Yubico Forum

...visit our web-store at store.yubico.com
It is currently Tue Jan 30, 2018 7:17 pm

All times are UTC + 1 hour




Post new topic Reply to topic  [ 4 posts ] 
Author Message
PostPosted: Sun Dec 26, 2010 1:56 pm 
Offline

Joined: Sun Dec 26, 2010 1:51 pm
Posts: 8
Is it possible to have the ssh/PAM module differentiate between an ssh connection from the same subnet and from a everywhere else?

I'd like to restrict ssh connections coming in from the internet to have to use their yubikey but to allow local connections through with just a password.


Top
 Profile  
Reply with quote  

Share On:

Share on Facebook FacebookShare on Twitter TwitterShare on Tumblr TumblrShare on Google+ Google+

PostPosted: Mon Jan 17, 2011 1:15 pm 
Offline
Yubico Team
Yubico Team

Joined: Mon Feb 22, 2010 9:49 am
Posts: 183
Yubico PAM module does not support selective two or single factor authentication based on from where the user is connecting (i.e. remotely or locally). Only two factor authentication is supported for all users. However, by making a small modification in the Yubico PAM module it will be possible to selective provide either YubiKey based two factor authentication or single factor password based authentication to a group of users.

The changes are needed to be made in the logic where the Yubico PAM module looks for the YubiKey ID and Username binding. If no YubiKey ID and Username binding found for a user, then the Yubico PAM module should skip all checks and send the success signal to the underlying PAM modules.


Top
 Profile  
Reply with quote  
PostPosted: Wed Jan 19, 2011 6:51 pm 
Offline

Joined: Sun Dec 26, 2010 1:51 pm
Posts: 8
Thanks, I'll have a look at that.

My other options is to run two ssh servers, one for internal on standard port 22 then the other with yubikey on a different port that is NAT'ed through the firewall. The NAT means I don't need to worry about it being on a different port as it can still present itself on 22 if I want it to.


Top
 Profile  
Reply with quote  
PostPosted: Thu Jan 20, 2011 6:44 am 
Offline
Yubico Team
Yubico Team

Joined: Mon Feb 22, 2010 9:49 am
Posts: 183
That sounds to be a good option!


Top
 Profile  
Reply with quote  
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 4 posts ] 

All times are UTC + 1 hour


Who is online

Users browsing this forum: No registered users and 7 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB® Forum Software © phpBB Group