We have a machine that uses a YubiKey to decrypt its hard drive on boot. Following the decryption, we would sometimes leave the YubiKey plugged into the machine. After upgrading from Ubuntu 20.04LTS to Ubuntu 22.04LTS, we noticed that the login screen of Ubuntu would not let us log in with the usual username and password. Still, it forced us to use the smartcard, which was never configured. To perform the login, we had to remove the YubiKey from the machine first. The following post uses a solution from the bug page below to mitigate this issue.
https://bugs.launchpad.net/ubuntu/+source/gdm3/+bug/1933027
First, we used the following command to verify the available options:
sudo update-alternatives --config gdm-smartcard;
The results it produced were the following:
$ sudo update-alternatives --config gdm-smartcard There are 3 choices for the alternative gdm-smartcard (providing /etc/pam.d/gdm-smartcard). Selection Path Priority Status ------------------------------------------------------------ * 0 /etc/pam.d/gdm-smartcard-sssd-exclusive 50 auto mode 1 /etc/pam.d/gdm-smartcard-pkcs11-exclusive 30 manual mode 2 /etc/pam.d/gdm-smartcard-sssd-exclusive 50 manual mode 3 /etc/pam.d/gdm-smartcard-sssd-or-password 40 manual mode
As recommended by the comments in the bug report, we edited the file /var/lib/dpkg/alternatives/gdm-smartcard to add a new option and from this:
$ cat /var/lib/dpkg/alternatives/gdm-smartcard auto /etc/pam.d/gdm-smartcard /etc/pam.d/gdm-smartcard-pkcs11-exclusive 30 /etc/pam.d/gdm-smartcard-sssd-exclusive 50 /etc/pam.d/gdm-smartcard-sssd-or-password 40 /etc/pam.d/gdm-password 60
We converted it to this:
$ cat /var/lib/dpkg/alternatives/gdm-smartcard auto /etc/pam.d/gdm-smartcard /etc/pam.d/gdm-smartcard-pkcs11-exclusive 30 /etc/pam.d/gdm-smartcard-sssd-exclusive 50 /etc/pam.d/gdm-smartcard-sssd-or-password 40
The new line would give us the option to log in with a username and password, even though the smartcard was still plugged in.
To use the new line, we executed the following command again:
sudo update-alternatives --config gdm-smartcard;
and we selected the new option, number 4.
$ sudo update-alternatives --config gdm-smartcard There are 4 choices for the alternative gdm-smartcard (providing /etc/pam.d/gdm-smartcard). Selection Path Priority Status ------------------------------------------------------------ 0 /etc/pam.d/gdm-password 60 auto mode 1 /etc/pam.d/gdm-smartcard-pkcs11-exclusive 30 manual mode 2 /etc/pam.d/gdm-smartcard-sssd-exclusive 50 manual mode 3 /etc/pam.d/gdm-smartcard-sssd-or-password 40 manual mode 4 /etc/pam.d/gdm-password 60 manual mode Press <enter> to keep the current choice[*], or type selection number: 4 update-alternatives: using /etc/pam.d/gdm-password to provide /etc/pam.d/gdm-smartcard (gdm-smartcard) in manual mode
On reboot, we were able to log in using the username and password combination, even though the YubiKey was still plugged in.
Notes
A) After performing this change, we had to type in both the username and password.
B) In case you type something wrong the in the file /var/lib/dpkg/alternatives/gdm-smartcard , you will get an error when you try to execute the update command. You will get an error for not keeping an empty line at the end of the file as below:
$ sudo nano /var/lib/dpkg/alternatives/gdm-smartcard $ sudo update-alternatives --config gdm-smartcard update-alternatives: error: /var/lib/dpkg/alternatives/gdm-smartcard corrupt: unexpected end of file while trying to read master file
This post is also available in: Greek
