Yubico Forum

...visit our web-store at store.yubico.com
It is currently Tue Jan 30, 2018 10:11 am

All times are UTC + 1 hour




Post new topic Reply to topic  [ 6 posts ] 
Author Message
 Post subject: Mac logon: PAM vs PIV?
PostPosted: Sat Sep 24, 2016 7:46 pm 
Offline

Joined: Mon Mar 30, 2015 8:36 pm
Posts: 12
Hello!

it is announced on Yubico website that starting from Sierra macOS supports logon with smartcards. That said, it becomes possible to logon to macOS using Yubikey's PIV module, not only PAM. But which one is better from security perspective? Shall one prefer new PIV-enabled way or stick to old PAM?

Thanks!


Top
 Profile  
Reply with quote  

Share On:

Share on Facebook FacebookShare on Twitter TwitterShare on Tumblr TumblrShare on Google+ Google+

PostPosted: Mon Oct 03, 2016 4:14 pm 
Offline

Joined: Mon Oct 03, 2016 4:07 pm
Posts: 2
I can't speak directly to the security, but from an ease of use I much prefer the PAM. I converted to the smartcard method once Sierra was released, and now it successfully unlocks when I enter my pin from screensaver lock, but I am now frequently asked to provide my password to unlock my Local Items keychain for applications. When I was using the PAM method, this did not occur.

Secondarily, I have not found documentation as to whether I can enroll multiple Yubikeys as smartcards for my account. I have two for my work machine (one 4, one 4 Nano), and in PAM mode, I had them both enrolled in case one was lost or left at home, etc. This latter question is what brought me here today, but I don't see any posts on point.

Best of luck


Top
 Profile  
Reply with quote  
PostPosted: Mon Oct 03, 2016 9:07 pm 
Offline
Yubico Team
Yubico Team

Joined: Thu Oct 16, 2014 3:44 pm
Posts: 349
Yes, multiple YubiKeys can be added to the same account via PIV. Just go through the same setup procedure (start to finish).


Top
 Profile  
Reply with quote  
PostPosted: Tue Oct 11, 2016 1:11 pm 
Offline

Joined: Mon Oct 03, 2016 4:07 pm
Posts: 2
Thank you for that information.


Top
 Profile  
Reply with quote  
PostPosted: Sat Jul 15, 2017 3:53 pm 
Offline

Joined: Mon Mar 30, 2015 8:36 pm
Posts: 12
Good stuff on the topic:
http://www.richard-purves.com/2017/02/1 ... v-and-pam/


Top
 Profile  
Reply with quote  
PostPosted: Mon Sep 11, 2017 10:16 am 
Offline

Joined: Mon Mar 30, 2015 8:36 pm
Posts: 12
interestingly, Richard Purves recommends (see reference in my previous post) using BOTH PIV and PAM logon at the same time. In my understanding PAM is something stronger, because 1) it's based on challenge-response, so an adversary won't be able to mount a replay attack, 2) you can require presenting your key with PAM, while with PIV both username/pwd and Yubikey/PIN will log you on.

So what are the benefits of invoking PIV in addition to PAM? any ideas? thanks!


Top
 Profile  
Reply with quote  
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 6 posts ] 

All times are UTC + 1 hour


Who is online

Users browsing this forum: No registered users and 3 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB® Forum Software © phpBB Group