

auth required pam_u2f.so authfile=/etc/u2f_mappings cue

You can test by running:

$ su yourusername

Conclusion

Be sure to add U2F authentication to your login and screen saver screens as well. I run GDM and Cinnamon, so I set up U2F for those. Again, see /etc/pam.d for the config files you'll need to tweak. As mentioned in Mike Jonesey's article, to really secure your install you should be running your disks fully encrypted, etc.

Happy Hacking!

Secure Two-Factor Authentication with TREZOR — U2F on Linux Mint