Yubico Forum

Re: Offline PAM for the Yubikey

2011-04-18T18:35:51+01:00

Has there been any progress on getting this integrated into the pam_yubico package?

I also noticed that the packages available from securixlive.com haven't been updated in months (years for the stable version). I am going to install the beta version in a moment.

I am using Fedora 14. Is there any way I can help merge these projects?

Thanks!

Statistics: Posted by MasonAJR — Mon Apr 18, 2011 6:35 pm

Re: Offline PAM for the Yubikey

2011-02-12T22:25:16+01:00

I downloaded a copy of YubiPAM 1.1 beta 1 from the securixlive.com site on Jan. 26.

Statistics: Posted by craig0927 — Sat Feb 12, 2011 10:25 pm

Re: Offline PAM for the Yubikey

2011-02-07T13:44:11+01:00

Hello! First post here!

Has anybody by chance downloaded the most recent stable version of this offline PAM
module as a tar file?

It seems, that http://www.securixlive.com/ is down, and I would love to try out this module.

Statistics: Posted by außerirdischegesund — Mon Feb 07, 2011 1:44 pm

Re: Offline PAM for the Yubikey

2010-02-04T00:56:44+01:00

I got yubipam 1.0.4 working with selinux in F12 but had to follow some different steps to the ones I found here:

http://blog.rootshell.be/2009/03/27/yub ... -on-linux/

To give /etc/yubikey write permission from the login process I had to rebuild with:

./configure --with-authdb=/var/lib/gdm/yubikey

Then I made sure yubikey had # ls -Z /var/lib/gdm/yubikey
-rw-rw-r--. root yubiauth system_u:object_r:xdm_var_lib_t:s0 /var/lib/gdm/yubikey

Otherwise, I could not login because the yk_chkpwd could not write to /etc/yubikey (this is with SELINUX=enforcing)

One unexpected hitch, I am able to log in with the yubikey, but as soon as I'm in I'm prompted for my password to unlock the gnome keyring Apart from that, it's neat.

Statistics: Posted by Cam — Thu Feb 04, 2010 12:56 am

Re: Offline PAM for the Yubikey

2009-07-08T17:21:32+01:00

Hi,

i really like the offline pam module. after some problems i got it working.

the only thing i want to ask is, is there a way via pam or this module directly to create a two way authorisation?
i simple want enter an password and then press the yubikey.

thanks

phil

Statistics: Posted by smurfy — Wed Jul 08, 2009 5:21 pm

Re: Offline PAM for the Yubikey

2009-04-01T04:36:56+01:00

gorkab,

sorry for the delayed response, but yes, yubipam works just fine for me under Lenny. Granted, i had built it (and packaged it) under etch, so that might be the difference...?

gorkab wrote:

Does anyone have the offline pam module working under Debian Lenny or Ubuntu Ibex (Lenny Based)?

I'm getting the a cascading auth issue when using multiple "required" pam modules.

Statistics: Posted by rpimonitrbtch — Wed Apr 01, 2009 4:36 am

Re: Offline PAM for the Yubikey

2009-03-13T14:56:37+01:00

lintweaker wrote:

I just got my keys and am trying to get offline pam working.

Whenever I try to login with the correct key I get:

Code:

Mar 13 13:11:48 paragon yk_chkpwd[13893]: password check failed for user (kramer)
Mar 13 13:11:48 paragon unix_chkpwd[13895]: password check failed for user (kramer)
Mar 13 13:11:48 paragon login: pam_unix(login:auth): authentication failure; logname=LOGIN uid=0 euid=0 tty=tty2 ruser= rhost=  user=kramer
Mar 13 13:11:50 paragon login: FAILED LOGIN 1 FROM (null) FOR kramer, Authentication failure

ykvalidate works as it should (although only under root):
ykvalidate --user kramer [optremoved]
OTP is VALID.

This is with Fedora 10 x86_64. Any hints on how to investigate this further?

I've rebuild the libaries with debugging enabled. The log files show:

Code:

[pam_yubikey.c:get_response(206)] conv returned: [snipped]
[pam_yubikey.c:_yubi_run_helper_binary(259)] called.
[yk_chkpwd.c:_yubi_verify_password(255)] Recived OTP: [snipped]
[yk_chkpwd.c:_yubi_verify_password(263)] Parsing OTP
[yk_chkpwd.c:_yubi_verify_password(279)] couldn't access database: /etc/yubikey
[pam_yubikey.c:_yubi_run_helper_binary(375)] returning 9

So somehow /etc/yubikey cannot be read. As this is on a Fedora machine with selinux enabled I had to change to /etc/yubikey context as well. I 'stole' the context from another file in /etc:

Code:

chcon -v --reference=/etc/wvdial.conf yubikey

I am not sure that's correct but I no longer get selinux messages. Unfortunately the problem persists, even after giving everybody read rights on the /etc/yubikey file. Clueless

OK, again replying to my on message.
Default the file /etc/yubikey has the following permission:
-rw-r--r-- root root
Checking the ykdbDatabaseOpen function in yubikey_db.c shows:

Code:

/* open the db */
   handle->file_descriptor = open(path, O_RDWR);
   if (handle->file_descriptor == -1)
   {
      free(handle);

      YKDB_ERROR(YKDB_ERR_IO);
      return NULL;

that the database will be opened with Read Write permissions (is that really necessary here?).
Changing the permissions on /etc/yubikey gets rid of the 'could not access database error':

Code:

[ykvalidate.c:_yubi_run_helper_binary(275)] called.
[yk_chkpwd.c:_yubi_verify_password(255)] Recived OTP: [snipped]
[yk_chkpwd.c:_yubi_verify_password(263)] Parsing OTP
[ykvalidate.c:_yubi_run_helper_binary(388)] returning 0

I am not sure this is the right way forward.

Statistics: Posted by lintweaker — Fri Mar 13, 2009 2:56 pm

Re: Offline PAM for the Yubikey

2009-03-13T14:40:22+01:00

lintweaker wrote:

I just got my keys and am trying to get offline pam working.

Whenever I try to login with the correct key I get:

Code:

Mar 13 13:11:48 paragon yk_chkpwd[13893]: password check failed for user (kramer)
Mar 13 13:11:48 paragon unix_chkpwd[13895]: password check failed for user (kramer)
Mar 13 13:11:48 paragon login: pam_unix(login:auth): authentication failure; logname=LOGIN uid=0 euid=0 tty=tty2 ruser= rhost=  user=kramer
Mar 13 13:11:50 paragon login: FAILED LOGIN 1 FROM (null) FOR kramer, Authentication failure

ykvalidate works as it should (although only under root):
ykvalidate --user kramer [optremoved]
OTP is VALID.

This is with Fedora 10 x86_64. Any hints on how to investigate this further?

I've rebuild the libaries with debugging enabled. The log files show:

Code:

[pam_yubikey.c:get_response(206)] conv returned: [snipped]
[pam_yubikey.c:_yubi_run_helper_binary(259)] called.
[yk_chkpwd.c:_yubi_verify_password(255)] Recived OTP: [snipped]
[yk_chkpwd.c:_yubi_verify_password(263)] Parsing OTP
[yk_chkpwd.c:_yubi_verify_password(279)] couldn't access database: /etc/yubikey
[pam_yubikey.c:_yubi_run_helper_binary(375)] returning 9

So somehow /etc/yubikey cannot be read. As this is on a Fedora machine with selinux enabled I had to change to /etc/yubikey context as well. I 'stole' the context from another file in /etc:

Code:

chcon -v --reference=/etc/wvdial.conf yubikey

I am not sure that's correct but I no longer get selinux messages. Unfortunately the problem persists, even after giving everybody read rights on the /etc/yubikey file. Clueless

Statistics: Posted by lintweaker — Fri Mar 13, 2009 2:40 pm

Re: Offline PAM for the Yubikey

2009-03-13T13:16:12+01:00

I just got my keys and am trying to get offline pam working.

Whenever I try to login with the correct key I get:

Code:

Mar 13 13:11:48 paragon yk_chkpwd[13893]: password check failed for user (kramer)
Mar 13 13:11:48 paragon unix_chkpwd[13895]: password check failed for user (kramer)
Mar 13 13:11:48 paragon login: pam_unix(login:auth): authentication failure; logname=LOGIN uid=0 euid=0 tty=tty2 ruser= rhost=  user=kramer
Mar 13 13:11:50 paragon login: FAILED LOGIN 1 FROM (null) FOR kramer, Authentication failure

ykvalidate works as it should (although only under root):
ykvalidate --user kramer [optremoved]
OTP is VALID.

This is with Fedora 10 x86_64. Any hints on how to investigate this further?

BTW I noticed that make install put the pam_yubikey.* in /lib/security instead of /lib64/security.

Statistics: Posted by lintweaker — Fri Mar 13, 2009 1:16 pm

Re: Offline PAM for the Yubikey

2009-02-17T21:51:39+01:00

Does anyone have the offline pam module working under Debian Lenny or Ubuntu Ibex (Lenny Based)?

I'm getting the a cascading auth issue when using multiple "required" pam modules.

session:

Code:

$ ssh root@x.x.x.x
gorkab@x.x.x.x's password:
Permission denied, please try again.
gorkab@x.x.x.x's password:

debug log:

Code:

[pam_yubikey.c:pam_sm_authenticate(104)] called.
[pam_yubikey.c:pam_sm_authenticate(105)] flags 1 argc 0
[pam_yubikey.c:pam_sm_authenticate(112)] verbose=0
[pam_yubikey.c:pam_sm_authenticate(122)] get user returned: gorkab
[pam_yubikey.c:get_response(206)] conv returned: <>
[pam_yubikey.c:_yubi_run_helper_binary(259)] called.
[yk_chkpwd.c:_yubi_verify_password(255)] Recived OTP: <>
[yk_chkpwd.c:_yubi_verify_password(263)] Parsing OTP
[yk_chkpwd.c:_yubi_verify_password(268)] public_uid has no length, OTP is invalid
[pam_yubikey.c:_yubi_run_helper_binary(375)] returning 8

i thoguht it might go away as lenny got older, but it didn't.

Statistics: Posted by gorkab — Tue Feb 17, 2009 9:51 pm

Re: Offline PAM for the Yubikey

2009-02-14T18:14:19+01:00

That did the trick!

Statistics: Posted by BIgV — Sat Feb 14, 2009 6:14 pm

Re: Offline PAM for the Yubikey

2009-02-13T07:54:13+01:00

I take it you're unable to login from this point, however I use it for all services and not just gdm, or screensaver. I did this by placing

Code:

auth sufficient pam_yubikey.so

in /etc/pam.d/common-auth

Statistics: Posted by firnsy — Fri Feb 13, 2009 7:54 am

Re: Offline PAM for the Yubikey

2009-02-12T18:17:48+01:00

I found the package for 1.0.4.

I installed the setup for kicking in the screensaver when unplugged and that worked fine. I just changed my /etc/pam.d/gnome-screensaver file to read:

@include common-auth
auth optional pam_gnome_keyring.so
auth sufficient pam_yubikey.so

I then changed my /etc/pam.d/gdm to be as follows:

#%PAM-1.0
auth requisite pam_nologin.so
auth required pam_env.so readenv=1
auth required pam_env.so readenv=1 envfile=/etc/default/locale
@include common-auth
auth optional pam_gnome_keyring.so
authsufficentpam_yubikey.so
@include common-account
session required pam_limits.so
@include common-session
session optional pam_gnome_keyring.so auto_start
@include common-password

and could not login. I kept getting an invalid key.

I'm running Ubuntu 8.10. Any ideas?

Statistics: Posted by BIgV — Thu Feb 12, 2009 6:17 pm

Re: Offline PAM for the Yubikey

2009-02-12T16:27:16+01:00

The link for this project appears to be broken.

Statistics: Posted by BIgV — Thu Feb 12, 2009 4:27 pm

Re: Offline PAM for the Yubikey

2009-01-29T20:16:40+01:00

Using this for offline authentication to my laptop and loving it. I wanted to set it up to also lock my workstation when my yubikey wasn't present so I set that up. I wrote up a small how to over in another section, here's the link viewtopic.php?f=11&t=246

Statistics: Posted by bmorgenthaler — Thu Jan 29, 2009 8:16 pm