[SOLVED] The backup (passkey) elligibility of this device has changed, meaning it must be re-enrolled for security validation

CRCinAU

Renowned Member
May 4, 2020
190
52
68
crc.id.au
I've noticed with the change to PVE9 and PBS4 betas that I've had a lot of problems with my passkeys giving the following error message:

Code:
Aug 06 13:57:34 pbs proxmox-backup-api[26218]: Credential backup elligibility has changed!
Aug 06 13:57:34 pbs proxmox-backup-api[26218]: error in 2nd factor authentication for user 'root@pam': The backup (passkey) elligibility of this device has
changed, meaning it must be re-enrolled for security validation
Aug 06 13:57:34 pbs proxmox-backup-api[26218]: authentication failure; rhost=[<ip>]:45972 user=root@pam msg=authentication failed

Give this has happened in both PVE and PBS, I'm guessing that something happened in the common parts of these to cause this.

If I delete the WebAuthn 2FA, and add it again, it seems to function properly again.

What causes this to happen?

EDIT: Seems that this happened again - on the WebAuthn device I only just enrolled... So I re-enrolled the same device on the 1st August, and twice today when it failed with the same error.

TOTP seems to be ok...

EDIT 2:
Code:
proxmox-backup: 4.0.0 (running kernel: 6.14.8-2-pve)
proxmox-backup-server: 4.0.10-1 (running version: 4.0.10)
proxmox-kernel-helper: 9.0.3
proxmox-kernel-6.14.8-2-pve-signed: 6.14.8-2
proxmox-kernel-6.14: 6.14.8-2
proxmox-kernel-6.14.8-1-bpo12-pve-signed: 6.14.8-1~bpo12+1
proxmox-kernel-6.8.12-12-pve-signed: 6.8.12-12
proxmox-kernel-6.8: 6.8.12-12
proxmox-kernel-6.8.12-9-pve-signed: 6.8.12-9
ifupdown2: 3.3.0-1+pmx9
libjs-extjs: 7.0.0-5
proxmox-backup-docs: 4.0.10-1
proxmox-backup-client: 4.0.10-1
proxmox-mail-forward: 1.0.2
proxmox-mini-journalreader: 1.6
proxmox-offline-mirror-helper: 0.7.0
proxmox-widget-toolkit: 5.0.4
pve-xtermjs: 5.5.0-2
smartmontools: 7.4-pve1
zfsutils-linux: 2.3.3-pve1
 
Last edited:
what kind of passkeys are you using?