Yubico Forum

Re: [HOW TO] - Yubikey SSH login via PAM module

2016-02-03T05:47:22+01:00

How can i set yubikey for single user (only one user)
Other user normal login without Yubikey!
(p/s: on Linux)

Statistics: Posted by Mobilegraphy — Wed Feb 03, 2016 5:47 am

Re: [HOW TO] - Yubikey SSH login via PAM module

2014-10-27T15:23:25+01:00

Not yet, but you are welcome to submit a pull request on our github.com/yubico

Statistics: Posted by Tom — Mon Oct 27, 2014 3:23 pm

Re: [HOW TO] - Yubikey SSH login via PAM module

2014-10-24T03:13:01+01:00

Hi!

I have a linux VPS set up where I currently use my Yubikey OTP and my password to log in via SSH (thanks in no small part to the info in this guide). I just got a new NEO to check out the U2F functionality. I love how simple that is to use with my Google accounts and that I can still use the Yubico Authenticator to generate numeric codes from my NEO in a pinch. Does / will the Yubico PAM support the U2F functionality for logins?

Thanks,

Agg

Statistics: Posted by Aggraxis — Fri Oct 24, 2014 3:13 am

Re: [HOW TO] - Yubikey SSH login via PAM module

2014-02-10T11:20:57+01:00

Are there any ways to only enable yubikey + password requirement for some user ?

Statistics: Posted by nebi — Mon Feb 10, 2014 11:20 am

Re: [HOW TO] - Yubikey SSH login via PAM module

2015-12-14T22:33:42+01:00

I've successfully setup SSH login on Ubuntu 13.04 Server & Client. For your reference...

http://smri.io/kpdh

Statistics: Posted by Eddie — Mon Aug 12, 2013 9:22 pm

Re: [HOW TO] - Yubikey SSH login via PAM module

2013-03-29T14:49:30+01:00

Thank you very much,

I found this HOW-TO tutorial via google, and maybe you should remind how pple can generate the KEY and ID via the api. This was my main problem as i'm totally new to Yubikey.

Btw it is still possible to bypass the yubikey auth tapping enter (you will still be prompted for a password) connecting via sftp.

Statistics: Posted by Novakin — Fri Mar 29, 2013 2:49 pm

Re: [HOW TO] - Yubikey SSH login via PAM module

2013-02-11T09:27:50+01:00

Thanks, i have edited the original post.

Statistics: Posted by Tom — Mon Feb 11, 2013 9:27 am

Re: [HOW TO] - Yubikey SSH login via PAM module

2013-02-09T16:08:25+01:00

I followed the tutorial but it only worked with One Factor Authentication. It would accept either the password or the OTP. I tried 2FA (the "required" setup) and it didn't work at all. Luckily I didnt lock myself out of my box Then I changed the following in /etc/ssh/sshd_config:

Code:

ChallengeResponseAuthentication yes
PasswordAuthentication yes

And then two factor authentication worked properly

Code:

loi-mbp:~ loiphin$ ssh 172.16.1.202
Yubikey for `loiphin': 
Password: 
Welcome to Ubuntu 12.10 (GNU/Linux 3.5.0-23-generic x86_64)

Statistics: Posted by loiphin — Sat Feb 09, 2013 4:08 pm

Re: [HOW TO] - Yubikey SSH login via PAM module

2013-02-04T09:43:58+01:00

Well done.

Statistics: Posted by Tom — Mon Feb 04, 2013 9:43 am

Re: [HOW TO] - Yubikey SSH login via PAM module

2013-02-03T15:56:23+01:00

Ok I have finally succeeded in ssh login to my Debian Box.
The debug mode was useful.

Statistics: Posted by moulip — Sun Feb 03, 2013 3:56 pm

Re: [HOW TO] - Yubikey SSH login via PAM module

2013-02-01T15:45:04+01:00

I am sorry moulip, i have posted a screenshot showing that it correctly works with only ONE factor. Just the Yubikey OTP without password.

What i can suggest you, is to install a virtual machine with Ubuntu 12.10, and try again from scratch.

1) Do not set up encrypted home folder.
2) Check that the virtual machine can connect to the internet to validate the OTP
3) Try reading the tutorial bottom-up, this may unlock some words that you missed, it happens.

Statistics: Posted by Tom — Fri Feb 01, 2013 3:45 pm

Re: [HOW TO] - Yubikey SSH login via PAM module

2013-02-01T14:11:31+01:00

I have strictly followed the howtos and I am still prompted for the password. I don't know what to do more.

Statistics: Posted by moulip — Fri Feb 01, 2013 2:11 pm

Re: [HOW TO] - Yubikey SSH login via PAM module

2013-02-01T13:11:34+01:00

No. You can authenticate yourself locally [challenge-response] or via the Internet using YubiClous service for example.

If you choose to authenticate against the YubiCloud you need the YubicoOTP ( the one configured in slot 1 by default )
If you choose to authenticate locally then you configure slot 2 of your Yubikey in challenge response mode ( following the other tutorial )

The password prompt depends on how you configure sshd / pam

Statistics: Posted by Tom — Fri Feb 01, 2013 1:11 pm

Re: [HOW TO] - Yubikey SSH login via PAM module

2013-02-01T12:10:04+01:00

You mean that in order for the SSH login to work without asking password, the Yubikey must be setup in challenge-response mode ?

Statistics: Posted by moulip — Fri Feb 01, 2013 12:10 pm

Re: [HOW TO] - Yubikey SSH login via PAM module

2013-01-30T13:55:45+01:00

I have tested the "one factor" and it works on Ubuntu 12.10

if you want to use challenge response mode then follow this tutorial:
https://github.com/Yubico/yubico-pam/wi ... geResponse

Statistics: Posted by Tom — Wed Jan 30, 2013 1:55 pm