Yubico Forum

Computer Logon - Windows | Linux | MacOS | freeBSD • [Community] - Forum going read only. New KDB on its way.

2018-01-30T09:26:55+01:00

For the security and experience of our user community, we have decided to set the forum as read-only and wipe all user account information. All historical posts and announcements will be archived and remain publicly searchable.

In 2018, we will be publishing a searchable knowledge-base system that allows the community to provide direct feedback on articles and make suggestions that will be reviewed by Yubico staff. We sincerely appreciate the participation of our user forum over the years and hope to continue serving your for years to come.

Statistics: Posted by Tom2 — Tue Jan 30, 2018 9:26 am

Computer Logon - Windows | Linux | MacOS | freeBSD • [QUESTION] Keep Win10 system from crashing -- network share

2018-01-25T17:25:41+01:00

I have Yubikey 4 set up for several different users on non-domain Windows 10 systems using the Windows Logon Tool. I have a network share set up on each system for users to transfer files. They have a random, but persistent problem of the system crashing and rebooting when accessing the file share. From the logs, there is a fatal error in the lsass.exe process, requiring the system to reboot. Upon reboot, the Windows Logon Tool no longer authenticates the user with the configured Yubikey and requires reconfiguration to log in. Note that the crash does not occur when the Windows Logon Tool is disabled.

[*]Users authenticate with the Yubikey inserted into the server hosting the share (or identically configured Yubikeys inserted into both the client and server).
[*]When crashes occur, it is usually at or near the end of a file transfer.
[*]Crashes appear more likely if systems connect to each other in serial.
[*]Once crashes occur, it appears to be more likely that crashes will continue to occur.

Do you have any information on what can be done to prevent these crashes?

As an afterthought, are there group policy security settings that could be interfering with Windows Logon Tool authentication over the network and making it unstable (but mostly functional)?

Statistics: Posted by jkl — Thu Jan 25, 2018 5:25 pm

Computer Logon - Windows | Linux | MacOS | freeBSD • Re: YubiKey 4 for PIV stopped working

2018-01-23T22:02:43+01:00

JamesA wrote:

For enroll on behalf of (EOBO) you also need to set the publish and enroll in the "Enrollment Agent" template as covered in the Smart Card Deployment Guide.

Regarding your issue with self-enrollment, please open a support ticket for further troubleshooting. https://www.yubico.com/support/get-support/

The Enrollment Agent template was also published. I was able to pull the cert and get almost all the way through enrollment before it failed due to policy.

Today I extinguished all doubt by troubleshooting the entire PKI stack with this guide:
https://blogs.technet.microsoft.com/ask ... e-snap-in/

I ran RSOP.msc to see if there were any conflicts with GPOs but everything was configured the way I expected.
I was still getting the 'blocked by computer policy' error so I disabled all of my computer GPOs and self enrollment worked. By turning things back on one at a time I determined that my Yubikey GPO was to blame. I believe it's one or both of my registry edits:

BlockPUKOnMGMUpgrade
or
NewKeyTouchPolicy

What I'm working backwards to understand is how the YubiKeys were getting the certificate installed in 9a -only with the PIV Manager- but weren't able to authenticate.

Statistics: Posted by RadiatorMints — Tue Jan 23, 2018 10:02 pm

Computer Logon - Windows | Linux | MacOS | freeBSD • Re: YubiKey 4 for PIV stopped working

2018-01-23T21:47:21+01:00

Statistics: Posted by JamesA — Tue Jan 23, 2018 9:47 pm

Computer Logon - Windows | Linux | MacOS | freeBSD • Re: YubiKey 4 for PIV stopped working

2018-01-22T20:20:54+01:00

Found rev B which has auto-enrollment stuff in it.
https://www.yubico.com/wp-content/uploa ... 7_RevB.pdf
Actions taken today (1/22/2018):
Revoked all previous user certs except the one that works.
Reissued the root domain cert and verified through cert chains that it is being used.
Pushed all the auto-enrollment config via GPO and found it in the system tray. (Fails with a message about "Prohibited by Computer Policy" weather it's launched from the tray or certmgr)
Added a brand new PC to the domain and logged in via the one working YubiKey 4 on the first boot with no configuration other than previously configured GPOs.

EDIT: per the documentation under the Cryptography tab:
Provider Category is now Key Storage Provider
Algo is RSA, length is default: 2048
Provider is Microsoft Smart Card Key Storage Provider

What am I missing?

Statistics: Posted by RadiatorMints — Mon Jan 22, 2018 8:20 pm

Computer Logon - Windows | Linux | MacOS | freeBSD • YubiKey 4 for PIV stopped working

2018-01-22T20:55:53+01:00

Earlier this month I purchased one YubiKey 4 for a proof of concept for OTP login using a 3rd party solution. In the interest of compatibility and simplicity we chose to back down to PIV. I followed the deployment instructions and in a matter of nearly no time my YubiKey 4 was doing PIV smartcard login on domain computers.

So I purchased the rest of the YubiKeys I needed for my users, implemented the Enroll on behalf of CA Template and that's when everything went completely sideways. Enroll on behalf of didn't seem to work at all, the template couldn't find the signature > no certificate on the YubiKey > cert enrollment failure on the CA. So I'm back to user self enrollment and I can get a certificate on a YubiKey. The PIV manager recognizes it, it's published in the Certificate Authority but any time I try to use it for login the endpoint says that "No valid certificates were found on this smart card."

My original YubiKey and cert still works flawlessly. Changing out YubiKeys yields the same results (failure). I changed the name of the original template and recreated a new one from scratch with the following settings:

General
Validity period is 2 years
Cert is published in AD
Compatibility
CA is Server 2016
Recipient is Windows 7
Request handling
Signature and encryption
Include symmetric algorithms allowed by the subject
Prompt user during enrollment
Cryptography
Note: italicized text refers to a configuration that has since been changed
Key Storage Provider
RSA
Key Size 2048
Requests must use Microsoft Smart Card Key Storage Provider

Legacy Cryptographic Service Provider
Algo determined by CSP
Requests must use Microsoft Enhanced Cryptographic Provider v1.0

Security
Authenticated users may read and enroll
Admins can read, write, and enroll

I'm happy to answer any questions (within the realm of reason).

Update: I replicated those template settings with a new, longer, unique name, made sure it was published to the CA and waited the 20 minutes. It still isn't working.

Statistics: Posted by RadiatorMints — Fri Jan 19, 2018 4:51 pm

Computer Logon - Windows | Linux | MacOS | freeBSD • Re: [QUESTION] - Using Yubikey 4 in Remote Desktop Connectio

2018-01-10T10:47:04+01:00

You can use the product https://www.mysmartlogon.com/products/e ... icate.html to use a Yubikey with PIV to login to another Windows computer/server which is not in a domain. It works perfect and is easy to setup.

Statistics: Posted by merijn — Wed Jan 10, 2018 10:47 am

Computer Logon - Windows | Linux | MacOS | freeBSD • Login from Linux desktop to Windows (RDP) with Yubikey (PIV)

2018-01-09T16:17:35+01:00

I like to use my Yubikey (PIV) x509 certificate to authenticate to a windows server through RDP. I have this working with a windows client. But I need to use this on a linux client (rhel7 prefered).
I allready expiremented with xfreerdp and rdesktop, but I didn't had any success with that.

Does anybody know a tool (can also be commercial) which supports this?

Statistics: Posted by merijn — Tue Jan 09, 2018 4:17 pm

Computer Logon - Windows | Linux | MacOS | freeBSD • Re: [SOLVED] Can't unlock macOS system preference panes

2017-12-04T23:42:10+01:00

with the help of Yubicos support these steps fixed the problem:

- rolled back (unpairing and deactivation of PAM)

- setup pairing as a first step again, followed by reboot

- set up PAM again, followed by reboot

- done!

Statistics: Posted by cho — Mon Dec 04, 2017 11:42 pm

Computer Logon - Windows | Linux | MacOS | freeBSD • Re: Mac OS (high Sierra) PIV - Using PIN after Screensaver

2017-12-04T23:35:37+01:00

Hi Maxime44,

I just setup my High Sierra machine (MB Pro 13" Mid 2012, macOS 10.13.1) this weekend following Yubicos setup guide and Richard Purves instrucitons
http://www.richard-purves.com/2017/02/1 ... v-and-pam/

The first time I did everything on one go, but that cased troubles. After I did the pairing and PAM-integration step by step with reboots between these two steps everything is fine.

Best,
Christoph

Statistics: Posted by cho — Mon Dec 04, 2017 11:35 pm

Computer Logon - Windows | Linux | MacOS | freeBSD • Mac OS (high Sierra) PIV - Using PIN after Screensaver

2017-12-02T16:56:08+01:00

Hello,

I set up my Yubikey by pairing it as a PIV key with my profile.
The setup is fully functional for logging into my profile when booting my computer. As I insert the key, my profile is selected and the password field becomes a "PIN" field.

However the setup is not fully functional when I'm already logged into my profile.
1. If I turn on "display sleep", upon wake up I will have to log in again, the page shows me a blurred background image, the password field does not mention "PIN", it's only asking to log in with TouchID or password, but logging in with the Yubikey + PIN works
2. If I start the screensaver, and move the mouse I get the log in screen again but this time, no blurred background picture, only a grey background with a password prompt, but here it won't let me log in with the Yubikey + PIN, only TouchID or my regular password.

Is it a bug from Mac OS ? Or is there any setting I can fix to resolve the issue and let me log in with Yubikey + PIN every time?

Statistics: Posted by Maxime44 — Sat Dec 02, 2017 4:56 pm

Computer Logon - Windows | Linux | MacOS | freeBSD • [SOLVED] Can't unlock macOS system preference panes

2017-11-30T01:44:36+01:00

Hi members,

I just set up my Yubikey Neo for my macOS 10.13.1 machine following the descriptions in the manual and on Richard Purves page http://www.richard-purves.com/2017/02/1 ... v-and-pam/
Login after reboot, unlocking screensaver or sudo authentication in the terminal work fine, but I can not unlock system preference panes like the security & privacy pane or user & groups. It does not work when I enter my account password nor with the key inserted and the PIN.

Any hint to solve this would be great!

Cheers,
Christoph

Statistics: Posted by cho — Thu Nov 30, 2017 1:44 am

Computer Logon - Windows | Linux | MacOS | freeBSD • Re: Lock computer when removed?

2017-11-10T13:31:22+01:00

Morphlin wrote:

Well looks like it handles both, let me know if anyone of you have trouble.

I get the following errors:

"Could not instantiate Yubico's COM API, do you wish to install it now? (requires administrative rights)"

I click to install and I get:

"Invalid Argument!"

Then I get:

"Startup failed, an error has occured."
"Could not load Yubico's API!"

Please help.

Statistics: Posted by RC51ManSam — Fri Nov 10, 2017 1:31 pm

Computer Logon - Windows | Linux | MacOS | freeBSD • Re: Setting up Win10 Hello

2017-11-02T07:35:20+01:00

Okay i would have thought that hello similar to in earlier versions supports arbitrary auth providers as long as the provider does its stuff, lol

Although they imo should really support either smart card ro u2f on standalone pcs.

Statistics: Posted by My1 — Thu Nov 02, 2017 7:35 am

Computer Logon - Windows | Linux | MacOS | freeBSD • Re: Setting up Win10 Hello

2017-11-02T04:37:35+01:00

My1 wrote:

ChrisHalos wrote:

No, it uses the OATH applet, same as Yubico Authenticator.

stupid question, why doesnt it just use U2F?

That would be a question for Microsoft. I have no idea why they decided to have Windows Hello support OATH and not U2F

Statistics: Posted by ChrisHalos — Thu Nov 02, 2017 4:37 am