Ubuntu sign-in

Laptop: help and removal

For a computer set up with personal-setup: what to check when a code is refused, how to get back in, and how to turn it off or remove it.

Common problems

Problem	What to do
A code is not accepted	Use the entry for this computer, and check the phone sets its time automatically. Or use a backup code.
Phone lost or replaced	Sign in with a backup code. Then run sudo u2auth-admin personal-setup --new-totp and add the new entry on the new phone; the old entry stops working.
Fingerprint or automatic login skips the code	Run sudo u2auth-admin check. It names each way around and how to close it.
Running out of backup codes	sudo u2auth-admin backup-codes alex makes a new set; the old one stops working.
You want a tap on your phone instead	Create a free Developer app and set the computer up as a fleet of one (Desktop login, sudo & su). Your code entry keeps working as the offline fallback.

Commands that help

bash

sudo u2auth-admin check     # ways a sign-in could skip U2 Secured; exits 1 if one is open
sudo u2auth-admin status    # each login: code entry and backup codes left
journalctl -t u2auth        # every decision, with its reason=

Locked out

1Try a backup code first: it works with no phone and no network.
2If another account on this computer is not in the u2mfa group, sign in with it and run sudo u2auth-admin disable.
3Otherwise restart into recovery mode (hold Shift or press Esc at boot → Advanced options → recovery mode → root), and run:

recovery mode root shell

mount -o remount,rw /
u2auth-admin disable
reboot

bash

sudo u2auth-admin enable

disable lets every gated sign-in through on the password alone, and logs each one as reason=disabled. It is an emergency switch, not a way to turn two-factor off for good: once you are back in and have fixed the cause, run enable.

Recovery mode skips every login

Anyone at the keyboard can do the same, which is why it works as a way back in. If that matters to you, set a GRUB password or use full-disk encryption, and keep your backup codes safe instead.

Turn it off

bash

sudo pam-auth-update --disable u2auth    # stop asking; --enable u2auth turns it back on

This stops the extra step on every sign-in and keeps your codes, so --enable u2auth brings it back as it was.

Remove it

bash

sudo apt remove u2auth       # keeps /etc/u2auth and /var/lib/u2auth
sudo apt purge u2auth        # also deletes them

remove takes U2 Secured out of your sign-ins before the files go, and keeps your settings and codes, so reinstalling picks up where you left off. purge deletes those too. Afterwards, delete the computer’s entry from your authenticator app.