Yubikey #127

onyxcherry · 2021-11-30T13:41:03Z

onyxcherry
Nov 30, 2021

Hello,
how do you use the Yubikey basic functionality in e.g. Ubuntu-20.04, especially with what (USB) drivers to get it working?

Currently (sudo lsusb -v inside WSL of course):

Bus 001 Device 002: ID 1050:0120 Yubico.com Yubikey Touch U2F Security Key
Device Descriptor:
  bLength                18
  bDescriptorType         1
  bcdUSB               2.00
  bDeviceClass            0
  bDeviceSubClass         0
  bDeviceProtocol         0
  bMaxPacketSize0        64
  idVendor           0x1050 Yubico.com
  idProduct          0x0120 Yubikey Touch U2F Security Key
  bcdDevice            5.26
  iManufacturer           1 Yubico
  iProduct                2 Security Key by Yubico
  iSerial                 0
  bNumConfigurations      1
  Configuration Descriptor:
    bLength                 9
    bDescriptorType         2
    wTotalLength       0x0029
    bNumInterfaces          1
    bConfigurationValue     1
    iConfiguration          0
    bmAttributes         0x80
      (Bus Powered)
    MaxPower               30mA
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        0
      bAlternateSetting       0
      bNumEndpoints           2
      bInterfaceClass         3 Human Interface Device
      bInterfaceSubClass      0
      bInterfaceProtocol      0
      iInterface              0
        HID Device Descriptor:
          bLength                 9
          bDescriptorType        33
          bcdHID               1.10
          bCountryCode            0 Not supported
          bNumDescriptors         1
          bDescriptorType        34 Report
          wDescriptorLength      34
         Report Descriptors:
           ** UNAVAILABLE **
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x04  EP 4 OUT
        bmAttributes            3
          Transfer Type            Interrupt
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0040  1x 64 bytes
        bInterval               2
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x84  EP 4 IN
        bmAttributes            3
          Transfer Type            Interrupt
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0040  1x 64 bytes
        bInterval               2
can't get device qualifier: Resource temporarily unavailable
can't get debug descriptor: Resource temporarily unavailable
Device Status:     0x0000
  (Bus Powered)

and no output from CtapHidDevice.list_devices() (python-fido2 as root).

cat /etc/udev/rules.d/90-fido2-own.rules:

#Udev rule for allowing HID access to Yubico devices for FIDO support.

KERNEL=="hidraw*", SUBSYSTEM=="hidraw", \
  MODE="0664", GROUP="plugdev", ATTRS{idVendor}=="1050"

Reloading udev with sudo udevadm trigger or even restarting the Windows (host) computer doesn't result in working :(

Answered by dorssel

Nov 30, 2021

For the HID interface, see #90.
For the other interface (smartcard, etc.) you will need to compile a kernel with the correct drivers, I think.

View full answer

dorssel · 2021-11-30T14:48:40Z

dorssel
Nov 30, 2021
Maintainer

For the HID interface, see #90.
For the other interface (smartcard, etc.) you will need to compile a kernel with the correct drivers, I think.

2 replies

onyxcherry Nov 30, 2021
Author

So no one of FIDO2 features (e.g. generating ssh key with RK option) or simply - basic - WebAuthn or U2F could work?

What are the modules needed to compile into a new kernel?
It is a lack of drivers, isn't it?

That's obviously an open question, future finding are welcome 😄

dorssel Nov 30, 2021
Maintainer

I just did a gpg --card-status for my Yubikey 5 on a regular Linux Hyper-V VM.
It loaded usbhid and input_leds.

mcdonaldseanp · 2021-12-15T21:07:02Z

mcdonaldseanp
Dec 15, 2021

I ran in to this problem or at least to me it looked like a similar set of symptoms: can connect yubikey from the windows side to WSL with usbipd, see it with lsusb but wasn't able to use it with gpg. I'm not sure about any other functionality like WebAuthn but I was at least able to get yubikey working together with gpg (including using gpg-agent instead of ssh-agent to access hosts with keys unlocked with my Yubikey).

For me it turned out the issue was that the pcscd service wasn't running. I was able to get things functional with my yubikey including running things with gpg by starting that service: sudo service pcscd start. If I remove the key from my workstation and need to use it again I have to restart pcscd every time (this is probably just my own lack of knowledge with pcscd though), but it takes so little time to restart it doesn't bother me.

9 replies

onyxcherry Dec 20, 2021
Author

Nothing 🙄

dorssel Dec 20, 2021
Maintainer

EDIT: strike that previous post ... that was not the YubiKey...

dorssel Dec 20, 2021
Maintainer

What does the usbhid driver node say? Mine says:

/sys/bus/usb/drivers/usbhid$ ls -la
total 0
drwxr-xr-x 2 root root    0 Dec 20 16:52 .
drwxr-xr-x 6 root root    0 Dec 20 09:44 ..
lrwxrwxrwx 1 root root    0 Dec 20 17:37 1-1:1.0 -> ../../../../devices/platform/vhci_hcd.0/usb1/1-1/1-1:1.0
lrwxrwxrwx 1 root root    0 Dec 20 17:37 1-1:1.1 -> ../../../../devices/platform/vhci_hcd.0/usb1/1-1/1-1:1.1
--w------- 1 root root 4096 Dec 20 17:27 bind
lrwxrwxrwx 1 root root    0 Dec 20 17:27 module -> ../../../../module/usbhid
-rw-r--r-- 1 root root 4096 Dec 20 17:27 new_id
-rw-r--r-- 1 root root 4096 Dec 20 17:27 remove_id
--w------- 1 root root 4096 Dec 20 16:52 uevent
--w------- 1 root root 4096 Dec 20 17:27 unbind
/sys/bus/usb/drivers/usbhid$

onyxcherry Dec 20, 2021
Author

tomasz@wsl:/sys/bus/usb/drivers/usbhid$ ls -la
total 0
drwxr-xr-x 2 root root    0 Dec 20 17:40 .
drwxr-xr-x 8 root root    0 Dec 20 17:40 ..
lrwxrwxrwx 1 root root    0 Dec 20 17:40 1-1:1.0 -> ../../../../devices/platform/vhci_hcd.0/usb1/1-1/1-1:1.0
--w------- 1 root root 4096 Dec 20 17:40 bind
lrwxrwxrwx 1 root root    0 Dec 20 17:40 module -> ../../../../module/usbhid
-rw-r--r-- 1 root root 4096 Dec 20 17:40 new_id
-rw-r--r-- 1 root root 4096 Dec 20 17:40 remove_id
--w------- 1 root root 4096 Dec 20 17:40 uevent
--w------- 1 root root 4096 Dec 20 17:40 unbind

nwayve Mar 20, 2023

I ran into this issue recently. After attaching the yubikey usb to wsl via uspipd wsl attach --busid {id}, the device would show up in wsl in lsusb but not in ykman list. The command sudo service pcscd start fixed it initially, but after restarting Windows and getting back into the wsl shell, the issue happened again but the service start command didn't work this time. I had to restart the service with sudo service pcscd restart in order for it to work again.

damex · 2022-03-31T15:40:52Z

damex
Mar 31, 2022

I hit the same problem with Debian 11 trying to use same Yubikey for OTP. usbip passthrough successfully and PIV works fine. attempting to check otp by 'ykman otp info' results in saying that otp interface is not found and touching Yubikey generate no otp. not sure if there is a workaround for that.

11 replies

Seldaek Jul 12, 2022

@davidshen84 do you have any instructions how you got it to work with SSH?

I got as far as what @dorssel wrote above, sudo cat /dev/console works when I tap the key (YubiKey 5 Nano), ykman info sees the key, but ykman otp info gives Error: No YubiKey found with the given interface(s).

davidshen84 Jul 12, 2022

ykman doesn't work because of WSL kernel config. To use the key in WSL for SSH connection, please check out this guide. You can ignore the gpg part in it.

onyxcherry Jul 16, 2022
Author

Or you can build the kernel [https://github.com/dorssel/usbipd-win/wiki/WSL-support#building-your-own-usbip-enabled-wsl-2-kernel] on your own and have FIDO2 working :D

Seldaek Jul 16, 2022

@onyxcherry is it correct that you still have to mount the USB from windows and then cannot use it anymore from windows? Because if that's the case I guess I rather skip this whole endeavor.

onyxcherry Jul 16, 2022
Author

You are entirely right about that process

ghost · 2022-09-30T16:12:43Z

dorssel Nov 25, 2022
Maintainer

Some functions (e.g. gpg) now work out-of-the-box. The latest default WSL kernel has

#
# HID support
#
CONFIG_HID=y
# CONFIG_HID_BATTERY_STRENGTH is not set
# CONFIG_HIDRAW is not set
# CONFIG_UHID is not set
CONFIG_HID_GENERIC=y

and

#
# USB HID support
#
CONFIG_USB_HID=y
# CONFIG_HID_PID is not set
# CONFIG_USB_HIDDEV is not set
# end of USB HID support

I believe FIDO and some other functions also require CONFIG_HIDRAW and/or CONFIG_USB_HIDDEV. Not sure though...

returntrip Nov 25, 2022

@dorssel confirmed gpg works OOB whilst FIDO needs extra kernel flags

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Yubikey #127

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Replies: 4 comments 28 replies

{{title}}

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

Select a reply

Yubikey #127

Replies: 4 comments · 28 replies

dorssel Nov 30, 2021 Maintainer

onyxcherry Nov 30, 2021 Author

dorssel Nov 30, 2021 Maintainer

onyxcherry Dec 20, 2021 Author

dorssel Dec 20, 2021 Maintainer

dorssel Dec 20, 2021 Maintainer

onyxcherry Dec 20, 2021 Author

onyxcherry Jul 16, 2022 Author

onyxcherry Jul 16, 2022 Author

dorssel Nov 25, 2022 Maintainer

Replies: 4 comments 28 replies

dorssel
Nov 30, 2021
Maintainer

onyxcherry Nov 30, 2021
Author

dorssel Nov 30, 2021
Maintainer

onyxcherry Dec 20, 2021
Author

dorssel Dec 20, 2021
Maintainer

dorssel Dec 20, 2021
Maintainer

onyxcherry Dec 20, 2021
Author

onyxcherry Jul 16, 2022
Author

onyxcherry Jul 16, 2022
Author

dorssel Nov 25, 2022
Maintainer