Ubuntu sign-in

Register and deregister machines

Registering gives each machine its own name and key in the portal. The phone then says which machine a login is on, and the sign-ins the machine decided by itself reach the sign-in log.

1
Create a registration token
In the portal, open the app → Machines → Add machines. Give it a Label, an expiry (Expires after (hours): 24 by default, at most 720) and, if you like, Max machines: how many machines may register with this token, not a cap on the fleet. Create token shows the token (rkr_…) once. One token can register a whole batch.
2
Register each machine
bash
```
sudo install -m 0600 /dev/stdin /root/u2-token <<<'rkr_…'
sudo u2auth-admin register --name web-03 --token-file /root/u2-token
sudo rm /root/u2-token
```
Run this as root on each machine, with its own --name: 1–64 characters, unique within the app. The token never reaches shell history or ps this way. --token rkr_… and $U2AUTH_REGISTRATION_TOKEN also work, but --token is visible in both.
3
Check it
bash
```
sudo u2auth-admin check      # shows: registered web-03 (<machine id>)
```
check shows “registered web-03” with the machine’s id, and how many sign-in events are waiting to be sent. The machine now appears under Machines, with its hostname, OS and last sign-in.

What registering changes

register writes /etc/u2auth/machine.conf (root, 0600) next to u2auth.conf: machine_id, machine_name and the machine’s own api_key, which replaces the shared key from then on. Do not edit it by hand. The shared key keeps working for machines not yet registered until it is revoked under API Keys.
The push names the machine, from the server: “SSH login as alex from 192.168.64.1 on web-03”. The name comes from the registration, never from the request, so one machine cannot pass itself off as another.
Sign-ins the machine decides by itself (offline codes, wrong codes, bypass users, the emergency switch) are queued and sent to the sign-in log. The event says which kind of code was used and whether it worked, never the code.

Renaming

Under Machines → Rename. The machine’s key is relabelled, and the next push shows the new name, because the name comes from the server. On the machine itself, u2auth-admin check keeps showing the name it registered with: a known gap, harmless.

If register refuses

register says	What to do
already registered as web-03; use --force to register again	The machine is already registered. To give it a new name or move it to another app, see “Move a machine” below.
this machine is still registered as “web-03” — revoke it in the portal first, or pick a new name	--force with the name of its own entry, which is still live. Revoke that entry under Machines first, or choose another name.
registration token is invalid, expired or used up — create a new one in the portal	The token expired, was revoked, or reached its Max machines. Create a new one under Machines → Add machines.

Deregister a machine

There is no deregister command. Revoking in the portal is the step that counts, and it works for a machine that is dead or compromised too.

1If the machine can still reach U2 Secured, send its queued sign-ins first with u2auth-admin sync, so the log is complete.
2In the portal: the app → Machines → Revoke, then Confirm revoke. Its key stops working at once. Its past rows in the sign-in log keep its name.
3On the machine, if it stays in service: delete /etc/u2auth/machine.conf. It falls back to the app’s shared key in u2auth.conf, if that key is still valid. To take the machine out of U2 Secured altogether, follow Remove.

bash

sudo u2auth-admin sync                 # 1. send queued sign-ins, if U2 is reachable
# 2. portal → the app → Machines → Revoke → Confirm revoke
sudo rm /etc/u2auth/machine.conf       # 3. if the machine stays in service

Until machine.conf is deleted, every sign-in on a revoked machine says “U2 Secured refused this machine’s request (ask your administrator).” and offers only offline codes.

Revoking a machine in use locks out users without codes

From the moment it is revoked, users of that machine get in only with an authenticator code or a backup code; anyone without one is refused. Before revoking a machine that is still in use, keep a root session open on it, or make sure the break-glass account works.

Move a machine to a new name or app

bash

# 1. portal → Machines → Revoke the old entry
# 2. with a token from the target app:
sudo u2auth-admin register --force --name web-03b --token-file /root/u2-token

Revoke the old entry first: --force with a new name registers the machine again but does not retire the old entry, which stays under Machines until it is revoked. To move to another app, use a token from that app; its users need to be paired with that app too (enroll).

Registration tokens

Machines lists the tokens with their expiry and how many machines used them. Revoke token (it asks first) stops further registrations with it; machines already registered with it keep working. Unused tokens also expire on their own.