Yubico Forum

Name: Yubico authentication with YubiKey
Default: no
Priority: 704
Auth-Type: Primary
Auth:
        required        pam_yubico.so   id=100 key=xxxxxx url=http://<server>/wsapi/2.0/verify? authfile=/etc/yubikey_mappings debug
Auth-Initial:
        required        pam_yubico.so   id=100 key=xxxxxx url=http://<server>/wsapi/2.0/verify? authfile=/etc/yubikey_mappings debug

# here are the per-package modules (the "Primary" block)
auth    required        pam_yubico.so id=100 key=xxxxxx url=http://<server>/wsapi/2.0/verify? authfile=/etc/yubikey_mappings debug
auth    [success=2 default=ignore]      pam_krb5.so minimum_uid=1000 try_first_pass
auth    [success=1 default=ignore]      pam_unix.so nullok_secure try_first_pass
# here's the fallback if no module succeeds
auth    requisite                       pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
auth    required                        pam_permit.so
# and here are more per-package modules (the "Additional" block)
auth    optional                        pam_cap.so

[pam_yubico.c:parse_cfg(736)] called.
[pam_yubico.c:parse_cfg(737)] flags 1 argc 5
[pam_yubico.c:parse_cfg(739)] argv[0]=id=100
[pam_yubico.c:parse_cfg(739)] argv[1]=key=xxxxxx
[pam_yubico.c:parse_cfg(739)] argv[2]=url=http://<server>/wsapi/2.0/verify?id=%d&otp=%s
[pam_yubico.c:parse_cfg(739)] argv[3]=authfile=/etc/yubikey_mappings
[pam_yubico.c:parse_cfg(739)] argv[4]=debug
[pam_yubico.c:parse_cfg(740)] id=100
[pam_yubico.c:parse_cfg(741)] key=xxxxxx
[pam_yubico.c:parse_cfg(742)] debug=1
[pam_yubico.c:parse_cfg(743)] alwaysok=0
[pam_yubico.c:parse_cfg(744)] verbose_otp=0
[pam_yubico.c:parse_cfg(745)] try_first_pass=0
[pam_yubico.c:parse_cfg(746)] use_first_pass=0
[pam_yubico.c:parse_cfg(747)] authfile=/etc/yubikey_mappings
[pam_yubico.c:parse_cfg(748)] ldapserver=(null)
[pam_yubico.c:parse_cfg(749)] ldap_uri=(null)
[pam_yubico.c:parse_cfg(750)] ldapdn=(null)
[pam_yubico.c:parse_cfg(751)] user_attr=(null)
[pam_yubico.c:parse_cfg(752)] yubi_attr=(null)
[pam_yubico.c:parse_cfg(753)] yubi_attr_prefix=(null)
[pam_yubico.c:parse_cfg(754)] url=http://<server>/wsapi/2.0/verify?id=%d&otp=%s
[pam_yubico.c:parse_cfg(755)] capath=(null)
[pam_yubico.c:parse_cfg(756)] token_id_length=12
[pam_yubico.c:parse_cfg(757)] mode=client
[pam_yubico.c:parse_cfg(758)] chalresp_path=(null)
[pam_yubico.c:pam_sm_authenticate(797)] get user returned: xxxxxx
[pam_yubico.c:pam_sm_authenticate(904)] conv returned 44 bytes
[pam_yubico.c:pam_sm_authenticate(922)] Skipping first 0 bytes. Length is 44, token_id set to 12 and token OTP always 32.
[pam_yubico.c:pam_sm_authenticate(929)] OTP: xxxxxx ID: xxxxxx
[pam_yubico.c:pam_sm_authenticate(960)] ykclient return value (107): Server response signature was invalid (BAD_SERVER_SIGNATURE)
[pam_yubico.c:pam_sm_authenticate(1000)] done. [Authentication service cannot retrieve authentication info]