path: root/computer/yubikey-with-non-us-keyboards.rst

Make Yubikey working with non-us keyboard layouts
#################################################

:date: 2013-04-09T23:59:41
:category: computer
:tags: yubikey, xorg, Gnome

My employer started to use system which allows using Yubikey for
authentication [*added later*: the most important thing is that whole
system is `Open Source`_, which is very very good thing], so I have
finally gave up and bought one myself as well. It works really well, and
comparing to the previous system it is both smaller and more convenient
to use (not mentioning that `the previous system has been
compromised`_).

The only problem I had with it is, that in order to be ultra-secure it
doesn't allow much configuration (my version of Yubikey doesn't have
``use-numeric-keypad`` option) so with my default Czech keyboard, it
didn't work, and I had to switch all the time between Czech and US
keyboard manually.

The first option seemed to be to use custom configuration snippet as
described in the Fedora Wiki and create a file in
``/etc/X11/xorg.conf.d/`` directory with content like::

   Section "InputClass"
       Identifier "keyboard defaults"
       MatchProduct "Yubic Yubico Yubikey II"

       Option "XkbModel" "pc104"
       Option "XkbLayout" "us"
       Option "XKbOptions" ""
   EndSection

Unfortunately, this solution doesn’t work with Gnome, which controls
input devices dynamically and overrides Xorg defaults.

Finally, I have found the solution with very kind help of Peter Hutterer
and his blogpost on `Custom input device configuration in GNOME`_. When
the example script from ``gnome-settings-daemon`` is modified to include
the configuration, it could also set Yubikey (and only Yubikey) input
device to us keyboard layout. The key part is::

   case "$1" in
       Yubico*)
         echo "Setting Yubikey layout"
         setxkbmap -device $2 -layout us
         ;;
     esac

Whole script is
https://gitlab.com/mcepl/input-device-configuration/blob/master/input-device-config.sh

.. _`Open Source`:
    http://linotp.org/
.. _`the previous system has been compromised`:
    http://arstechnica.com/security/2011/06/rsa-finally-comes-clean-securid-is-compromised/
.. _`Custom input device configuration in GNOME`:
    http://who-t.blogspot.com.au/2011/03/custom-input-device-configuration-in.html