Hi all,
I've just got my server set up with the PAM module for SSH login and it works great! However, the process got me thinking; what happens in the event that you need to log in if the machine's networking (or the Yubico servers themselves) is down?
Is there a PAM configuration that will allow the Yubikey PAM module auth to be mandatory in the (normal) situation that networking is up, but to fall back to normal password auth if for whatever reason the network is unavailable? I don't want to make the Yubikey auth "sufficient", because as I understand it, that would mean that all an attacker would have to do to bypass the OTP would be to enter a couple of null OTPs.
I know there are a lot of variables here... what happens if networking is up but mangled, how do you reliably and efficiently check for the availability of a web service etc... but I hear PAM is pretty flexible so thought I'd ask the question
Cheers!
-- Tim