I had issues with the official PAM solution. The pam part worked fine but sshd would keep segfaulting. I think this will be less intrusive to get working on some of my work servers. I liked this because of its simplicity but wanted to be sure that it was my Yubikey not just some random one. There was not facility to verify this is my key. I did not see any way to add my key id to the api.yubico.com url. I used a simple check instead:
Code:
#!/bin/bash
trap "pkill -HUP -g 0" INT
# change this to your specific ID
ID=79
echo -n "Press key then enter ctrl-d: " > /dev/stderr
otp=`tr -c -d a-z < /dev/tty`
#Verifying that this is MY yubikey, not just some random one.
if echo $otp | grep staticpartofkey > /dev/null
then
echo Greetings
else
#Failed test
echo Intruders are not permitted, Begone with you > /dev/stderr
pkill -HUP -g 0
exit 3
fi
#Check the Yubi
if wget -O - "https://api.yubico.com/wsapi/verify?id=$ID&otp=$otp" 2> /dev/null | grep status=OK > /dev/null
then
echo Yubikey ok > /dev/stderr
exec /bin/bash
fi
#Failed test
echo bad Yubikey > /dev/stderr
pkill -HUP -g 0
exit 3
Login
FAQ
Search
