Issues loging in with PAM authentication

I followed the process with my Nitrokey Pro 2 to be able to log into my account using the USB. I was able to successfully add the public key into the poldi local db, and I modified the pam.d files (common-auth, login, and sudo).

Before I restarted my computer to see if it worked, I tried to see if the Nitrokey would work for using sudo in the terminal.

The result was that I was still required to input my user password, which I guess I could live with as this would serve as a 2FA of sorts, but when I put in my password I was then prompted to unlock the Nitrokey with the PIN. I believe it was a similar situation as another user on here but that never got resolved. Imputing the PIN never showed to authenticate, but even when I didn’t type anything or typed the wrong PIN, it would still grant me sudo privileges because I typed in the password.

I then tried to start up the Nitrokey application (on Linux, Pop_os) to see if the password vault needed to be unlocked before it would serve as an authentication, but not only did it not remove the password prompt followed by the PIN prompt, it repeatedly disconnected the Nitrokey!

I’m not smart enough to figure out a) why it was still requiring a password and b) why having the vault unlocked/app open caused the Nitrokey to continuously disconnect.

The unmodified pam.d files I tried editing:


# /etc/pam.d/common-auth - authentication settings common to all services
# This file is included from other service-specific PAM config files,
# and should contain a list of the authentication modules that define
# the central authentication scheme for use on the system
# (e.g., /etc/shadow, LDAP, Kerberos, etc.).  The default is to use the
# traditional Unix authentication mechanisms.
# As of pam 1.0.1-6, this file is managed by pam-auth-update by default.
# To take advantage of this, it is recommended that you configure any
# local modules either before or after the default block, and use
# pam-auth-update to manage selection of other modules.  See
# pam-auth-update(8) for details.

# here are the per-package modules (the "Primary" block)
auth	[success=1 default=ignore] nullok_secure
# here's the fallback if no module succeeds
auth	requisite
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
auth	required
# and here are more per-package modules (the "Additional" block)
auth	optional unwrap
auth	optional 
# end of pam-auth-update config


# The PAM configuration file for the Shadow `login' service

# Enforce a minimal delay in case of failure (in microseconds).
# (Replaces the `FAIL_DELAY' setting from login.defs)
# Note that other modules may require another minimal delay. (for example,
# to disable any delay, you should add the nodelay option to pam_unix)
auth       optional  delay=3000000

# Outputs an issue file prior to each login prompt (Replaces the
# ISSUE_FILE option from login.defs). Uncomment for use
# auth       required issue=/etc/issue

# Disallows other than root logins when /etc/nologin exists
# (Replaces the `NOLOGINS_FILE' option from login.defs)
auth       requisite

# SELinux needs to be the first session rule. This ensures that any
# lingering context has been cleared. Without this it is possible
# that a module could execute code in the wrong domain.
# When the module is present, "required" would be sufficient (When SELinux
# is disabled, this returns success.)
session [success=ok ignore=ignore module_unknown=ignore default=bad] close

# Sets the loginuid process attribute
session    required

# Prints the message of the day upon successful login.
# (Replaces the `MOTD_FILE' option in login.defs)
# This includes a dynamically generated part from /run/motd.dynamic
# and a static (admin-editable) part from /etc/motd.
session    optional motd=/run/motd.dynamic
session    optional noupdate

# SELinux needs to intervene at login time to ensure that the process
# starts in the proper default security context. Only sessions which are
# intended to run in the user's context should be run after this.
# changes the SELinux context of the used TTY and configures
# SELinux in order to transition to the user context with the next execve()
# call.
session [success=ok ignore=ignore module_unknown=ignore default=bad] open
# When the module is present, "required" would be sufficient (When SELinux
# is disabled, this returns success.)

# This module parses environment configuration file(s)
# and also allows you to use an extended config
# file /etc/security/pam_env.conf.
# parsing /etc/environment needs "readenv=1"
session       required readenv=1
# locale variables are also kept into /etc/default/locale in etch
# reading this file *in addition to /etc/environment* does not hurt
session       required readenv=1 envfile=/etc/default/locale

# Standard Un*x authentication.
@include common-auth

# This allows certain extra groups to be granted to a user
# based on things like time of day, tty, service, and user.
# Please edit /etc/security/group.conf to fit your needs
# (Replaces the `CONSOLE_GROUPS' option in login.defs)
auth       optional

# Uncomment and edit /etc/security/time.conf if you need to set
# time restraint on logins.
# (Replaces the `PORTTIME_CHECKS_ENAB' option from login.defs
# as well as /etc/porttime)
# account    requisite

# Uncomment and edit /etc/security/access.conf if you need to
# set access limits.
# (Replaces /etc/login.access file)
# account  required

# Sets up user limits according to /etc/security/limits.conf
# (Replaces the use of /etc/limits in old login)
session    required

# Prints the last login info upon successful login
# (Replaces the `LASTLOG_ENAB' option from login.defs)
session    optional

# Prints the status of the user's mailbox upon successful login
# (Replaces the `MAIL_CHECK_ENAB' option from login.defs). 
# This also defines the MAIL environment variable
# However, userdel also needs MAIL_DIR and MAIL_FILE variables
# in /etc/login.defs to make sure that removing a user 
# also removes the user's mail spool file.
# See comments in /etc/login.defs
session    optional standard

# Create a new session keyring.
session    optional force revoke

# Standard Un*x account and session
@include common-account
@include common-session
@include common-password



session    required readenv=1 user_readenv=0
session    required readenv=1 envfile=/etc/default/locale user_readenv=0
@include common-auth
@include common-account
@include common-session-noninteractive

For each file, I simply added auth sufficient at the very end and made no other changes.

Now as I’m sure you can guess, with this not working for sudo as I was expecting I’m not about to try to log out just to find out I can’t log back in haha. Any information would be greatly appreciated!