Why?

Because I think it's cool and I don't want to type in my long password when I am at home and frequently leave my desk.

Requirements

• A Yubikey with support for U2F
• openSUSE Tumbleweed (it's what I use, commands and package names may differ)
• KDE (or anything else that uses PAM)

How To

These commands worked on my system, they may not work on your's, so be careful. If you don't know much about your system, then be warned that you may lock yourself out when configuring PAM incorrectly! (but that should only affect KDE for this guide, and you can always login via TTY and delete the config)

Installing packages

Usually you only need to install the pam_u2f/pam-u2f/libpam-u2f (depending on your distro) package. For openSUSE, you can do this as follows:

$ sudo zypper in pam_u2f

Enrolling a signature

You first need to teach your system what your Yubikey looks like. To do this, simply create the appropriate config directory and then enroll your Yubikey:

$ mkdir -p ~/.config/Yubico
$ pamu2fcfg > ~/.config/Yubico/u2f_keys

Configure PAM

Typically, there is no /etc/pam.d/kde file, likely because KDE inherits everything it needs. Well, not in our use-case, so don't be scraed that this will create a new file.

$ sudo edit /etc/pam.d/kde

Now just add these two lines, which will allow unlocking with your yubikey, as well as preserve password auth as a fallback:

auth sufficient pam_u2f.so nouserok cue
auth include common-auth

The common-auth part can differ based on your distro. Be sure to check what your distro uses in case you are not using openSUSE Tumbleweed (or things have changed since 2026).

Done! You can now unlock your session with your Yubikey. It should work instantaneous. This does however not cover sddm or whatever display manager you use to log-in to your system.

You can of course configure your Yubikey system-wide or for other applications aswell, but I'll only focus on KDE in this write-up.