u2u2secured
Documentation menu
Ubuntu sign-in

Remove U2 Secured from a machine

Take the SSH lines out first, then remove the package. The package refuses to go while lines added by hand still use the module, because without the module those lines would refuse every SSH login.

Keep a root session open

Keep a second, already-authenticated root session open until a fresh SSH login works after step 2. A mistake in /etc/pam.d/sshd locks everyone out, the break-glass account included.

  1. 1

    Deregister the machine

    Run u2auth-admin sync if the machine can still reach U2 Secured, then revoke it under Machines. See Register & deregister machines.

  2. 2

    Undo the SSH setup

    /etc/pam.d/sshd
    # /etc/pam.d/sshd — delete the two U2 Secured lines, leaving the stock
@include common-auth
    bash
    sudo rm /etc/ssh/sshd_config.d/u2auth.conf
sudo sshd -t && sudo systemctl reload ssh

    In /etc/pam.d/sshd, delete the pam_succeed_if and pam_u2auth.so lines so the plain “@include common-auth” is all that remains (on RHEL, “auth substack password-auth”). Delete the sshd drop-in and reload. Then log in from another session before going on.

  3. 3

    Remove the package

    bash
    sudo apt remove u2auth     # keeps /etc/u2auth and /var/lib/u2auth
sudo apt purge u2auth      # also deletes them

    remove takes the module out of common-auth (the desktop profile) before its files go, and keeps the config, registration and users’ codes, so reinstalling resumes. purge also deletes /etc/u2auth and /var/lib/u2auth: machine.conf, every user’s offline codes and any sign-in events not yet sent.

  4. 4

    Tidy up

    bash
    sudo groupdel u2mfa        # if nothing else uses it

    The u2mfa group does nothing without the module. Users keep the fleet’s entries in their app; they still work on the other machines.

If removal is refused

apt stops with “u2auth: not removing. These PAM lines still use the U2 Secured module:” and lists each file and line number. Delete those lines (step 2), check with a second SSH session, and remove again. The override exists:

bash
sudo U2AUTH_REMOVE_ANYWAY=1 apt remove u2auth

U2AUTH_REMOVE_ANYWAY=1 locks out SSH

With the module gone, a “default=die” line that names it refuses every login by a member of u2mfa through that service, and bypass_users no longer helps them because it lives in the module. Only an account kept outside u2mfa, like the break-glass account, still gets in. Use the override only with console access and a plan to fix /etc/pam.d/sshd from there.

Need it out of the way now?

bash
sudo u2auth-admin disable                # gated logins pass on their first factor alone
sudo u2auth-admin enable                 # back on
sudo pam-auth-update --disable u2auth    # desktops: local sign-ins only, SSH untouched

disable lets every gated login through on its first factor alone (the SSH key, or the password on a desktop), each one logged as reason=disabled; enable reverses it. On desktops, pam-auth-update --disable u2auth takes the module out of local sign-ins and leaves SSH as it is.

Upgrades are not removals

Installing a newer .deb over the old one keeps the config, the registration, users’ codes and the PAM lines, and is never refused.