#392 Securing Fedora with FIDO2 (uTrust): Full-Disk (LUKS), GUI Login, and Sudo Authentication
Closed: published by rlengland. Opened by rlengland.

This guide provides a comprehensive walkthrough for integrating a FIDO2 security key (Identiv uTrust) with Fedora 42 to secure:
• LUKS2 full disk encryption (FDE)
• Graphical login (LightDM + Cinnamon)
• Sudo elevation

https://discussion.fedoraproject.org/t/securing-fedora-with-fido2-utrust-full-disk-luks-gui-login-and-sudo-authentication/154136


Metadata Update from @rlengland:
- Issue tagged with: article, needs-image

Metadata Update from @ihs-2025:
- Issue assigned to ihs-2025

Hi everyone, and thank you for the chance to share this. I’m still very new to Fedora and the community here, so I really appreciate your patience as I try to figure things out. I’m a cybersecurity student, and this write-up is less of a formal guide and more of a rough (and probably imperfect) recap of my own attempts to integrate an Identiv uTrust FIDO2 key for full disk encryption, GUI login, and sudo elevation — with the larger goal of eventually building a passwordless home cyber lab. I mainly put it together in case others hit the same confusing roadblocks I did. Please let me know how you'd like me to proceed from here — whether I should clean it up further, submit it here, or move it to WordPress. I'm grateful for any feedback and happy to help however I can.

@ihs-2025 Sorry Joe, but to be published as a Fedora Magazine article it has to be submitted via the Fedora WordPress instance Magazine - Dashboard (click on “Posts” in the left sidebar and then the “Add New Post” button at the top)
If it is not submitted there very few people will encounter it. In fact, in 6 months the topic in the Fedora Magazine Discussion group will disappear.

Please take the time to submit this via the Wordpress site.

@ihs-2025 Sorry Joe, but to be published as a Fedora Magazine article it has to be submitted via the Fedora WordPress instance Magazine - Dashboard (click on “Posts” in the left sidebar and then the “Add New Post” button at the top)
If it is not submitted there very few people will encounter it. In fact, in 6 months the topic in the Fedora Magazine Discussion group will disappear.

Please take the time to submit this via the Wordpress site.

@ihs-2025 Sorry Joe, but to be published as a Fedora Magazine article it has to be submitted via the Fedora WordPress instance Magazine - Dashboard (click on “Posts” in the left sidebar and then the “Add New Post” button at the top)
If it is not submitted there very few people will encounter it. In fact, in 6 months the topic in the Fedora Magazine Discussion group will disappear.

Please take the time to submit this via the Wordpress site.

Thank you, Richard. I appreciate the clarification.

I’ll do my best to get it submitted through the Fedora Magazine WordPress site this weekend.

V/r,
Joe Murphy

@ihs-2025 Hello, Joe. Have you had any luck with (or time to) see about getting your article into the Fedora Magazine WordPress instance?

If you have questions please contact us via this ticket. We are here to assist.

@ihs-2025 Hello, Joe. Have you had any luck with (or time to) see about getting your article into the Fedora Magazine WordPress instance?

If you have questions please contact us via this ticket. We are here to assist.

Hi Richard,

Thanks so much for checking in.

I’m still very interested in getting the article posted. I’m currently finishing up finals for my cybersecurity courses this week as the Spring Quarter wraps up, which has taken most of my focus. I truly apologize for the delay.

Once finals are complete, I plan to circle back and finish everything up for submission. I appreciate your patience, and I’ll be back on this very soon!

Best regards,

Joe Murphy

@ihs-2025 Joe, no apologies necessary for concentrating on your finals.
This is to be expected. Let us know if we can help and when you have it ready for a review in WordPress.

Thank you for the update.

BTW, knock 'em dead on your finals!

Moving this ticket back to the "Ideas" category until Joe finds time to resume writing and reviewing how current the outline is due to any changes that might have occurred in the Fedora environment.

I've moved this ticket to ready for review per Joe's notice:

https://discussion.fedoraproject.org/t/meeting-and-publication-schedule/34554/283

Metadata Update from @rlengland:
- Custom field preview-link adjusted to https://fedoramagazine.org/?p=42404&preview=true

Hi Joe ( @ihs-2025 )
I did a first review pass and changed some minor wording just for language flow. Also there were code blocks that were entered as “inline code” style. The magazine standard is to use the “keyboard input” style. So I’ve changed those.

There were places where it seemed obvious to me that there was some “compaction” of the code. I.e., there should have been line breaks at strategic places. This lead me to compare the article with the original, here and I found that there were a number of variations and missing connecting and explanatory text. I added some of that but I think it would be best if you were to review the article and edit/add text where appropriate. This will ensure that I’m not putting code/words in your mouth. :slight_smile: It’s important that we provide accurate info to the readers.

Please feel free to ask for assistance via comments on this ticket if you feel the need. We will be more than happy to assist.

Metadata Update from @rlengland:
- Custom field editor adjusted to rlengland

By the way, Joe ( @ihs-2025 ) I've added a possible featured image for this article. Let me know if it meets with your approval. If you have a preferable idea, let us know and we'll work on utilizing it instead.

Thanks

Metadata Update from @rlengland:
- Custom field image-editor adjusted to rlengland

Hello, Joe ( @ihs-2025 )
Have you had an opportunity to review/edit/correct anything in your article that needs it?
If you can find some time to do that we can do a final edit pass and get it published for you.
Thankyou.

Hi Richard,

I just wanted to follow up and say that I have some photos/screenshots I’d be happy to contribute to go along with the article (FDE unlock, login, sudo elevation, and screensaver fallback).

I also went through your last draft, made the edits I could for accuracy, and submitted it for review in WordPress. That said, I’m not entirely sure the email I sent with screenshots actually went through — it included attachments and some Outlook links that may have interfered.

If there’s a better way to provide the images (an email address or another method for submitting them), I’d really appreciate the guidance. I’m happy to get them over in whatever format works best for you.

Thanks again for all your help on this.

Best,
Joe

@ihs-2025 The images appear here in the ticket just fine, however, the editors have no clear idea where they should appear in the article. As I see it, there are two options.

Options 1:
Place them in the article yourself. This can be a two step or one step operation.
Two steps:
1) upload them to the Media section of the Fedora Magazine WordPress instance.
https://fedoramagazine.org/wp-admin/upload.php
2) place them in the article in the appropriate location.
Select a location for the image (left click in the article while in edit mode). You should see a popup menu that has a "Image" option. Select the appropriate image from the media library.

One step: From the "popup > image" option mention above it is possible to directly include the image with out the preliminary Media step. Select the "image" option in the popup and then select "upload".

Option 2:
If you prefer we can add the images if you indicate in the article where each of the images goes. Place some text in the article, preferably something very noticeable, that identifies the image that should be place at that location. We can assume that the images are ordered 1 through 9 as they appear here in this ticket. Indicate which number goes where.

Thanks so much! I’ll go with Option 2. I’ve reposted the photos here in the correct order — the first photo at the top is Image 1 and the last photo at the bottom is Image 8. Alongside each, I’ve added comments. If you look at the photos themselves, it should also be fairly straightforward to match them with the right point.

I’ve also listed them below in the order they should appear (from top to bottom, starting with number one and ending with number eight). If you could add them into the article at the appropriate places, that would be awesome. Thank you!

Final Ordered Image Sequence for the Article
1. Image 1 — LUKS unlock PIN
Boot screen asking for LUKS2 token PIN.
2. Image 2 — LUKS unlock key touch
FIDO2 key lit up, waiting for touch to complete full-disk unlock.
3. Image 3 — GUI login PIN
Fedora LightDM login screen prompting for FIDO2 key PIN.
4. Image 4 — GUI login key touch
Login process with FIDO2 key lit up, requiring touch to proceed.
5. Image 5 — GUI login completion
Login screen showing successful authentication, ready to “Log In.”
6. Image 6 — Sudo escalation (terminal)
Example of sudo test requiring PIN + touch in terminal.
7. Image 7 — Locked screen
Lock screen where the user may need to click the person icon to switch back to FIDO2 login.
8. Image 8 — Locked screen PIN entry
Re-login screen asking for FIDO2 key PIN to unlock session.
IMG_7882.jpegIMG_7883.jpegIMG_7884.jpegIMG_7885.jpegIMG_7889.jpegIMG_7890.jpegIMG_7891.jpeg

Thanks so much! I’ll go with Option 2. I’ve reposted the photos here in the correct order — the first photo at the top is Image 1 and the last photo at the bottom is Image 8. Alongside each, I’ve added comments. If you look at the photos themselves, it should also be fairly straightforward to match them with the right point.

I’ve also listed them below in the order they should appear (from top to bottom, starting with number one and ending with number eight). If you could add them into the article at the appropriate places, that would be awesome. Thank you!

Final Ordered Image Sequence for the Article
1. Image 1 — LUKS unlock PIN
Boot screen asking for LUKS2 token PIN.
2. Image 2 — LUKS unlock key touch
FIDO2 key lit up, waiting for touch to complete full-disk unlock.
3. Image 3 — GUI login PIN
Fedora LightDM login screen prompting for FIDO2 key PIN.
4. Image 4 — GUI login key touch
Login process with FIDO2 key lit up, requiring touch to proceed.
5. Image 5 — GUI login completion
Login screen showing successful authentication, ready to “Log In.”
6. Image 6 — Sudo escalation (terminal)
Example of sudo test requiring PIN + touch in terminal.
7. Image 7 — Locked screen
Lock screen where the user may need to click the person icon to switch back to FIDO2 login.
8. Image 8 — Locked screen PIN entry
Re-login screen asking for FIDO2 key PIN to unlock session.
IMG_7882.jpegIMG_7883.jpegIMG_7884.jpegIMG_7885.jpegIMG_7886.jpegIMG_7889.jpegIMG_7890.jpegIMG_7891.jpeg

@ihs-2025 Sorry, Joe, but I'm a bit confused about the placement of the images. It appears that these are to be included in the "Phase 6: Testing" section. Correct?

I see only 7 locations that might have images:
After 1. "Reboot..."
After 2. "Confirm:" where there are 5 sub-bullets
After 3. "Confirm the fallback..."

Also, Inserting images in a list is fraught with all kinds of nit-picky issues. I can probably rework the text around the list but I'm unclear on how to proceed with the 8 images that you have provided.

I just had a thought, Is it possible that you did an edit and something was not saved?

BTW, keep in mind that I've never worked with LUKS or a FIDO device so keeping it at the 2nd grade level would probably help.

Sorry this is being painful but we'll get this finished. Thanks for your patience.

Thanks for flagging this! You’re correct — these images are meant for the “Phase 6: Testing” section, placed at the points you outlined. Sorry for the earlier confusion — I went back through everything and confirmed the sequence.

I’ve re-labeled the photos (#1 through #8) and here’s the exact order with short captions to guide placement:
1. Image 1 — LUKS unlock PIN
Boot screen asking for LUKS2 token PIN.
2. Image 2 — LUKS unlock key touch
FIDO2 key lit up, waiting for touch to complete full-disk unlock.
3. Image 3 — GUI login PIN
Fedora LightDM login screen prompting for FIDO2 key PIN.
4. Image 4 — GUI login key touch
Login process with FIDO2 key lit up, requiring touch to proceed.
5. Image 5 — GUI login completion
Login screen showing successful authentication, ready to “Log In.”
6. Image 6 — Sudo escalation (terminal)
Example of sudo test requiring PIN + touch in terminal.
7. Image 7 — Locked screen
Lock screen where the user may need to click the person icon to switch back to FIDO2 login.
8. Image 8 — Locked screen PIN entry
Re-login screen asking for FIDO2 key PIN to unlock session.

The idea is to show the full sequence: disk unlock → login → sudo escalation → lock/unlock.

I mainly included these screenshots to demonstrate that I actually ran through the process, and also so readers can see what each stage looks like in practice.

Thanks again for your patience and for helping polish this section — I really appreciate it!

For some reason , in some post, it only uploaded seven of the eight photos.
My apologies for all the various posts. I’m trying to do most of this from Cell Phone still waiting on moving into my new house and everything is still in storage.

Here are the same photos labeled:

IMG_7882.jpegIMG_7883.jpegIMG_7884.jpegIMG_7885.jpegIMG_7886.jpegIMG_7889.jpegIMG_7890.jpegIMG_7891.jpegHere are the photos that are labeled now

@ihs-2025 I've included the images you provided. Rather than try to make them work in the outline form, I've added them in three subsections
- Reboot the system
- Confirm functionality
- Confirm the fallback....
and I've used your descriptive text as the captions. I think that makes it clear how the images flow.

Please take a moment or two to review "one more time" and make any corrections, additions or suggestions and let me know when you feel it is ready for another review by the editors or for publication.

Thank you.

@ihs-2025 I've included the images you provided. Rather than try to make them work in the outline form, I've added them in three subsections
- Reboot the system
- Confirm functionality
- Confirm the fallback....
and I've used your descriptive text as the captions. I think that makes it clear how the images flow.

Please take a moment or two to review "one more time" and make any corrections, additions or suggestions and let me know when you feel it is ready for another review by the editors or for publication.

Thank you.

@ihs-2025 I've included the images you provided. Rather than try to make them work in the outline form, I've added them in three subsections
- Reboot the system
- Confirm functionality
- Confirm the fallback....
and I've used your descriptive text as the captions. I think that makes it clear how the images flow.

Please take a moment or two to review "one more time" and make any corrections, additions or suggestions and let me know when you feel it is ready for another review by the editors or for publication.

Thank you.

Thanks for all the time and effort you’ve put into going back-and-forth on this. The integration of the images looks good, and I think it’s clear and ready to go. No further changes from me — I’m happy to move this forward for publication. My apologies for the delays in getting back to you. R. Joe

@ihs-2025 Thank you for the confirmation, Joe. I'll give it one more read-through to check for random typos, etc. then we'll get it schedule.
Taking time to get it right is time well spent. Thank you for your perseverance.

@ihs-2025 Thank you for the confirmation, Joe. I'll give it one more read-through to check for random typos, etc. then we'll get it schedule.
Taking time to get it right is time well spent. Thank you for your perseverance.

Thanks much, Richard! I really appreciate the careful review. I’m looking forward to seeing it published. Will I get a notice when it goes live, or should I just keep an eye out for it?

I will update the publish date (right column on this page) and send you a message about it.

Metadata Update from @rlengland:
- Issue untagged with: needs-image

Joe, this article is scheduled for 19 Sept at 0800 UTC. That's tomorrow.

Note that if you or someone else finds a typo or issue, only the editors will be able to make changes.

We monitor the comments (as you should as well) and try to take care of what we can but technical issues will probably need to be addressed by you. Let us know about any changes and we'll take care of the editing.

I don't foresee issues but I thought I should let you know.

Thank you again.

Metadata Update from @rlengland:
- Custom field publish adjusted to 2025-09-19

Thanks, Richard, I’ll keep an eye out for any comments or issues. I’m starting my last quarter for my AAS in Cybersecurity and then moving on to my BAS, so I really appreciate the opportunity to contribute. Looking forward to working on another project in the future!

Issue status updated to: Closed (was: Open)
Issue close_status updated to: published

Metadata