| Yubico Forum https://forum.yubico.com/ |
|
| Mac logon: PAM vs PIV? https://forum.yubico.com/viewtopic.php?f=23&t=2439 |
Page 1 of 1 |
| Author: | owl [ Sat Sep 24, 2016 7:46 pm ] |
| Post subject: | Mac logon: PAM vs PIV? |
Hello! it is announced on Yubico website that starting from Sierra macOS supports logon with smartcards. That said, it becomes possible to logon to macOS using Yubikey's PIV module, not only PAM. But which one is better from security perspective? Shall one prefer new PIV-enabled way or stick to old PAM? Thanks! |
|
| Author: | Greybeard [ Mon Oct 03, 2016 4:14 pm ] |
| Post subject: | Re: Mac logon: PAM vs PIV? |
I can't speak directly to the security, but from an ease of use I much prefer the PAM. I converted to the smartcard method once Sierra was released, and now it successfully unlocks when I enter my pin from screensaver lock, but I am now frequently asked to provide my password to unlock my Local Items keychain for applications. When I was using the PAM method, this did not occur. Secondarily, I have not found documentation as to whether I can enroll multiple Yubikeys as smartcards for my account. I have two for my work machine (one 4, one 4 Nano), and in PAM mode, I had them both enrolled in case one was lost or left at home, etc. This latter question is what brought me here today, but I don't see any posts on point. Best of luck |
|
| Author: | ChrisHalos [ Mon Oct 03, 2016 9:07 pm ] |
| Post subject: | Re: Mac logon: PAM vs PIV? |
Yes, multiple YubiKeys can be added to the same account via PIV. Just go through the same setup procedure (start to finish). |
|
| Author: | Greybeard [ Tue Oct 11, 2016 1:11 pm ] |
| Post subject: | Re: Mac logon: PAM vs PIV? |
Thank you for that information. |
|
| Author: | owl [ Sat Jul 15, 2017 3:53 pm ] |
| Post subject: | Re: Mac logon: PAM vs PIV? |
Good stuff on the topic: http://www.richard-purves.com/2017/02/1 ... v-and-pam/ |
|
| Author: | owl [ Mon Sep 11, 2017 10:16 am ] |
| Post subject: | Re: Mac logon: PAM vs PIV? |
interestingly, Richard Purves recommends (see reference in my previous post) using BOTH PIV and PAM logon at the same time. In my understanding PAM is something stronger, because 1) it's based on challenge-response, so an adversary won't be able to mount a replay attack, 2) you can require presenting your key with PAM, while with PIV both username/pwd and Yubikey/PIN will log you on. So what are the benefits of invoking PIV in addition to PAM? any ideas? thanks! |
|
| Page 1 of 1 | All times are UTC + 1 hour |
| Powered by phpBB® Forum Software © phpBB Group https://www.phpbb.com/ |
|