Yubico Forum

Dear Yubico-forum users,

I recently bought an yubikey, and trying to set it up with ssh (two factor authentication).
Going through all the steps from the Hak5 video, plus a lot of forums, github wiki's and google code groups, I still can't get it to work. (It's making me not sleep).

Some details:
(Yeah, the server is an raspberry pi)

Operating System: Linux 3.2.20-rpi1+ #5 Sun Jun 17 15:59:27 BST 2012 armv6l GNU/Linux

Versions:

Libykclient-dev 2.3-3
Libykclient3 2.3-3
Libkeyutils1 1.4-1
Libyubikey0 1.5-1

yubico-c-client ==> latest pull from github
yubikey-personalization ==> latest pull from github
yubico-pam ==> latest pull from github



Hereby I want to ask what is the solution to this error code:



<--snip-->


[pam_yubico.c:pam_sm_authenticate(901)] conv returned 55 bytes
[pam_yubico.c:pam_sm_authenticate(919)] Skipping first 11 bytes. Length is 55, token_id set to 12 and token OTP always 32.
[pam_yubico.c:pam_sm_authenticate(926)] OTP: xxxx ID: xxxx
[pam_yubico.c:pam_sm_authenticate(941)] Extracted a probable system password entered before the OTP - setting item PAM_AUTHTOK
[pam_yubico.c:pam_sm_authenticate(957)] ykclient return value (106): Server response signature was invalid (BAD_SERVER_SIGNATURE)
[pam_yubico.c:pam_sm_authenticate(997)] done. [Authentication service cannot retrieve authentication info]




</--snip-->

I can only login to ssh with the yubikey, if I put 'sufficient' instead of 'required' in /etc/pam.d/sshd.
However, making auth sufficient, it isn't two factor authentication anymore.

[/etc/pam.d/sshd]
<--snip-->
auth required pam_yubico.so id=xxxx key=xxxxx= debug
</--snip-->

Now the ssh server is only requesting the password, whereby I can login over ssh (without yubikey, even though all the configuration options are set).
I am using the YubiCloud to verify the key. (default)
When I try to authenticate, to the default yubico servers, using ykclient only it is successful.

When making yubikey-personalization, I also get the following warning:


ykpersonalize.c:69: warning: initialization makes integer from pointer without a cast



Thanks in advance.

Hello,

The BAD_SERVER_SIGNATURE error is returned from the client when the signature on the server response doesn't match with the api-key inputted. Verify that the you've inputted the correct key from https://upgrade.yubico.com/getapikey/

/klas

Yeah, did that. Still get BAD_SERVER_SIGNATURE (even though I tried a few api keys, and waited a time).
Now when I issue ykclient --apikey KEY ID OTP, it gives me the 106 BAD_SERVER_SIGNATURE error.

[EDIT]:

I reinstalled everything, and I stil get the 106 error.
Also, I noticed that I have multiple versions of libusb. Is this normal?

You seem to be quite correct. I've started up an emulated ARM machine and I run into signature problems, something is buggy with the request signing on ARM. I'm working on finding and fixing it.

/klas

Hello again,

I've now pushed a possible fix (https://github.com/Yubico/yubico-c-clie ... 0ed97cda40) for this issue to github, with this fix my emulated ARM machine works as it should.

Thanks for taking the time to report this issue!

/klas

[EDIT]:
Wow! Thanks alot!!! Saved my day! No thanks, thank you ;-0
I hereby confirm that SSH-yubikey two-factor authentication is grand on an Rasperry Pi. (ARM)

Would you mind documenting how you've setup your raspberrypi for yubikey authentication.

Taking it a step further, a raspberrypi port of the yubiradius server would be excellent for a home authentication server.

Hello, I've published an optimized Raspberry Pi binary image of multiOTP open source, a strong authentication RADIUS server with a simple web GUI that supports Yubikeys and also OATH-HOTP and OATH-TOTP hardware or software tokens. multiOTP open source is based on our open source PHP library.

You can have a look here: http://www.multiotp.net/

And the direct download of the Raspberry Pi image is here: http://download.multiotp.net/raspberry/

Best regards,

Andre Liechti
Project leader of multiOTP open source

Thanks, this is interesting.

Tom