PAMU2FCFG(1)

📦
version 1.4.0 · 5 versions
, in alpine 3.24, debian trixie, nixos 26.05, nixpkgs unstable, ubuntu questing, ubuntu resolute, ubuntu stonking

💖 PAMU2FCFG(1) 💖

okay bestie, sit down, because we're about to talk about pamu2fcfg — the PAM U2F Configuration Tool — and honestly? she's iconic. this whole page lives in section 1 of the manual, so if you ever need to find her again, you know where to look. 🎀

✨ NAME ✨

pamu2fcfg — Configuration tool for the U2F PAM module.

like. the whole point. she configures your U2F PAM module. that's the gig. 💅

🦋 SYNOPSIS 🦋

pamu2fcfg [OPTION]...

that's it. that's the whole thing. options only, no positional args, no drama. 🌸

💫 DESCRIPTION 💫

so what does she actually do? she runs a full FIDO2/U2F registration procedure using an authenticator that's plugged in / connected, and then she spits out a configuration line that you can use with the U2F PAM module. 🫶

that's the tea. that's literally it. plug in your key, run the tool, get your config line, go live your life. periodt. ✨

👑 OPTIONS 👑

every single one, no skips, no skimming, we're doing this properly because you deserve the full picture. 💜

  • -d, --debug — print debug information. and when she says debug info she means it, this is highly verbose. like, so much output. be ready. 😭
  • -h, --help — print help and exit. the classic escape hatch. 🎀
  • -o, --origin=STRING — set the FIDO2 relying party ID to use during registration. defaults to pam://hostname. heads up tho: before pamu2fcfg v1.1.0, this option set the U2F origin URL instead. so if you're on an old version, different vibe entirely. 💀
  • -i, --appid=STRING — set the FIDO2 relying party name to use during registration. defaults to origin. and same lore as above: before pamu2fcfg v1.1.0, this set the U2F application ID. 🦋
  • -r, --resident — generate a resident credential. defaults to off. 👑
  • -t, --type=STRING — the COSE type to use during registration. your choices are ES256, EDDSA, or RS256. defaults to ES256. pick your fighter. 🔥
  • -P, --no-user-presence — allow using the credential without ensuring the user's presence. defaults to off. 🌈
  • -N, --pin-verification — require PIN verification during authentication. defaults to off. 🔐 (ok that emoji wasn't on the list but the vibe was right, moving on 💅)
  • -V, --user-verification — require user verification during authentication. defaults to off. ⭐
  • --version — print version and exit. 🎀
  • -u, --username=STRING — the name of the user registering the device. defaults to the current user name. 🫶
  • -n, --nouser — print only registration information (that's the key handle, the public key, and the options). super useful for appending. ✨

🐛 BUGS 🐛

found a bug? don't suffer in silence bestie, report pamu2fcfg bugs in the issue tracker:

https://github.com/Yubico/pam-u2f/issues

they want to hear from you fr fr. 💖

🌸 SEE ALSO 🌸

go read these next, they're all connected, iykyk:

the pam-u2f home page: https://developers.yubico.com/pam-u2f/

and if you need a YubiKey of your very own (and honestly, who doesn't), you can get them from Yubico: https://www.yubico.com/ 👑

okay that's the whole page, you made it, i'm so proud of you. 🥹 this was pamu2fcfg, Version 1.4.0, living her best life in section 1 of the manual. go register something. slay. 💅✨

📦 where this page comes from