Re: sudo command in OS X authorizes without key

2016-01-15T23:56:23+01:00

Sudo has it's own pam configuration module. I have pam_yubico configured in the following locations:

Code:

$ grep yubi /etc/pam.d/*
/etc/pam.d/authorization:auth       required       pam_yubico.so mode=challenge-response
/etc/pam.d/screensaver:auth       required       pam_yubico.so mode=challenge-response
/etc/pam.d/sudo:auth       required       pam_yubico.so mode=challenge-response

This covers logins (not filevault), screensaver and sudo.

Statistics: Posted by bmorgenthaler — Fri Jan 15, 2016 11:56 pm

sudo command in OS X authorizes without key

2016-01-07T22:28:42+01:00

I have just configured my OS X El Capitan for 2 factor authentication. It works for logins and authenticating features that require to unlock the lock icon in system settings. What i did notice tho is that the sudo command authenticates without the yubikey in the usb port. Is there a special setting for this? Isn't adding yubico_pam.so in /etc/pam.d/authorization supposed to protect all authorization in OS X?

Statistics: Posted by ZIm — Thu Jan 07, 2016 10:28 pm

Yubico Forum

Re: sudo command in OS X authorizes without key

sudo command in OS X authorizes without key