Enabling Yubikeys?

alexintokyo

Is there a way to enable the use of Yubikeys in GhostBSD? At the moment, I get prompted to touch the Yubikey button by Bitwarden for instance, but when I touch the button, nothing happens...

ericbsd

Oh, I had notes about that in the old forums, but I put it down since it was causing issues with the server.

ericbsd

I dug into MySQL and found what I wrote.

Post 1

So, I have installed those packages:
sudo pkg install yubico-piv-tool libu2f-host u2f-devd py311-yubikey-manager
You might only need libu2f-host and u2f-devd.
After that, I have added my user to the u2f group:
sudo pw group mod u2f -m ericbsd
I have tested it here: webauthn.io.
I set it on my Proton account, and it is working, although sometimes the first attempt fails.

Post 2

*For Firefox with PIV Authentication:
Enable and start the pcscd service
sudo service pcscd enable
sudo service pcscd start
Configure Firefox to use ykcs11

Open Firefox.

Enter about:preferences in the address bar.

In the left-hand column, click Privacy & Security.

Under the Security section, click Security Devices.

Click Load and provide the following information:
Module Name: YubiKey PIV

Module filename: /usr/local/lib/libykcs11.so*

Post 3

*Ensure that FIDO U2F is enabled in Firefox. By default, it is missing.

Open Firefox.

Enter about:config in the address bar.

Accept the risk warning to proceed.

Search for security.webauth.u2f.

If it is missing, create it as a boolean and set the value to true.*

Post from another user.

I use a Yubikey 5 for more than a year now, and it works very well. I have a pin, and the key is fully functional.
For a working key, you only need to install the following:
pkg install libu2f-host u2f-devd pcsc-lite
Then enable pcscd at boot:
service pcscd enable
Add your user to the u2f group:
pw group mod u2f -m user
Replace user with your actual username, and simply reboot.
For using 2FA in Firefox, you don’t need to adjust anything. In the current Firefox version, it works out of the box.
I use it in FreeBSD, NomadBSD (Yes, FreeBSD), and GhostBSD. It works.

alexintokyo

ericbsd Many thanks! I will have a go. This will increase the usability of GhostBSD for me greatly!

alexintokyo

ericbsd ericbsd Unfortunately, installing the various packages and adding myself to the u2f group etc does not enable me to use my Yubikey 5 NFC yet on GhostBSD.

When I try to 2FA on Bitwarden, I get the following error message:

NotAllowedError: The request is not allowed by the user agent or the platform in the current context, possibly because the user denied permission.

and when I try to register on webauthn.io, I get the following error message:
Registration ceremony was sent an abort signal

One possible cause of this I think might be that the system clock on my GhostBSD installation might not be as accurate as Yubikey would like. Is there a way to set the time server that GhostBSD references to a time server located in Japan so that the system clock will be as accurate as possible?

vimanuelt

alexintokyo
Modify /etc/ntp.conf.
Change lines 32, 33, and 34 to:

     ntp.nict.jp iburst
     pool 0.jp.pool.ntp.org iburst
     pool 2.jp.pool.ntp.org iburst

Then run: sudo service ntpd restart

Also, to reduce the time drift, you could run this command twice: sudo ntpdate -u ntp.nict.jp

alexintokyo

vimanuelt Thanks for this. I made the changes to the ntp.conf file and typed in the ntpdate update commanc twice, and the system clock seems to be perfectly accurate now.

Unfortunately, I am still getting the same error messages from both webauthn.io and from bitwarden when I click on the Yubikey 5 NFC button for 2FA. when I simply touch the Yubikey button in a text editor, or in Firefox's address bar, the random characters generated by Yubikey shows up without issues so it seems that the character strings are received but are somehow rejected by the authentification software in Firefox on GhostBSD.

I wonder whether there is some setting in Firefox itself which is somehow making Yubikey fail?

vimanuelt

webcamd sometimes grabs HID devices, blocking direct access.

You can stop it temporarily for testing: sudo service webcamd stop

If that fixes WebAuthn, you may need to blacklist your YubiKey in /usr/local/etc/webcamd.conf so it’s never claimed.

alexintokyo

vimanuelt Thanks for this suggestion. I did

sudo service webcamd stop

but this returned

webcamd is not running.

So it seems to be something else. Is it perhaps possible that my locale (Japanese) is garbling the output from the Yubikey? Is there a way to switch the locale for instance to English to see whether this might make a difference?

vimanuelt

alexintokyo
That is good to know.

To temporarily switch your locale to English, you can launch Firefox with a temporary environment:

LANG=en_US.UTF-8 firefox &

or more explicitly:

LC_ALL=en_US.UTF-8 LANG=en_US.UTF-8 firefox &

That will only affect the process you launch this way, not your whole system. Then test webauthn.io and Bitwarden again.

alexintokyo

vimanuelt Thanks for this. I tried switching the locale for the Firefox with the temporary environment. It didn't allow the use of my Yubikey in either webauthn.io or in bitwarden.

I did notice though that whereas the error message returned by bitwarden before I had changed the timeserver to the jp one was:

NotAllowedError: The request is not allowed by the user agent or the platform in the current context, possibly because the user denied permission.

Bitwarden is now returning the following error message to a Yubikey press:

AbortError: The operation was aborted.

vimanuelt

Do the same for fido2-token:

LC_ALL=en_US.UTF-8 fido2-token -L

If it lists the device, we know permissions and HID access are fine.

alexintokyo

vimanuelt I typed in the fido2-token command, but found that it did not return anything No list of device, no error message either...