CuriOS provides a complete, easy-to-use security experience built around hardware security keys such as YubiKey.

Through the CuriOS Manager, you can manage your entire security posture from a single menu — no manual configuration files or command-line tools needed.

The security features work together to protect your system at every stage:

• Logging in — use your YubiKey instead of a password at the login screen
• Unlocking your disk — use your YubiKey to decrypt your drive at boot time
• Remote access — store SSH keys securely on your YubiKey
• Boot protection — ensure only trusted software can start your computer

It is important to understand that these are independent features you can enable in any combination:

Enabling one does not automatically enable the others.

When this feature is enabled, CuriOS configures your system so that a FIDO2/U2F security key can be used to authenticate.

• Authentication is configured so that a successful key touch can replace password entry.
• Password authentication remains available as a fallback.
• Users who do not have a key configured will not be blocked.
• Interactive prompts and visual cues are enabled for better user experience.

U2F authentication is enabled for:

• cosmic-greeter (COSMIC login screen)
• greetd
• login (console)
• sudo

By default CuriOS uses stable values instead of your computer's hostname.

The goal is to make it easy to use the same YubiKey enrollment across multiple machines. When the origin and application ID are stable values instead of per-hostname, you can share the resulting configuration file between machines and the key will work without re-enrollment.

The CuriOS Manager automatically reads these two values when performing U2F enrollment.

If you want different values (for example your own domain), override them in settings.nix.

You can optionally enable automatic session locking. When this option is active, removing the YubiKey from the USB port will automatically lock all user sessions. This provides a convenient physical security feature (similar to pulling a smart card).

This option is disabled by default and is not available from the CuriOS Manager menu. To enable it, run the following command:

sudo curios-update --update-module curios.security.u2f.lockOnRemove true && sudo curios-update --update

This feature allows you to use a FIDO2-compatible security key (such as a YubiKey 5 or newer) to unlock your encrypted root partition at boot time.

• CuriOS uses the modern systemd-cryptenroll approach (the recommended path when systemd in the initrd is active).
• The key must support the FIDO2 hmac-secret extension (most YubiKey 5 series and later devices do).

When this feature is active, the standard Plymouth theme is used. The prompt will usually display a generic message such as "Enter password".

• If your YubiKey requires a client PIN, type the PIN at this prompt.
• If the key only requires a touch (no PIN), insert the key and touch it when the LED blinks.
• The recovery passphrase always works as a fallback at the same prompt.

You must always keep a strong recovery passphrase for your LUKS volume.

If your YubiKey is lost, damaged, or simply not plugged in during boot, the only way to decrypt the disk is with the recovery passphrase that was set during installation (or added later via the manager).

Without a recovery method, a lost hardware key would result in permanent data loss.

You can create an SSH key that lives inside your YubiKey instead of as a file on your computer. This means the private key never leaves the hardware, making it much more resistant to theft or malware.

• The key is generated as a resident key stored directly on the YubiKey.
• The file on your computer is only a reference (a "handle") that tells the YubiKey which key to use.
• You can use the key on another machine by downloading it from the YubiKey.

The CuriOS Manager walks you through the process:

1. Checks your YubiKey — it verifies that a compatible key is inserted.
2. PIN check — if your YubiKey does not have a FIDO2 PIN set yet, the manager will offer to help you create one. A PIN is required for this feature.
3. Name your key — you give the key a friendly name (for example, "work-laptop").
4. Touch the key — you enter your PIN and touch the YubiKey when it blinks.
5. Done — the key is ready to use for remote connections.

Because the private key is stored on the YubiKey itself, you can move to a different computer and download the key from the device. You do not need to carry separate key files.

To import the key on another computer, insert your YubiKey and run:

cd ~/.ssh/ && ssh-keygen -K

This will download the resident key from the YubiKey into the current ~/.ssh/ directory.

The manager can also show you which SSH keys and other credentials are currently stored on your YubiKey.

Secure Boot ensures that only trusted, properly signed software can start your computer. It protects against malicious programs that try to modify the boot process and quietly take control before the operating system loads.

On CuriOS, Secure Boot is supported through the Limine bootloader, which is the default bootloader since CuriOS 26.05.5.

The CuriOS Manager provides a guided, step-by-step setup:

1. System check — the manager verifies your system is ready.
2. Bootloader check — if you are upgrading from a previous version of CuriOS that used a different bootloader, the manager will offer to switch to Limine, which is required for Secure Boot.
3. Firmware check — the manager scans your computer's firmware and will warn you if a firmware update is needed before Secure Boot can work.
4. Key creation — the manager generates the necessary security keys automatically.
5. Enter Setup Mode — the manager guides you to reboot into your computer's firmware settings, clear the existing security keys, and return to Curi*OS.

   On ThinkPad devices, use "Reset to Setup Mode" instead of "Clear All Secure Boot Keys".

6. Enroll keys — back in CuriOS, the manager enrolls the new keys and enables Secure Boot.
7. Final reboot — one last restart to confirm everything works.

All security settings, as well as the enrollment process itself, are managed through the CuriOS Manager.

1. Launch the manager with Super + Return
2. Navigate to the 🔐 Security section

From this menu you can:

• Enroll your YubiKey for full disk decryption
• Enable Secure Boot
• Register your primary YubiKey for login and sudo
• Add an additional YubiKey for login and sudo
• View your current U2F keys
• Test PAM authentication
• Add an SSH key to your YubiKey
• List the SSH keys and credentials stored on your YubiKey

• Always have a recovery method for LUKS FIDO2. Test it at least once after enrollment.
• Consider enrolling two different YubiKeys (primary + backup) for important machines.
• The lockOnRemove feature is very convenient but can be surprising if you frequently unplug your key. Test it first.
• U2F/PAM, LUKS FIDO2, SSH keys, and Secure Boot can be enabled independently. Choose the combination that matches your security requirements.
• The default origin and application ID values are designed so you can use one YubiKey across several machines. Only change them if you have a specific reason.
• At the Plymouth boot prompt with FIDO2 active, remember you can always use the recovery passphrase if your key is not inserted or the PIN step is not what you expect.
• For SSH keys on a YubiKey, remember that the private key lives on the device. The local file is just a handle. If you lose the YubiKey, you cannot use that SSH key anymore.
• Before enabling Secure Boot, make sure you understand how to access your firmware settings. The Limine boot menu offers a quick shortcut (S) to enter the firmware setup.
• If you dual-boot, research how Secure Boot affects your other operating systems before enabling it.

Next: Audio/Video applications.

Previous: AI tools

Back: index.