diff --git a/modules/de/i3.nix b/modules/de/i3.nix
index 65705b5..7672895 100644
--- a/modules/de/i3.nix
+++ b/modules/de/i3.nix
@@ -1,8 +1,6 @@
 { pkgs, lib, ... }:
 
 {
-  # gnupg to fix conflict between kde
-  programs.gnupg.agent.pinentryPackage = pkgs.pinentry-gtk2;
   # X11
   services.xserver = {
     enable = true;
diff --git a/modules/sys/rc/openssh.nix b/modules/sys/rc/openssh.nix
index 9502e65..901d9fe 100644
--- a/modules/sys/rc/openssh.nix
+++ b/modules/sys/rc/openssh.nix
@@ -1,10 +1,10 @@
 {config, ...}:
 
 {
-  programs.ssh = {
-    startAgent = true;
-    agentPKCS11Whitelist = "${config.security.tpm2.pkcs11.package}/lib/*,/run/current-system/sw/lib/*";
-  };
+  #programs.ssh = {
+  #  startAgent = true;
+  #  agentPKCS11Whitelist = "${config.security.tpm2.pkcs11.package}/lib/*,/run/current-system/sw/lib/*";
+  #};
   services.openssh = {
     enable = true;
     settings.PasswordAuthentication = true;
diff --git a/modules/sys/security.nix b/modules/sys/security.nix
index f6ac7b8..4e53045 100644
--- a/modules/sys/security.nix
+++ b/modules/sys/security.nix
@@ -1,8 +1,20 @@
 {
+  programs.gnupg.agent = {
+    enable = true;
+    enableSSHSupport = true;
+  };
+  services.pcscd.enable = true;
+  services.udev.packages = [ pkgs.yubikey-personalization ];
   security = {
     sudo.execWheelOnly = true;
     polkit.enable = true;
     protectKernelImage = true;
+    pam.yubico = {
+       enable = true;
+       debug = true;
+       mode = "challenge-response";
+       id = [ "19694730" ];
+    };
     tpm2 = {
       enable = true;
       pkcs11.enable = true;