FIDO2 Smartcard
On Linux

I recently purchased a Cryptnox FIDO2 NFC smartcard from Amazon because it was on sale, and because I really wanted to play with a FIDO2 token in smartcard form factor. For my desktop I also bought an ACR1252U USB NFC Reader III.  FIDO2 tokens provide hardware support for passkeys, but support for both FIDO2 and passkeys is still a bit of a mess, particularly on Linux.

I use Fedora 42, and it provides the pam-u2f package for local authentication with FIDO2 cards.  Unfortunately, pam-u2f only supports USB tokens (such as yubikey) and does not see the Cryptnox card on the NFC reader.  This is an understood issue that is solved with the fido2-hid-bridge package, which provides a daemon service that looks for fido2 tokens on NFC and proxies them to a virtual token on USB HID, where pam-u2f can find them. Note that fido2-hid-bridge is not in Fedora's repo, so you have to get it from github and install it manually.

Configuring pam-u2f to use the Cryptnox token is simple. First you enroll the token with the pamu2fcfg command:

     pamu2fcfg --pin-verification > ~/.config/Yubikey/u2f_keys    (Note that pam-u2f defaults to the "Yubikey" config directory...)

Then you configure how to use the token with authselect. You can use the token directly for authentication with:

     authselect select local with-pam-u2f

or configure the token for two factor (token plus password)

     authselect select local with-pam-u2f-2fa

After using the 2fa configuration for a while, I decided to us 2fa only for sudo, not for my normal user login. This is a pretty nice configuration - in normal use I leave the Cryptnox card off of the reader, so that no one can get root authority. But when I need to use sudo, its easy enough to put the card on the reader. To configure u2f only for sudo edit /etc/authselect/password-auth and delete the line with "auth required pam_u2f.so".

This setup also works fine for passkeys for most websites, including google. Note that google requires tokens to have a pin, which you can set with fido2-token. Fortunately, pam-u2f supports prompting for the pin if needed.