Yubico Forum

YubiRADIUS • [Community] - Forum going read only. New KDB on its way.

2018-01-30T09:26:55+01:00

For the security and experience of our user community, we have decided to set the forum as read-only and wipe all user account information. All historical posts and announcements will be archived and remain publicly searchable.

In 2018, we will be publishing a searchable knowledge-base system that allows the community to provide direct feedback on articles and make suggestions that will be reviewed by Yubico staff. We sincerely appreciate the participation of our user forum over the years and hope to continue serving your for years to come.

Statistics: Posted by Tom2 — Tue Jan 30, 2018 9:26 am

YubiRADIUS • [HELP] - YubiKey not working in Windows (Multiple Version)

2015-10-08T08:23:19+01:00

We have 4 options here, try them in order

(1) Uninstall ALL entries in Device Manager for the NEO.

*If you have U2F enabled, you should see Human Interface Devices > HID-compliant device.
*If you have OTP enabled, you should see Keyboards > HID Keyboard Device.
*If you have CCID enabled, you should see Smart card readers > Microsoft Usbccid Smartcard Reader (WUDF), and Smart cards > Identity Device (NIST SP 800-73 [PIV]).

After all are removed, either "Scan new hardware" or remove the NEO and re-insert.

(2) Uninstall all entries under Universal Serial Bus controllers, and then restart. These will typically be reloaded when you restart.

(3) Use the Intel Driver Update Utility (assuming you are Intel-based), and restart after all drivers are updated. Alternatively, you can download the USB and Chipset drivers from your manufacturer's support website and install.

(4) On Windows 10 if on build 10.0.10240 updating to Windows 10 1511 build 10.0.10586 corrected the issue. You can simply open a cmd prompt and view the system build number at top.

(5) Re-install Windows.

WINDOWS 10
Win 10 - YK4.PNG

NEO
1.PNG

EDGE
2.PNG

Statistics: Posted by Tom2 — Thu Oct 08, 2015 8:23 am

YubiRADIUS • Re: [QUESTION] Hardening YubiRADIUS, what services can be of

2015-01-09T04:49:08+01:00

As YubiRADIUS is no longer being maintained, you should check out GreenRADIUS – Yubico Edition. GreenRADIUS is built from YubiRADIUS by the original developers, but is being carried forward by Green Rocket Security, a Yubico partner. It is kept current with the latest updates, taking care of issues such as Heartbleed, Shellshock, and POODLE.

In addition, the server has been hardened specifically to remove unneeded services out of the box so you don’t need to. Services such as cups for printing, Samba for Windows file sharing, and NFS tools for accessing NFS shares are not included in the VM.

Check out the GreenRADIUS hardening page to see how the server is hardened out of the box, and check out the latest security updates to the server here.

Statistics: Posted by GRS — Fri Jan 09, 2015 4:49 am

YubiRADIUS • Shellshock Vulnerability Update

2014-10-01T16:12:42+01:00

Recently, a vulnerability was discovered in the shell program Bash which could allow a remote attacker to execute any code he likes on the remote server. It has a CVSS severity of 10 on a scale from 1 to 10, so it is very serious. A vulnerable version of Bash is included with YubiRADIUS.

The problem is described in this link from NIST and references CVE-2014-6271 - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-6271. This link also contains links to external sites where you can manually download and apply patches to fix the vulnerability in the OS used in YubiRADIUS.

However, you can also upgrade to GreenRADIUS - Yubico Edition, the next generation of YubiRADIUS. GreenRADIUS -Yubico Edition is a fully maintained open source RADIUS server built by the same team that developed YubiRADIUS. Due to severity of the latest vulnerabilities, Green Rocket Security, a Yubico partner, is offering a free upgrade to GreenRADIUS - Yubico Edition, which has the Shellshock fixes applied and tested, a hardened virtual appliance, and many more fixes (e.g. for the serious Heartbleed SSL vulnerability). Find out more about GreenRADIUS - Yubico Edition here.

Statistics: Posted by GRS — Wed Oct 01, 2014 4:12 pm

YubiRADIUS • Re: Opensource Yubiradius alternatives

2014-09-12T04:53:50+01:00

If you are looking for a YubiRADIUS alternative or replacement, give GreenRADIUS a try. (As of November 2013, Yubico has ceased developing and supporting YubiRADIUS.) All of the same features YubiRADIUS employed are included in GreenRADIUS with additional enhancements such as:

- Hardening
- Two-factor authentication for the administrator login
- Updated Ubuntu OS

GreenRADIUS is the next generation of YubiRADIUS and was developed by the same team that is now a part of Green Rocket Security, a Yubico enterprise partner. GreenRADIUS is fully supported, will be kept current, and has a roadmap for further enhancements.

See the comparison summary file detailing the key differences between GreenRADIUS and YubiRADIUS.

Statistics: Posted by GRS — Fri Sep 12, 2014 4:53 am

YubiRADIUS • Re: Opensource Yubiradius alternatives

2014-08-28T16:46:46+01:00

I have some great news. LinOTP open sourced all of their software components back in May with release 2.7. You can now use AD as your user database and there's no limit to the number of tokens created. The challenge you will now face is actually building a server. The open source version of LinOTP requires you to setup freeradius and LinOTP manually. I went through the setup this week and found a few gaps in the documentation, but ultimately got the two services talking to each other.

At the end of last year I was demoing the Enterprise Edition of LinOTP to see what it would take to get migrated off YubiRadius. During the time of my demo LSE added support for YubiCo's authentication algorithm, importing keys from the Personalization tool, and allowing auto assignments of YubiKeys. LSE was also able to add a feature request from me which populated the description field of the token view to list the key's public ID (similar to how YubiRadius lists keys). That helped me keep track of what keys were assigned to users.

Between demoing the Enterprise Edition last year and being able to build my own open source edition this week, I feel more confident in moving off of YubiRadius. With LinOTP I automatically gain support for other two-factor tokens, including time based OATH tokens like Google Authenticator. I'm looking at Google Authenticator as a method for allowing users to connect their phones & tablets to VPN. When Yubico ended support for YubiRadius they also stopped development on the YubiApp IOS/Android applications. IOS7 broke the app last year and YubiCo never officially released the Android version in the Play store. Now I think I can finally provide an alternative.

Statistics: Posted by agizmo — Thu Aug 28, 2014 4:46 pm

YubiRADIUS • Re: Imprting Yubikey to yrva

2014-07-27T15:11:23+01:00

solved it.
the correct link for importing yubikeys to yrva is :
http://www.google.co.il/url?url=http://www.yubico.com/wp-content/uploads/2013/04/Uploading-YubiKeys-to-YubiRADIUS.pdf&rct=j&frm=1&q=&esrc=s&sa=U&ei=rQfVU__oGcKn0QWzooCQCw&ved=0CCUQFjAD&usg=AFQjCNF14RiLq6MOsU_m834WOZZzjQ7Scg

Statistics: Posted by cohena — Sun Jul 27, 2014 3:11 pm

YubiRADIUS • Re: Imprting Yubikey to yrva

2014-07-20T06:36:01+01:00

Tom wrote:

Dear Cohena,

YubiRadius is a discontinued project. You may want to checkout YubiX

https://github.com/Yubico/yubix

http://www.yubico.com/2013/11/yubix-ref ... are-stack/

Thanks for your help.

Is there any howto/step by step guide for configuring the YubiX like the YubiRadius Pdf?

Statistics: Posted by cohena — Sun Jul 20, 2014 6:36 am

YubiRADIUS • Re: Imprting Yubikey to yrva

2014-07-18T07:53:07+01:00

Dear Cohena,

YubiRadius is a discontinued project. You may want to checkout YubiX

https://github.com/Yubico/yubix

http://www.yubico.com/2013/11/yubix-ref ... are-stack/

Statistics: Posted by Tom — Fri Jul 18, 2014 7:53 am

YubiRADIUS • [SOLVED] - Imprting Yubikey to yrva

2014-07-27T15:12:49+01:00

Hi,

I am trying to install Yrva in order to add otp phase to vpn access to our lan using Softether vpn server.
After installing Softether and being able to login to our lan from remte computer,
I have installed the Yrva on the same machine.

My os is win2008 r2 64 bit.

I followed the instructions as described on the YubiRADIUS_Virtual_Appliance_3_6_0.pdf and everything went ok.

After importing the yubikey to the Yrva(with csv file that was created using the Yubikey personlization tool) i get Yubikey imported successfully, but i cant see any yubikey on the "list yubikeys".

When i trying to validate otp on the "troubleshot" page i get "authntication failed NO_VALID_ANSWER",
What went wrong?

Is there any documantation of using Yubikey with softether on Windows server os?

Thanks in advance....[*]

Statistics: Posted by cohena — Thu Jul 17, 2014 1:22 pm

YubiRADIUS • Re: Number of Users Displayed per Page

2014-06-11T08:37:02+01:00

Dear StefanR

YubiRadius is a discontinued project. You may want to checkout YubiX

https://github.com/Yubico/yubix

http://www.yubico.com/2013/11/yubix-ref ... are-stack/

Statistics: Posted by Tom — Wed Jun 11, 2014 8:37 am

YubiRADIUS • Re: After "Users Import", some groups are missing

2014-06-11T08:36:04+01:00

Dear StefanR

YubiRadius is a discontinued project. You may want to checkout YubiX

https://github.com/Yubico/yubix

http://www.yubico.com/2013/11/yubix-ref ... are-stack/

Statistics: Posted by Tom — Wed Jun 11, 2014 8:36 am

YubiRADIUS • Number of Users Displayed per Page

2014-06-06T14:09:47+01:00

Hey,

I didn`t find any way that far to change the number of users/groups, that are displayed per page.

15 users per page is way too less for me, so bigger changes need to be done several times, for many, many pages...

Cheers

Statistics: Posted by StefanR — Fri Jun 06, 2014 2:09 pm

YubiRADIUS • After "Users Import", some groups are missing

2014-06-06T13:55:16+01:00

Dear Yubico tech community,

I am just starting with the YubiRadius, the first users can already authenticate, but there is still an issue:

The users were imported successfully, using e.g. following filter:
(|(memberOf=cn=SEC-GL-ABC-VPN,ou=SecurityGroups,ou=SEC,dc=example,dc=com)(memberOf=cn=SEC-GL-VWX-VPN,ou=SecurityGroups,ou=SEC,dc=example,dc=com))

So I can see the users, when I click on "Users/Groups".
When I click on "Groups" there are a bunch of groups, so I want to change the priority to allow passing the right fgroup informastion to the Cisco ASA.
The group "SEC-GL-ABC-VPN" is showing up, so I can increate the priority to a higher value than 0, but "SEC-GL-VWX-VPN" is not showing up.

I thought importing users out of a group will automatically list the group there?!

Additional information:
- there are 374 groups listed (perhaps a limit?)
- some groups are displaying multiple times (like e.g. "SecurityGroups"), is this normal?

Thank you!

Statistics: Posted by StefanR — Fri Jun 06, 2014 1:55 pm

YubiRADIUS • Re: Key assignment not listed in user list, unable to unassi

2014-04-27T19:52:00+01:00

Hi there,

I got the same Problem, which you reported (Changelog says, that this was fixed with verison 3.6.1 btw).
I got only one solution for that problem:

My usernames in AD were with upper and lower case characters.
For example: User

If i imported those users and assigned a Yubikey to the, the assigned Yubikey was not shown and I couldn't unassign it.
After changing all usernames to lowercase characters, for example "user", I can see the Yubikeys correctly and also unassign them.

That's the only solution I can see atm.

Statistics: Posted by Ibeme — Sun Apr 27, 2014 7:52 pm