I'm running i3 window manager and have 2-factor authentication on my system. It appears that i3 and i3lock do NOT support the additional prompt for 2-factor authentication, but merely pipes the password I entered in as the verification code.

That obviously doesn't work, short of modifying my pam configuration and disabling 2-factor authentication (for i3lock), is there a better way that will let me leverage 2-factor authentication for i3lock as well?

Because i3lock supports PAM, it necessarily supports u2f modules too, though it may not support visual prompts for user input. It certainly works with Yubikey u2f, which merely requires the user to press a physical key on the USB after being prompted by the USB flashing.

Setup Yubikey U2F for i3lock

1. Build your pam module (e.g. pam_u2f.so) and place it in the right spot (e.g. /lib/security). If you have a yubikey then follow Yubico's guide.


2. Create /etc/pam.d/i3lock if it does not already exist. Here is the default file, which simply requires a password.

#

# PAM configuration file for the i3lock screen locker. By default, it includes

# the 'login' configuration file (see /etc/pam.d/login)

#



auth    include     login

You now have the following options for authenticating with your Yubikey, though the first one (password fallback) is only single factor authentication.

Option 1: Yubikey with password fallback

Add the following line before the auth include login line.

auth    sufficient      pam_u2f.so nouserok cue

This will unlock your computer if you hit enter, which triggers PAM authentication in i3lock (prompt will hang on "verifying") and then press the Yubikey, which should be flashing.

You can also unlock your computer simply by typing the correct password while the yubikey is not plugged in. If it is plugged in, the module will wait for the yubikey to fail, which will requires you to unplug it, or wait for it to timeout (the boring way to gain access to your computer!).

Option 2: Require Yubikey and password

Add the following line after the auth include login line.

auth    required      pam_u2f.so nouserok cue

This will unlock your computer if you enter the correct password, hit enter, and then press the Yubikey (it should be flashing) to provide the required second factor.

Debugging

If you get locked out, login on a virtual terminal (TTY). You can get to one with the ctrl+alt+f2 key combination. You can then kill i3lock with killall i3lock or find more information about what went wrong by looking through the output of journalctl -x.