FIDO2 Security Key Auth

This setup uses a FIDO2 security key through pam-u2f. The key becomes the preferred local authentication path for sudo, polkit prompts, and Hyprlock, while the account password stays available as fallback.

The daily path is touch-only. Do not add pinverification=1 unless you want the security-key PIN on every sudo, pkexec, and Hyprlock authentication.

It does not change LUKS disk decryption. Boot still uses the LUKS passphrase unless a separate LUKS token setup is configured.

Keep a fallback

Keep an unlocked terminal open while editing PAM files. Do not remove the password fallback unless you have a separate recovery path.

Start with the Omarchy menu

Use Omarchy’s built-in FIDO2 setup first:

1. Open the Omarchy menu.
2. Go to Setup.
3. Go to Security.
4. Choose Fido2.
5. Touch the security key when prompted.
6. Let the script test sudo before closing the terminal.

The setup installs libfido2 and pam-u2f, registers the key with pamu2fcfg, stores the mapping at /etc/fido2/fido2, and adds pam_u2f.so to sudo and polkit-1.

The default Omarchy setup is touch-based. Keep that behaviour for daily use, then add Hyprlock manually.

Confirm sudo and polkit

Use this touch-only line in /etc/pam.d/sudo and /etc/pam.d/polkit-1:

auth sufficient pam_u2f.so cue [cue_prompt=Touch your security key] authfile=/etc/fido2/fido2

Keep the existing password lines below it. With sufficient, a successful security-key auth skips the password prompt; failure falls through to the password fallback.

Add Hyprlock

The Omarchy shell lock screen uses its own PAM service. Omarchy’s FIDO2 setup does not add this line automatically, so prepend it to /etc/pam.d/omarchy-lock-password:

auth sufficient pam_u2f.so cue [cue_prompt=Touch your security key] authfile=/etc/fido2/fido2

Leave the default password stack below it so normal password unlock still works. The packaged lock-screen prompt is owned by Omarchy 4 and is not configured through a stowed hyprlock.conf.

Remove fingerprint leftovers

If Omarchy’s fingerprint setup was run by mistake, remove its PAM lines and packages:

pkexec sed -i '/pam_fprintd\.so/d' /etc/pam.d/sudo /etc/pam.d/polkit-1
pkexec pacman -Rns fprintd libfprint-git

The Omarchy shell detects fingerprint support through its separate omarchy-lock-fingerprint PAM service.

PIN mode

pinverification=1 is stricter, but pam-u2f prompts for the security-key PIN on every PAM authentication. It does not cache the PIN for the whole login session.

Use PIN mode only if that tradeoff is intentional:

auth sufficient pam_u2f.so cue [cue_prompt=Touch your security key] pinverification=1 authfile=/etc/fido2/fido2

Test order

Test each layer before relying on it:

1. Run sudo -k, then sudo true.
2. Touch the security key when prompted.
3. Trigger a polkit prompt if convenient.
4. Lock the screen with the Omarchy shell while another session or terminal remains available.
5. Test password fallback by trying without the security key.

Rollback

Restore the backed-up PAM files, or remove only the added pam_u2f.so line from /etc/pam.d/omarchy-lock-password if the lock screen is the only broken part.

Do not delete /etc/fido2/fido2 unless you are fully removing FIDO2 auth.