How to attach a Yubikey as a normal, extra usb keyboard only to specific AppVMs?

[@LeeteqXV (Twitter)]

I have followed this guide: https://www.qubes-os.org/doc/usb/

And I can see the Yubikey, and attach it to the AppVM, then see that it
is attached to the AppVM with the qvm-usb command.

However, nothing happens inside the AppVM when I push the Yubikey button
to send the password to the field with the cursor, neither in a browser
window nor in Gedit.

As far as I know, the Yubikeys are identifying themselves as a 100%
standard keyboard without the need for any driver on any system, so the
push of its button should be understood by the Qube to be normal
keyboard key presses.

What may be wrong?

Regards,

@LeeteqXV

[wes....@gmail.com]

Good Luck @LeeteqXV

I haven't yet tried to get my yubikey to work but that is on my to-do list. I hope you are able to deduce the problem and get it working. Still troubleshooting my wifi problems. Ugh...fml

[Andrew David Wong]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

I don't have a YubiKey, so I haven't tried this myself. If it really
identifies itself as a keyboard, then it's probably necessary to
follow the USB keyboard-specific instructions:

https://www.qubes-os.org/doc/usb/#how-to-use-a-usb-keyboard

Specifically, make sure you edit the RPC policy rules, if you haven't.

Also, you might find some hints here:

https://www.qubes-os.org/doc/yubi-key/

- --
Andrew David Wong (Axon)
Community Manager, Qubes OS
https://www.qubes-os.org
-----BEGIN PGP SIGNATURE-----

iQIcBAEBCgAGBQJYbcEQAAoJENtN07w5UDAwMgsP/2/LH25FVGbVJ2c8/ZWiqaMd
tWu0aUpTg6wIj5bIM6uhiMI2RDNoxN5USF3NStgDLYUjtvjCEIE1ykYZSU/PRNGu
iS6KFk2DYZ4BxCdVH88hIfm2IzP6gVxoyQMvJL1ez3BXSbX23EYdpl1/0ZwbpVCC
QjtLq6ecgWXQ3oPusVPV3GlkfpU1NWEIiRvtu9Z3TYAT4lzzWl6YVWN3DjUjetUS
WD9pxJgE8hKylbnn2slOCLwxqJ3FmcdUEPo4TG+3VKMwqRfoixKfC+RO97rKxCeP
rJfqEDKWw31ytFEUE29Wj/KbffUoqEA4vt8hbrCEabNpQ9hgdaZYXFutl8FpOfSp
b0W35b0re5phN4DMobV+f4ViZfjMCFGCtsGkJ6CIlOsUAQ+JKX3aZDc0+P1tgjny
crKnap9dxiypGMKpufw/les/TrOwajg1rsWUyziDzP9orHUO61SPsAUiXigp959+
4NP0Injgo9w9QfBIEY4kHD2S8Pzw+YNDNOH+KtEuCkodnYJftVzDuXBB8xhl00ne
3GgJAnaQHdfedoulGFufUGgn85KhsLGU7rKhFYOQ+LQw7QcGITFLfuJb2bfhsjQV
0XZIaVjx7e2ul0IdvBw7DXH9wbwKK6nObnl4/ZwkbXJNaay8Lj/o7DFWn6okFFYf
q0+eilBGSuwmdc0qW6nP
=x77l
-----END PGP SIGNATURE-----

[wes....@gmail.com]

I was able to get my yubikey to work in this personal vm but for the life of me I wasn't able to use it to authenticate with my gmail on this login.

I followed the instruction where you add the info to the qubes.InputKeyboard file then it worked. You'll know you've configured that file correctly if you get the popup.

I'm still not able to get my smart card reader to work even though I think i've followed all the instructions. I'm gonna use all these same tricks and see if I can get it to work in the Win7 HVM...FML

B4U2D0

[miguel]

Did you manage to find a solution? I have the same exact problem. USBVM sees usb fine and pass it to AppVM without a problem but the yubikey simply doesnt do anything inside the Appvm even the yubico personalization tool does not detect a yubikey connected even though qvm-usb shows that the Yubikey is properly connected and lsusb inside the VM also shows Yubico connected.

regards,
Miguel

[Daniel Moerner]

On Monday, August 7, 2017 at 1:06:27 PM UTC-4, miguel wrote:
> Did you manage to find a solution? I have the same exact problem. USBVM sees usb fine and pass it to AppVM without a problem but the yubikey simply doesnt do anything inside the Appvm even the yubico personalization tool does not detect a yubikey connected even though qvm-usb shows that the Yubikey is properly connected and lsusb inside the VM also shows Yubico connected.

Hi,

I have a Yubikey 4, and I have no problems using the Yubikey with appVMs on a fresh install of Qubes R3.2, no extra configuration required.

I use the following script to attach it to specific VMs, and then it works perfectly with Google Chrome:

#!/bin/bash
# Usage: yubi <vm-name>

USB_DEVICE="$(qvm-usb | grep Yubikey | cut -f1)"

# If no device, just exit
if [ -z "$USB_DEVICE" ]; then
echo "No device attached"
exit
fi

# If no argument, then just detach.
if [ $# -eq 0 ]; then
echo "No argument, detaching device"
qvm-usb -d "$USB_DEVICE"
exit
fi

# If we have an argument, detach first as a precaution.
qvm-usb | grep "$USB_DEVICE" | grep -q "(attached to"
if [ $? -eq 0 ]; then
echo "Device already attached, detaching first"
qvm-usb -d "$USB_DEVICE"
sleep 1
fi

echo "Attaching device to $1"
qvm-usb -a "$1" "$USB_DEVICE"