CTAP Proxy not working, Qubes OS 4.2.2, Fedora 40 XFCE

User Support
1

Hi all,

Asking my question in a fresh tread to try to get attention on the exact problem I’m having.

I have a pretty fresh install of Qubes OS 4.2.2 with the default Fedora 40 XFCE template. I am also using sys-usb as installed by default during the installation process, no modification.

I have followed this guide which is simple: CTAP proxy | Qubes OS

In dom0

$ sudo qubes-dom0-update qubes-ctap-dom0

For each qube (qube_name) that need to use ctap proxy (in dom0 as well)

$ qvm-service --enable qube_name qubes-ctap-proxy

then inside the related qube-template:

$ sudo dnf install qubes-ctap

Each time I try to use the key, I get my screen flooded with denied rights messages as followed:

Denied: u2f.Authenticate
Denied u2f.Authenticate+stringOfNumbersAndCharacters from qube_name to sys-usb

I have checked that the service “qubes-ctap-proxy” is checked in the qube manager and also checked if the qubes-ctap is installed. All seems good.

Anyone knows if “qubes-ctap-proxy” should also be installed in sys-usb? I would prefer not to mess with this qube if possible so I didn’t tried yet as it was not part of the documentation.

Anyone have successfully activated CTAP Proxy in 4.2.x / Fedora 40?

Thanks!

2

What do you have in your /etc/qubes/policy.d/50-config-u2f.policy in dom0?
What’s the output of this command in dom0?

grep "u2f.Authenticate" /etc/qubes/policy.d/*
3

Thanks apparatus,

Nothing comes up when I enter that command, I also tested other policies to confirm I’m typing it properly and yes I do.

I was under the impression that using the command line was activating everything but now I see that “Enable the Qubes u2f proxy service” is not activated in the GUI (Qubes OS Global Config) and there, it’s stated that “qubes-u2f” package needs to be installed in the usb template in order to be activated.

I was also under the impression that the u2f options in the GUI where the old version and the new version was ctap.

Should I go ahead and install “qubes-u2f” in the usb template and then activate “Enable the Qubes u2f proxy” from there?

Thanks for your help!

4

Yes, the u2f was just renamed to ctap:

I guess the info in Qubes Global Config just wasn’t updated.

I guess you need to install qubes-ctap package in sys-usb template as well.

1 Like
5

Thank you for your help apparatus,

I have made some tests and found out that installing either qubes-ctap or qubes-u2f will install exactly the same 3 modules/versions.

So I installed it in sys-usb… no changes
Enabled the Qubes u2f proxy service with Auth and Reg for a specific qube in Qubes OS Global Config… no changes
Checked the qubes-ctap-proxy service in sys-usb… no changes
Reboot the whole system… no changes

Going back to your initial question, the grep command now return:
/etc/qubes/policy.d/50-config-u2f.policy:policy.RegisterArgument +u2f.Authenticate sys-usb @anyvm allow target=@adminvm

While I have some doubt about the mistakes that I could have made initially, I’m completely runing out of idea now.

Let me know if you have any ideas!

Thanks!

6

What’s the content of this file in dom0?

/etc/qubes-rpc/policy/u2f.Authenticate
1 Like
7

Hi apparatus,

It seems like that file does not exist there or anywhere else in my system.

However, I made more research on u2f.Authenticate and find that post here:

And added the missing lines found in Jarrah’s reply to /etc/qubes/policy.d/50-config-u2f.policy as follow and it worked:

u2f.Register * @anyvm sys-usb allow
u2f.Authenticate * @anyvm sys-usb allow
ctap.GetInfo * @anyvm sys-usb allow
ctap.ClientPin * @anyvm sys-usb allow

I guess I should re-open a new issue because this one has been closed: Qubes R4.2.0-rc2 Qubes OS Global Config tool not see qubes-u2f installed in sys-usb · Issue #8463 · QubesOS/qubes-issues · GitHub

Also, while I needed to add the ctap policies, the related interface throw an error message stating that thoses 2 lines are technically correct but too complicates and they are going to be removed after “saving” :-S

I really appreciate your help apparatus as I right now have a working CTAP Proxy :slight_smile:

Thanks!

1 Like
8

Hi all, I am having similar problems, but without the resolution.
I would like to use my Yubikey with its current “keys” registered on another computer without having to re-set them up. Right now I’m testing by trying to authenticate on brave browser, but I would like to be able to use the Yubico Authenticator app in an App qube currently that isn’t working.

I have done the following:
sudo qubes-dom0-update qubes-ctap-dom0
and in each qvm:
qvm-service --enable qube_name qubes-ctap-proxy
And inside the templates
dnf install qubes-ctap
I have also tried setting it in the Qubes Global Config as well, and tried adding custom rules to allow all to a qvm.
I have also checked in the settings in the Qubes Manager for each qvm and template that ctap is enabled.

In /etc/qubes/policy.d/50-config-u2f.policy file I have added the following lines like above:

u2f.Register * @anyvm sys-usb allow
u2f.Authenticate * @anyvm sys-usb allow
ctap.GetInfo * @anyvm sys-usb allow
ctap.ClientPin * @anyvm sys-usb allow

Without the ctap.GetInfo * @anyvm sys-usb allow I get the error: “Denied ctap.GetInfo from vmname to sys-usb” but with it that goes away.

Thanks for the above conversation and any help!

9

I fixed my problem:
I made a clone of sys-usb and in the clone configured the devices with strict reset. It was a thunderbolt problem.

I use the main sys-usb most of the time unless I need the thunderbolts.

I believe this happened because of a bios setting that turned thunderbolt off when installing Qubes. I also read somewhere that thunderbolt is less secure so best practice might be to just use the clone when needed. Not sure though.

Hope this helps someone.

10

I have been struggling mightily with this problem, described exactly as by the OP, except this is Q4.2.4 and Fedora-42-XFCE. I have followed the Qubes on-line docs, used the Qubes Global Config GUI, and tried the various suggestions in this and related threads, such as adding extra lines to the /etc/qubes/policy.d/50-config-u2f.policy file. No luck.

The Yubikey works fine if I connect it directly to the qube of interest, bypassing the proxy. I would prefer using the proxy, of course.

I have not tried @on-the-docs’s May 27 solution, mainly because I don’t understand in detail what needs to be done. (I also wonder about actually increasing security risks by changing the device treatment, at least without me knowing what I’m doing.)

Anyhow, if there is any other news on how to solve this, including “All my problems will be solved in Q4.3”, I would appreciate any ideas or new things to try.

11

Hi @shmooga,
My previous solution stopped working for me and I tried many different solutions.

The flatpak yubico authenticato application is the only solution that works.
To use flatpak, follow @solene’s guide to integrating it.
– Hope this helps!

12

Great, I will look at that next. Thank you for the feedback on your previous attempt, too!

13

(Her explainer on how to set up ProtonVPN is excellent.)