Yubico Forum

Re: Yubikey plugin for Wordpress

2010-04-28T20:54:59+01:00

I've been using this plugin for awhile and it worked great. However, recently I have gotten an Android phone and wanted to start using the WordPress app. One issue that I'm having is that with this plugin installed the WordPress app won't work. Obviously there is no way for me to plugin the YubiKey into my phone, and the WordPress app doesn't give any option to enter in the additional OTP anyways. I'm curious if there is somehow a way to detect the attempt by the WordPress app and allow authentication without the use of the OTP? I don't want to weaken the added security that the plugin provides, but I find myself having to run without the YubiKey plugin in order to use the WordPress app.

Statistics: Posted by tnolte — Wed Apr 28, 2010 8:54 pm

Re: Yubikey plugin for Wordpress

2010-01-13T16:10:17+01:00

I'm having trouble with wordpress 2.9.1
The login form complains about the empty password field.

Bye

Statistics: Posted by nolith — Wed Jan 13, 2010 4:10 pm

Re: Yubikey plugin for Wordpress

2009-06-11T13:24:00+01:00

Here is a detailed visual guide on setting up Wordpress two factor authentication with Yubikey by using this plugin:

WordPress two-factor authentication with low-cost YubiKey USB token
http://www.net-security.org/article.php?id=1248

Statistics: Posted by helpnet — Thu Jun 11, 2009 1:24 pm

Re: Yubikey plugin for Wordpress

2009-03-07T00:30:18+01:00

I have created the german language files. You just need to copy the unzipped files into the plugin folder.
Feel free to contact me if there is something to improve.

/Jens

Statistics: Posted by JensK — Sat Mar 07, 2009 12:30 am

Re: Yubikey plugin for Wordpress

2009-03-02T22:11:34+01:00

Hi Henrik,

thanks for this great work!
As Bill I received my Yubikey and installed your great plugin with WP2.7.1 - it works like a charme.

One question to your clean code:
In line 272 you are calling api.yubico.com with the http protocol. I know we are working with OTPs but would it make sense to call the api via https? Maybe I am a little bit to paranoid

If you are interested in I could translate it into the german language. Feel free to contact me.

@Bill: As I undestood the plugin adds the OTP so you have a two-factor authentication. The OTP alone will not work.

/Jens

Statistics: Posted by JensK — Mon Mar 02, 2009 10:11 pm

Re: Yubikey plugin for Wordpress

2009-01-09T20:23:37+01:00

Hi Henrik,

OK so I've gotten my yubikey, installed the plug-in, configured the options, and user.
One question I have... Shouldn't the user by able to login without having to enter userid and password.
It kind of makes not point if I can login with those credentials and supersede the yubikey.

Perhaps I'm missing something.
Thanks in advance,

Bill

Statistics: Posted by billheese — Fri Jan 09, 2009 8:23 pm

Re: Yubikey plugin for Wordpress

2008-06-30T21:13:08+01:00

Looks very interesting. I will certainly try to look a bit into this code and try to use it in a future WordPress-installations.

Statistics: Posted by VoxPelli — Mon Jun 30, 2008 9:13 pm

Re: Yubikey plugin for Wordpress

2008-06-30T19:44:12+01:00

Simon wrote:

I solved the problem: My server still uses php4, so it doesn't have the 'hash' requirement. I modified the following line:

Code:

   $hmac = base64_encode(hash_hmac('sha1',$datastring,base64_decode($yubico_api_key), TRUE));

into:

Code:

   $hmac = base64_encode(mhash(MHASH_SHA1,$datastring,base64_decode($yubico_api_key)));

So that it uses mhash instead of the newer hash interface. Then it worked fine. Great! Now 'blog.josefsson.org' is a user of the yubikey/wordpress-plugin!

I would suggest that the code checks for hash+curl libraries earlier, is it possible to do this using a 'require' or similar?

I'm still curious whether it is possible to disable password authentication.

/Simon

Happy You figured out the hash problem, I must admit I didn't think about testing against PHP4 as it is very very close to end of life.

I have been looking into ways of testing for Curl & Hash lib presence, but there isn't any really nice way to do it in Wordpress, you can't prevent the plugin from being installed or anything like that.
How about a solution where the plugin gets installed but the loginpage tells that the functionality has been disabled due to missing libs ?

I'm not sure there is a hook that makes it possible to disable password auth. But I'll look into it

/Henrik Schack

Statistics: Posted by Henrik.Schack — Mon Jun 30, 2008 7:44 pm

Re: Yubikey plugin for Wordpress

2008-06-30T16:15:34+01:00

I solved the problem: My server still uses php4, so it doesn't have the 'hash' requirement. I modified the following line:

Code:

   $hmac = base64_encode(hash_hmac('sha1',$datastring,base64_decode($yubico_api_key), TRUE));

into:

Code:

   $hmac = base64_encode(mhash(MHASH_SHA1,$datastring,base64_decode($yubico_api_key)));

Statistics: Posted by Simon — Mon Jun 30, 2008 4:15 pm

Re: Yubikey plugin for Wordpress

2008-06-30T15:56:33+01:00

Very neat! The code looks really clean and high quality too. Thanks, Henrik!

Since my own personal blog (blog.josefsson.org) uses wordpress, I'd like to use it... but when I enable it, I just get

Code:

ERROR: Incorrect password.

. The password is correct. Any ideas? Where are things logged anyway?

Using a packet sniffer, I can see that the request to/from api.yubico.com works fine, and comes back with an OK, so I believe the client key id/key is correct. I've tried setting the yubikey id both pasting in an entire OTP and cut'n'paste'ing in the first 12 characters only, but no difference.

Any ideas?

Is it possible to disable password authentication, and just use yubikey authentication?

/Simon

Statistics: Posted by Simon — Mon Jun 30, 2008 3:56 pm

Re: Yubikey plugin for Wordpress

2008-06-25T17:58:54+01:00

I second that - awesome work!

I've just setup the plugin on a wordpress 2.5.1 under debian testing.

Initially i got this error when signing in with the plugin active

Quote:

Call to undefined function: curl_init()

when signing in as php support for curl was not installed on my box

Quote:

apt-get install php5-curl
/etc/init.d/apache2 restart

cured that. many thanks,

Dave.

Statistics: Posted by wavey — Wed Jun 25, 2008 5:58 pm

Re: Yubikey plugin for Wordpress

2008-06-25T17:06:11+01:00

Thank you!

Works like a charm! Great bit of sample code too!

Statistics: Posted by WouterduToit — Wed Jun 25, 2008 5:06 pm

Re: Yubikey plugin for Wordpress

2008-06-25T13:19:47+01:00

WouterduToit wrote:

Hi henrik,

The url to the plugin on your blog is not working, please could you provide me with the correct url?

Thanks in advance,
Wouter

Ooops, sorry a typo, I've fixed it now

Statistics: Posted by Henrik.Schack — Wed Jun 25, 2008 1:19 pm

Re: Yubikey plugin for Wordpress

2008-06-25T13:10:31+01:00

Hi henrik,

The url to the plugin on your blog is not working, please could you provide me with the correct url?

Thanks in advance,
Wouter

Statistics: Posted by WouterduToit — Wed Jun 25, 2008 1:10 pm

Re: Yubikey plugin for Wordpress

2008-06-25T13:03:03+01:00

Awesome stuff!

Thanks Henrik!

Statistics: Posted by WouterduToit — Wed Jun 25, 2008 1:03 pm