samir wrote:
Yubico PAM module does not currently support selective two or single factor authentication based on specific user IDs (only two factor authentication is supported for all users). Supporting this functionality is currently on Yubico's roadmap.
However, if you can make some simple changes to the Yubico PAM module then it would be possible to use the same Yubico PAM module to authenticate selective users based on Yubikey bindings i.e. if a user has YubiKey assigned, then it would require 2 factor auth. otherwise only user name and password will be sufficient to authenticate.
The changes are needed to be made in the logic where the Yubico PAM module looks for the YubiKey ID and Username binding. If no YubiKey ID and Username binding found for a user, then the Yubico PAM module should skip all checks and send the success signal to the underlying PAM modules.
We hope this helps!
Hi there,
Based on your suggestion I've created a patch for pam_yubico.c
Changelog
- Added a check_user_in_auth_file function which is just check_user_token but with only the username checking, no token checking. This is called near the beginning of pam_sm_authenticate.
- Moved user auth file path code from authorize_user_token to a new function get_userfile. This was so I could reuse it in check_user_in_auth_file.
New code in pam_sm_authenticate
Code:
if (check_user_in_auth_file(cfg.auth_file, user) == 0)
{
DBG (("user not in auth file: %s", user));
/* If user is not in auth file, skip all checks
and send the success signal to the underlying PAM modules.
Authentication will continue using the underlying PAM modules. */
retval = PAM_SUCCESS;
goto done;
}
New functions in pam_yubico
Code:
/*
* This function will return the file path to the authorized_yubikeys file in the
* users home dir.
*/
static char*
get_userfile(const char *username)
{
struct passwd *p;
char *userfile = NULL;
p = getpwnam(username);
if (p)
{
userfile = malloc((p->pw_dir ? strlen(p->pw_dir) : 0) + strlen(USERFILE)
+ 1);
if (!userfile)
return NULL;
strcpy(userfile, p->pw_dir);
strcat(userfile, USERFILE);
}
return userfile;
}
/*
* This function will check if a users name is present in the auth file. It
* will return 0 for no and 1 for yes.
*/
static int
check_user_in_auth_file(const char *authfile, const char *username)
{
char buf[1024];
char *s_user;
int retval = 0;
FILE *opwfile;
if (!authfile)
{
/* Getting file from user home directory
..... i.e. ~/.yubico/authorized_yubikeys
*/
authfile = get_userfile(username);
}
opwfile = fopen(authfile, "r");
if (opwfile == NULL)
{
D(("Cannot open file: %s", authfile));
return retval;
}
while (fgets(buf, 1024, opwfile))
{
if (buf[strlen(buf) - 1] == '\n')
buf[strlen(buf) - 1] = '\0';
D(("Authorization line: %s", buf));
s_user = strtok(buf, ":");
if (s_user && strcmp(username, s_user) == 0)
{
D(("Matched user: %s", s_user));
fclose(opwfile);
return 1;
}
}
fclose(opwfile);
return 0;
}
I've tested this with the /etc/ authfile and it works as expected, though I've not tested with the user auth file - as far as I can see though the code should work for that.
Patch against latest version in the pam_yubico SVN is attached in a tar.gz (won't let me attach txt files, disallowed in phpBB config).Statistics: Posted by gsreynolds — Tue Nov 16, 2010 1:40 pm
]]>
