Yubico Forum

Yubikey NEO • [Community] - Forum going read only. New KDB on its way.

2018-01-30T09:26:55+01:00

For the security and experience of our user community, we have decided to set the forum as read-only and wipe all user account information. All historical posts and announcements will be archived and remain publicly searchable.

In 2018, we will be publishing a searchable knowledge-base system that allows the community to provide direct feedback on articles and make suggestions that will be reviewed by Yubico staff. We sincerely appreciate the participation of our user forum over the years and hope to continue serving your for years to come.

Statistics: Posted by Tom2 — Tue Jan 30, 2018 9:26 am

Yubikey NEO • Re: Yubikey Resetting code

2018-01-30T09:10:29+01:00

viewtopic.php?f=26&t=2147

Statistics: Posted by ChrisHalos — Tue Jan 30, 2018 9:10 am

Yubikey NEO • Yubikey Resetting code

2018-01-29T13:13:21+01:00

So I have read that you can configure a Resetting Code for the OpenPGP applet which can be used to reset the pin.
The command to be used is supposed to be: RESET RETRY COUNTER but I've not found any information on how to send the command.
Are there any utilities to use the Resetting Code for the yubikey, or how is it supposed to work?

Statistics: Posted by jfjallid — Mon Jan 29, 2018 1:13 pm

Yubikey NEO • Re: [QUESTION] Neo & ssh ... works on Linux, not on Mac

2018-01-23T21:03:14+01:00

tinkster wrote:

Hi,

I have installed the yubi_u2f PAM module on my linux workstation. Connecting via ssh to localhost works - I type ssh andrej@host, get
a password prompt, and get connected when I push the button on the neo after that; plugging the neo into my macbook air and trying
to connect to my linux box via ssh fails; ought to say that I could happily connect to it from the mac yesterday (w/o the yubi_u2f), using
either password or public-key access. Now it's no-show. What am I doing wrong? :)

Cheers,
Andrej

So ... for shits & giggles I tried to connect from the Mac to Linux box while the Neo was on the linux box. Doing the password
typy-typy thing on the mac and then pushing the button attached to the Linux box established a session. Huh? :D

What *did* I do wrong?

Cheers,
Andrej

Statistics: Posted by tinkster — Tue Jan 23, 2018 9:03 pm

Yubikey NEO • [QUESTION] Neo & ssh ... works on Linux, not on Mac

2018-01-23T20:45:36+01:00

Statistics: Posted by tinkster — Tue Jan 23, 2018 8:45 pm

Yubikey NEO • Re: gpg --card-status and Card error message

2018-01-21T21:56:56+01:00

having tried again,
I get this message:

C:\Users\myaccount>gpg --card-status

gpg: OpenPGP card not available: Not supported

Statistics: Posted by jbenfeld — Sun Jan 21, 2018 9:56 pm

Yubikey NEO • gpg --card-status and Card error message

2018-01-21T21:32:31+01:00

Microsoft Windows [Version 10.0.16299.192]
(c) 2017 Microsoft Corporation. All rights reserved.

C:\Users\myaccount>gpg --card-status
gpg: selecting openpgp failed: Card error
gpg: OpenPGP card not available: Card error

Does anyone know how to solve this error?

regards
JB

Statistics: Posted by jbenfeld — Sun Jan 21, 2018 9:32 pm

Yubikey NEO • Re: Sharing violation / can't access extended capability fla

2018-01-18T16:32:50+01:00

Just to add to this, I tried this on a different computer, also running Ubuntu 16.04, and I get the same set of errors. I've tried resetting the applet per this suggestion, https://www.yubico.com/support/knowledg ... t-yubikey/ but no luck.

Statistics: Posted by BFRAME — Thu Jan 18, 2018 4:32 pm

Yubikey NEO • Sharing violation / can't access extended capability flag

2018-01-18T00:02:07+01:00

I am trying to get Neo working on Ubuntu 16.04. THe issue seems to be that gpg can't access my card. If I run

Code:

$ gpg --card-status
gpg: sending command `SCD LEARN' to agent failed: ec=6.124
gpg: OpenPGP card not available: general error

With sudo I get a different error:

Code:

$ sudo gpg --card-status
gpg: WARNING: unsafe ownership on configuration file `/home/bframe/.gnupg/gpg.conf'
gpg: detected reader `Yubico Yubikey NEO OTP+U2F+CCID 00 00'
gpg: pcsc_connect failed: sharing violation (0x8010000b)
gpg: apdu_send_simple(0) failed: locking failed
Please insert the card and hit return or enter 'c' to cancel:

I can kill the gpg agent to remove that error:

Code:

$ gpg-connect-agent 'scd killscd' /bye
OK

But that error is replaces with a "can't access Extended Capability Flags" error:

Code:

$ sudo gpg --card-status
gpg: WARNING: unsafe ownership on configuration file `/home/bframe/.gnupg/gpg.conf'
gpg: detected reader `Yubico Yubikey NEO OTP+U2F+CCID 00 00'
gpg: can't access Extended Capability Flags - invalid OpenPGP card?

gpg: Segmentation fault caught ... exiting
Segmentation fault (core dumped)

gpg2 doesn't fair any better:

Code:

$ sudo gpg2 --card-status
gpg: OpenPGP card not available: Unsupported operation

But otherwise the device is recognized by the system:

Code:

$ opensc-tool -l
# Detected readers (pcsc)
Nr.  Card  Features  Name
0    Yes             Yubico Yubikey NEO OTP+U2F+CCID 00 00
$ piv-tool --serial
Using reader with a card: Yubico Yubikey NEO OTP+U2F+CCID 00 00
BB D0 8B B7 1C 17 02 FC F5 42 20 44 24 37 94 02 .........B D$7..

And Yubikey NEO Manager, YubiKey PIV Manager, and YubiKey Personalization, and YubiKey Authorization all recognize it.
I'm running gpg v. 1.4.20 and gpg2 v. 2.1.11.

I've seen similar problems on the forum, but no solution has worked. Any thoughts on how to trouble shoot this?

Thanks!

Statistics: Posted by BFRAME — Thu Jan 18, 2018 12:02 am

Yubikey NEO • Re: Smart card removed when press YubiKey button

2018-01-17T10:48:01+01:00

For the record, I am linking to viewtopic.php?f=25&t=2764 that implements the aforementioned minidriver, with support for multiple certificates.

With important drawbacks, see for example viewtopic.php?f=26&t=2739 , by the way!

Statistics: Posted by maggis — Wed Jan 17, 2018 10:48 am

Yubikey NEO • Re: windows 10 1703 minidriver update breaks PIV

2018-01-17T10:47:19+01:00

Hit by this as well.

Does anyone know the exact update name so I can un-approve it from WSUS?

I would prefer to not blacklist the device ID since some complained that the device did not work after that.

Does anyone know does OpenSC support the new "container" on-card format or will it be supported?

Statistics: Posted by maggis — Wed Jan 17, 2018 10:47 am

Yubikey NEO • Re: Determine current slot configurations

2018-01-11T00:50:55+01:00

Try pressing and holding on the button for 3+ seconds. If you don't get something different from your slot 1 configuration, then it's most likely a challenge-response credentials. If you get a different output from your OTP, you can only tell by comparing the output if it's Yubico OTP, OATH-HOTP, or Static Password.

Statistics: Posted by ChrisHalos — Thu Jan 11, 2018 12:50 am

Yubikey NEO • Re: Determine current slot configurations

2018-01-10T16:17:26+01:00

When I run YubiKey Personalization Tool the Programming Status is listed as "Slot 1 and 2 configured", but I can't remember what I configured slot 2 for.

Is there any way to determine exactly what slot 2 is being used for?

Statistics: Posted by kentukynitemare — Wed Jan 10, 2018 4:17 pm

Yubikey NEO • Re: [QUESTION] - KeePass2 on PC/Android / Challenge/Response

2018-01-09T19:18:04+01:00

peach200 wrote:

Hi Sevo, could you clarify the steps you use for the KP2A? I have it installed, open kdbx, and select "Password + Challenge-Response". There's a field for password, and a button to "Load OTP Auxiliary File...". If I click the button, it just shows another screen titled "Select the storage type", with options to select System file picker, dropbox, etc. If I just swipe the NEO, it just prompts with Chrome, Firefox, Samsung Internet... Should there be one for KP2A?

Thanks!

Hi peach200,
You need to be sure you have your challenge .xml file in your phone's storage. Once you click the Load OTP Auxiliary File button, navigate to the .xml file in your phone's storage. When it is selected, you will be prompted to swipe your YubiKey NEO.

This page is very helpful if you would like to check out their setup and configuration instructions:
https://b3n.org/yubikey-two-factor-authentication

Cheers!

Statistics: Posted by poultrygeist — Tue Jan 09, 2018 7:18 pm

Yubikey NEO • NEO Lifespan

2017-12-27T16:45:02+01:00

So is there a way to check how many times the Yubico NEO has been used or how much is left of its lifespan? I don't want to get caught with a device that all of a sudden doesn't work for me regarding opening up secure accounts.

Statistics: Posted by wpcmsninja — Wed Dec 27, 2017 4:45 pm