Use YubiKey instead of fingerprint auth on Linux

I love fingerprint auth, it's very convenient and I don't have to punch in my password everytime. But since I go bouldering, practically my fingerprint gets sanded down everytime. Re-enrolling the fingerprint only works for a few days then it's not working again. (I'm very thankful that my current phone uses a thumb instead of index finger for fingerprint reader).

But yubikey exists, and you can do a lot of stuff with it aside from using it as a 2FA key or passkey. You can use it to log into linux, and grant sudo access. For laptops, it works best if you use a nano model, since the yubikey body won't protrude, which means you can leave it plugged in without having to worry about accidental damage.

For my setup, I want to use yubikey for authentication, but if yubikey is not present, it will fallback to default authentication mechanism.

You'll have to install following packages first. The names might be different if you are not on Ubuntu:

sudo apt install libpam-u2f pamu2fcfg

Then register your yubikey:

mkdir -p ~/.config/Yubico
pamu2fcfg > ~/.config/Yubico/u2f_keys

This will allow you to use yubikey to log into linux. If yubikey is not present, it'll fallback to normal password authentication:

sudo vi /etc/pam.d/gdm-password
## put this BEFORE `@include common-auth`
auth sufficient pam_u2f.so

When you are typing commands in a terminal and it prompts for sudo, you can also use yubikey to grant sudo privileges (with fallback to password auth):

sudo vi /etc/pam.d/sudo
## put this BEFORE `@include common-auth`
auth sufficient pam_u2f.so nouserok cue

But sometimes your desktop environment asks for sudo, then you'll need to set this so the sudo dialogue box will accept yubikey auth (with fallback to password auth):

sudo cp /usr/lib/pam.d/polkit-1 /etc/pam.d/polkit-1
sudo vi /etc/pam.d/polkit-1

## put this BEFORE `@include common-auth`
auth sufficient pam_u2f.so cue

It's too bad that I can't use a fingerprint reader on my thinkpad reliably, but then I like bouldering too much, so yubikey it is!