ERROR: Failed to write to the YubiKey. Make sure the device does not have restricted access #553
Comments
|
Because you've set an access code, all the changes are locked unless you can provide that access code when issuing the changing command. The way to provide the access code is by passing it to the Yes, it is confusing that you cannot pass the |
|
Thanks for this advice. It helped to clear the access code from one key but clearing the other key still fails. I also tried to reset the otp application with these instructions but failed during step 5. Error message was: Is there any way to reset the whole key (all applications) to factory settings? |
|
There is not, unfortunately. The behavior seems to indicate that you are using the incorrect access code, and if that is the case and the code is lost, then there is no way to recover it. |
|
I found the used access-code and managed to remove it from the yubikey so that issue is cleared. What is the reason that user cannot reset otp application (=remove PIN/access-code and all credentials) if he/she loses the access-code? My understanding is that at least fido, oauth and opengpg applications you can reset without any PIN. So why does the otp application use a different logic? It is also good to note that this irrecoverability is not properly documented, at least not mentioned at all in the ykman help texts or in the web documentation. In my mind user should be able to reset the otp application without PIN or access-code or if that is not possible for some reason then at least the ykman documentation and help texts should clearly warn user that losing the access-code prevents any further programming of the otp application. |
|
I am experiencing the same issue Any final suggestion? |
Added Yubico PPA
Instructions, see: https://support.yubico.com/hc/en-us/articles/360016649039-Enabling-the-Yubico-PPA-on-Ubuntu
https://launchpad.net/~yubico/+archive/ubuntu/stable
I cannot delete or reprogram otp slot 1. I cannot remove access code.
Expected result
[What did you expect to happen when you did the above?]
I expected this command to run without any error:
Or if failed then could remove the access code with command:
and then reprogram slot again without any errors.
Actual results and logs
See above
Other info
Before this error I could run several times
ykman otp yubiotp-command without any error.ykman otp yubiotp --force --public-id ldjhfkebukilcinj --private-id aff6c6808817 --key 38fbab04313c88a358e8cb4a6633e6bc 1Also the first time I added access code was successful
ykman otp settings --new-access-code 000000000000 1but after that I could not reprogram otp or remove access code.
I also installed
Yubikey Manager GUI v1.2.5
Yubikey Personalization Tool v3.1.24 (lib v 1.20.0)
Reprogramming or clearing otp slot 1 will fail also with those tools.
Running Yubikey Manager GUI / Applications / OTP / Slot 1 / Delete
Result is error text:
Failed to modify Slot 1. Make sure the Yubikey does not have restricted access.It seems that there is no way to modify access using Yubikey Manager GUI.
Running Yubikey Personalization Tool / Yubikey OTP / Quick / Slot 1 / Write configuration
Result is error text:
Yubikey could not be configured. Perhaps protected with configuration protection access code.It seems that there is no way to modify access using Yubikey Personalization Tool either.
I have same issue and same error logs with both of my Yubikeys. Keys were purhchased at the same time and they have identical SW versions and enabled applications. So most likely the issue is not in the keys but a SW issue.
I have tested both keys in 2 different Linux Ubuntu 20.04 LTS environments with same results. Yubico SW installed into both environments with same commands so most likely this is not an environment related HW issue either.
How can I fix this issue?
My keys are partly useless until I can fix this issue.
Thank you for your help and support!
The text was updated successfully, but these errors were encountered: