Azure Virtual Machines
An Azure service that is used to provision Windows and Linux virtual machines.
9,036 questions
Using Yubikey over usbip on Azure hosted Ubuntu 18.04
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(160, 73%, 25%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EBP%3C/text%3E%3C/svg%3E)
Budzynski, Piotr [AUTOSOL/RS/WRSW]
0
Reputation points
Hi,
I am trying to access my phisical machine Windows 10 with 'Yubikey 5 NFC' connected using usbip from Ubuntu 18.04.1(5.4.0-1122-azure) hosted on Azure.
Ubuntu has usbip installed by default (usbip-utils 2.0) and Windows has 4.0.0 version installed.
I need a hardware key, using Azure Key Vault is not an option.
The issue is on Azure Ubuntu:
usbip attach --remote=1.1.1.2 --device=1-1
libusbip: error: udev_device_new_from_subsystem_sysname
failedusbip: error: open vhci_driver
There is a very similar issue solved on AWS reported here:
https://askubuntu.com/questions/1303403/how-to-install-usbip-vhci-hcd-drivers-on-an-aws-ec2-ubuntu-kernel-version
Following post above when I try to run 5.4.0-81-generic instead of 5.4.0-1122-azure kernel machine still boots with 5.4.0-1122-azure kernel.
I have also tried xrdp with no luck.
Any ideas how to get vhci module, or support for remote USB and Yubikey on Azure hosted Ubuntu machine?
Thanks,
Piotr
Azure Virtual Machines
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(60.8, 4%, 15%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EKM%3C/text%3E%3C/svg%3E)
kobulloc-MSFT 26,811 Reputation points Microsoft Employee Moderator2024-02-05T18:16:29.6366667+00:00 Hello, @Budzynski, Piotr [AUTOSOL/RS/WRSW] !
I'm still doing some additional research, but it appears that there are a couple solutions for using Yubikeys on Azure:
In the video, we use the iOS Remote Desktop application to show both of these two new features together where a user can now use their iPhone and a YubiKey to access their Windows 11 virtual desktops without using a password.
-
Budzynski, Piotr [AUTOSOL/RS/WRSW] 0 Reputation points
2024-02-07T13:01:27.4333333+00:00 Hi, this is a bit different case. I am connecting Yubikey to Windows machine. All the functionality from Yubikey is needed on remote Azure VM running Ubuntu. Remote USB pass thru between Windows and Ubuntu is required. Thank you, Piotr
-
kobulloc-MSFT 26,811 Reputation points Microsoft Employee Moderator
2024-02-07T19:17:36.25+00:00 Thank you for the clarification, @Budzynski, Piotr [AUTOSOL/RS/WRSW] ! There are a lot of different approaches to using Yubikey on Azure but it sounds like the key ask here is remote USB passthrough. In the past when we explored USB over IP, the recommendation was to use third party solutions (which support both Windows and Linux):
USB ports were not designed to be virtualized. If we mapped a physical USB port to a VM, access to the device would fail when the virtual machine Live Migrated or failed over in the case of unplanned downtime. The solution is to use a USB over IP solution. There are several options on the market which provide access to USB devices over TCP/IP. Here are a few examples:
https://www.amazon.com/Coolgear-2-Port-Ethernet-Device-Server/dp/B08372NQZQ?ref_=ast_sto_dp
https://www.amazon.com/Coolgear-4-Port-Ethernet-Device-Server/dp/B08373BZSJ?ref_=ast_sto_dp
I reached out to the virtual machine team and I believe there is still a bit of confusion regarding your setup and why we aren't recommending one of the existing Yubekey solutions like Active Directory , Entra ID, Priviliged Identity Manager (PIM), or Microsoft MFA.
I am connecting Yubikey to Windows machine. All the functionality from Yubikey is needed on remote Azure VM running Ubuntu.
Am I correct in understanding that you have a physical USB device you are using locally on a Windows machine that you are using to connect to an Azure Ubuntu VM? The virtualized USB pitfall of migration for maintenance mentioned above seems to me that you would want to use the Yubico solution below with something like Entra ID to connect to your VM:
-
Budzynski, Piotr [AUTOSOL/RS/WRSW] 0 Reputation points
2024-02-08T10:27:11.0266667+00:00 I do not want to log in and authenticate into remote Ubuntu VM machine using Yubikey. Yubikey is connected locally to my Windows computer. Azure Ubuntu VM is running software that needs Yubikey locally. Most promising solution so far was USBIP If I understood correctly the problem is in Azure optimized kernel - it is missing handling of "open vhci_driver". AnyplaceUSB could be a solution, unfortunately I will not be able to investigate it any time soon.
Sign in to comment
Sign in to answer