Yubico Forum

Re: Mac logon: PAM vs PIV?

2017-09-11T10:16:50+01:00

interestingly, Richard Purves recommends (see reference in my previous post) using BOTH PIV and PAM logon at the same time. In my understanding PAM is something stronger, because 1) it's based on challenge-response, so an adversary won't be able to mount a replay attack, 2) you can require presenting your key with PAM, while with PIV both username/pwd and Yubikey/PIN will log you on.

So what are the benefits of invoking PIV in addition to PAM? any ideas? thanks!

Statistics: Posted by owl — Mon Sep 11, 2017 10:16 am

Re: Mac logon: PAM vs PIV?

2017-07-15T15:53:53+01:00

Good stuff on the topic:
http://www.richard-purves.com/2017/02/1 ... v-and-pam/

Statistics: Posted by owl — Sat Jul 15, 2017 3:53 pm

Re: Mac logon: PAM vs PIV?

2016-10-11T13:11:20+01:00

Thank you for that information.

Statistics: Posted by Greybeard — Tue Oct 11, 2016 1:11 pm

Re: Mac logon: PAM vs PIV?

2016-10-03T21:07:51+01:00

Yes, multiple YubiKeys can be added to the same account via PIV. Just go through the same setup procedure (start to finish).

Statistics: Posted by ChrisHalos — Mon Oct 03, 2016 9:07 pm

Re: Mac logon: PAM vs PIV?

2016-10-03T16:14:14+01:00

I can't speak directly to the security, but from an ease of use I much prefer the PAM. I converted to the smartcard method once Sierra was released, and now it successfully unlocks when I enter my pin from screensaver lock, but I am now frequently asked to provide my password to unlock my Local Items keychain for applications. When I was using the PAM method, this did not occur.

Secondarily, I have not found documentation as to whether I can enroll multiple Yubikeys as smartcards for my account. I have two for my work machine (one 4, one 4 Nano), and in PAM mode, I had them both enrolled in case one was lost or left at home, etc. This latter question is what brought me here today, but I don't see any posts on point.

Best of luck

Statistics: Posted by Greybeard — Mon Oct 03, 2016 4:14 pm

Mac logon: PAM vs PIV?

2016-09-24T19:46:15+01:00

Hello!

it is announced on Yubico website that starting from Sierra macOS supports logon with smartcards. That said, it becomes possible to logon to macOS using Yubikey's PIV module, not only PAM. But which one is better from security perspective? Shall one prefer new PIV-enabled way or stick to old PAM?

Thanks!

Statistics: Posted by owl — Sat Sep 24, 2016 7:46 pm