# Problème utilisation de pam\_u2f

**URL:** <https://www.debian-fr.org/t/probleme-utilisation-de-pam-u2f/89516>\
**Category:** Support Debian\
**Tags:** fido2, pam\_u2f, yubikey, pamd\
**Created:** [Février 6, 2024, 9:07 UTC](https://www.debian-fr.org/t/probleme-utilisation-de-pam-u2f/89516 "2024-02-06T09:07:26Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Zargos](https://www.debian-fr.org/user_avatar/www.debian-fr.org/zargos/32/10889_2.png) [@Zargos](https://www.debian-fr.org/u/Zargos)\
**Post date:** [Février 6, 2024, 9:07 UTC](https://www.debian-fr.org/t/probleme-utilisation-de-pam-u2f/89516/1 "2024-02-06T09:07:26Z")

</div>

Bonjour,  
j’essaye de faire en sorte d’utiliser ma clef yubikey 5 NFC pour sudo.  
Dans /etc/pam.d/common-auth j’ai:

```auto
auth required pam_faillock.so preauth # Added to enable faillock
auth	[success=1 default=ignore]	pam_unix.so nullok
auth [default=die] pam_faillock.so authfail # Added to enable faillock
auth sufficient pam_faillock.so authsucc # Added to enable faillock
auth	requisite pam_deny.so
auth	required pam_permit.so
auth	optional pam_cap.so 

```

et dans /etc/pam.d/sudo j’ai mis:

```auto
session required pam_limits.so

@include common-auth

auth	required	pam_u2f.so debug cue origin=pam://headquarters

@include common-account
@include common-session-noninteractive

```

Seulement voilà, dans les logs, il n’y aucune trace du passage par pam\_u2f:

```auto
2024-02-06T09:49:10.095944+01:00 dsrvtest03 sudo: zargos : TTY=pts/1 ; PWD=/home/zargos ; USER=root ; COMMAND=/usr/bin/apt update
2024-02-06T09:49:10.098156+01:00 dsrvtest03 sudo: pam_unix(sudo:session): session opened for user root(uid=0) by (uid=1000)
2024-02-06T09:49:16.738858+01:00 dsrvtest03 sudo: pam_unix(sudo:session): session closed for user root
2024-02-06T09:51:17.938768+01:00 dsrvtest03 sudo: zargos : TTY=pts/1 ; PWD=/home/zargos ; USER=root ; COMMAND=/usr/bin/apt search yubikey
2024-02-06T09:51:17.941699+01:00 dsrvtest03 sudo: pam_unix(sudo:session): session opened for user root(uid=0) by (uid=1000)
2024-02-06T09:51:18.595557+01:00 dsrvtest03 sudo: pam_unix(sudo:session): session closed for user root
2024-02-06T09:51:45.349404+01:00 dsrvtest03 sudo: zargos : TTY=pts/1 ; PWD=/home/zargos ; USER=root ; COMMAND=/usr/bin/apt search yubikey
2024-02-06T09:51:45.350487+01:00 dsrvtest03 sudo: pam_unix(sudo:session): session opened for user root(uid=0) by (uid=1000)
2024-02-06T09:51:45.996641+01:00 dsrvtest03 sudo: pam_unix(sudo:session): session closed for user root
2024-02-06T09:54:22.726269+01:00 dsrvtest03 sudo: zargos : TTY=pts/1 ; PWD=/home/zargos ; USER=root ; COMMAND=/usr/bin/apt update
2024-02-06T09:54:22.727116+01:00 dsrvtest03 sudo: pam_unix(sudo:session): session opened for user root(uid=0) by (uid=1000)
2024-02-06T09:54:25.910653+01:00 dsrvtest03 sudo: pam_unix(sudo:session): session closed for user root
2024-02-06T09:54:56.206595+01:00 dsrvtest03 sudo: zargos : TTY=pts/1 ; PWD=/home/zargos ; USER=root ; COMMAND=/usr/bin/apt update
2024-02-06T09:54:56.207410+01:00 dsrvtest03 sudo: pam_unix(sudo:session): session opened for user root(uid=0) by (uid=1000)
2024-02-06T09:54:59.648631+01:00 dsrvtest03 sudo: pam_unix(sudo:session): session closed for user root

```

---

<div class="post-metadata">

**Author:** ![Zargos](https://www.debian-fr.org/user_avatar/www.debian-fr.org/zargos/32/10889_2.png) [@Zargos](https://www.debian-fr.org/u/Zargos)\
**Post date:** [Février 6, 2024, 9:19 UTC](https://www.debian-fr.org/t/probleme-utilisation-de-pam-u2f/89516/2 "2024-02-06T09:19:38Z")

</div>

Bon j’ai trouvé:  
La ligne `pam_u2f` dans /`etc/pam.d/sudo` doit être avant les `includes`.  
Ainsi j’ai non seulement l’authentification Fido2 puis le mot de passe.