Yubico Forum

As someone mentioned in another thread the macOS PIV setup with Yubikey doesn't appear to force the yubikey to be present. Not talking about the initial FileVault encryption but screen saver unlock. If I have my nano it, it requires the PIN. If I remove the nano however it allows me to login with my password.

So then:

1. Is it possible to enforce the Yubikey to be in place to unlock?
2. What is the proper way to remove the PIV setup so I can go back to PAM

Removing PIV - delete the certificates on the card (or reset the applet) with PIV Manager, then remove the hashes with sc_auth:

viewtopic.php?t=2434&p=9037

No, it's not possible to force it right now (I've seen hacks that kind of work, but so far it has been very inconsistent and all methods end up breaking some functionality in macOS). FileVault, sudo in Terminal, and Security & Privacy section of System Preferences all currently don't support smart cards. Until these issues are cleared up in Sierra, I wouldn't recommend attempting to force a smart card requirement.

Thanks Chris.

sc_auth was what I was missing. It's really frustrating that macOS doesn't have better smart card support. It is also really annoying that there isn't anyway to get FDE setup with MFA, I've seen some good methods on Linux, too bad we can't get access to the preboot environment. Ah well.

We can see the smart card ecoystem slowly growing in macOS (following the beta builds very closely here and testing as they are released). If you're familiar with previous builds, smart card support has been essentially non-existent for the past several yearly releases.

My recommendation continues to be use PAM/challenge-response until the ecosystem expands (if you need two-factor for login) - combining with a complex FileVault password is a pretty solid combination. I'm currently playing with both right now (PIV and PAM concurrently), but I wouldn't recommend on a production system at this time.