Using U2F keys with Fedora

G Fernandes

2026-08-27

U2F setup with a backup key

Follow this link for general setup.

Whilst the link advises setting up a backup key - which is generally good practice and strongly recommended - it does not really tell you how to do it.

You should add a backup key using the following command:

    pamu2fcfg --username=$(whoami) >> .config/Yubico/u2f_keys

This will add a new line to your u2f configuration. Now edit this file.

You will see two lines of the form:

userid:<RANDOM_GENERATED_KEY>,<TYPE>,<REQUIREMENTS>
userid:<RANDOM_GENERATED_KEY>,<TYPE>,<REQUIREMENTS>

…where:

  1. userid is your user-id.
  2. The random key is the key that is configured as your 2nd factor when you touch the device.
  3. The type of key - usually es256.
  4. The requirements for your multi-factor authentication: for me, I use +presence only - the default. You can set it to require presence and PIN[*].

Now, delete the user-id from the second line so that your file looks like this:

userid:<RANDOM_GENERATED_KEY>,<TYPE>,<REQUIREMENTS>:<RANDOME_GENERATED_KEY2>,<TYPE>,<REQUIREMENTS>

Note

  1. Each user must have all keys on the same line - only one line per user is allowed. If you end up with more than one line for the same user, the last line will be used - so you’re effectively with no backup key!
  2. The separator for each user key is “:”.

Now you have a backup key setup and ready to use.