Use FIDO2 Yubikey as sudo password

sudo password is ok, but maybe not super safe and not nice having to type it on each pacman, systemctl, etc, why not use a Yubikey FIDO2 as your sudo password, it is nice only have to touch your key each time you need install/update your system 🦖

Step 1:

Install pam-u2f:

sudo pacman -S pam-u2f

Step 2:

create config folder to store your keys setup:

mkdir -p ~/.config/Yubico
touch ~/.config/Yubico/u2f_keys

Step 3:

Enroll your yubikey, run below command, connect your yubikey and touch it:

pamu2fcfg > ~/.config/Yubico/u2f_keys

Step 4:

Edit your auth configuration for sudo commands:

sudo nvim /etc/pam.d/sudo

Add/Update the below line

auth required pam_u2f.so

🎉 That's it now you only need to connect/touch your key instead of type your sudo password