Using sshd
The PAM module came from
http://www.securixlive.com/yubipam/download.php
and doesn't appear to be under any real development at the moment. That
provides the server-side bit and it's licensed under GPL.
I unpacked it, installed the pam-devel package, did a
./configure && make then a
make install as root, and followed the rest of
the instructions in the
INSTALL file in the distro as regards adding a yubikey auth group to
group-own the /etc/yubikey file, and sgid'ing the check binary.
As per the README file in the distro, I changed my
/etc/pam.d/sshd from
#%PAM-1.0
auth required pam_sepermit.so
auth include password-auth
account required pam_nologin.so
[...]
to
#%PAM-1.0
auth required pam_sepermit.so
auth sufficient pam_yubikey.so verbose_otp
auth include password-auth
account required pam_nologin.so
[...]
I added my password to the yubikey file with
[root@risby pam.d]# ykpasswd -a --user madhatta -k abcabcabcabcabcabcabcabcabcabcab -o here i supplied a slot-1 OTP
Adding Yubikey entry for madhatta
Using public UID: 00 00 00 89 87 3d
Using private UID: 01 23 45 67 89 ab
Completed successfully.
I'm definitely in the database, and replay attacks definitely don't work
(as they most definitely should not):
[madhatta@risby madhatta]$ ykvalidate --user madhatta ccccccjkjietjvfrcvvbvrdllrggjgdkkjvtbkddbtjc
OTP is VALID.
[madhatta@risby madhatta]$ ykvalidate --user madhatta ccccccjkjietjvfrcvvbvrdllrggjgdkkjvtbkddbtjc
OTP is INVALID!
I could have used ykpasswd without the actual key to hand
if I knew the public and
private UID strings, in hex. From the output above,
I found that the public UID (00 00 00 89 87 3d) is the same as my modhex
fixed string (ccccccjkjiet) using
yubico's modhex calculator. From this I
presume that
ykpasswd -a --user madhatta -k abcabcabcabcabcabcabcabcabcabcab -f 00000089873d -p 0123456789ab
would have worked just as well, though I have not tried it.
I created a local guest user and became him to avoid any issues with
SSH agents, identities, etc. Then I did
[guest@risby ~]$ ssh madhatta@risby
madhatta@risby's password:
provided the OTP password, but got
Permission denied, please try again.
while /var/log/facility/authpriv * said:
Mar 8 09:24:22 risby yk_chkpwd[22644]: password check failed for user (madhatta)
Mar 8 09:24:22 risby unix_chkpwd[22645]: password check failed for user (madhatta)
Mar 8 09:24:22 risby sshd[22641]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=risby.home.teaparty.net user=madhatta
Mar 8 09:24:24 risby sshd[22641]: Failed password for madhatta from 192.168.3.11 port 59028 ssh2
I found that I also had to enable ChallengeResponseAuthentication
in /etc/ssh/sshd_config with
# Change to no to disable s/key passwords
ChallengeResponseAuthentication yes
#ChallengeResponseAuthentication no
Then I got success:
[guest@risby ~]$ ssh madhatta@risby
Yubikey OTP: ccccccjkjiethrubinjedfgcbntgrfjjbfkdditlerbc
Last login: Mon Mar 8 10:28:42 2010 from risby.home.teaparty.net
[madhatta@risby ~]$
I tried a reply attack by pasting the OTP into a text buffer and presenting
it twice, the second time I got:
[guest@risby ~]$ ssh madhatta@risby
Yubikey OTP: ccccccjkjiethrubinjedfgcbntgrfjjbfkdditlerbc
Yubikey OTP: ccccccjkjietviinkkidricrbktviivuhikutjterlub
Last login: Mon Mar 8 10:29:40 2010 from risby.home.teaparty.net
[madhatta@risby ~]$
Note how the first OTP, which is the one from the previous example retried,
simply fails silently; only a new, valid OTP succeeds.
Yubico also provide a PAM implementation at
http://code.google.com/p/yubico-pam/wiki/YubikeyAndSSHViaPAM
but this authenticates off yubico's central server, which is not desirable
in this application. Shame.
Using sudo
Having done the above, changing /etc/pam.d/sudo to start
#%PAM-1.0
auth sufficient pam_yubikey.so
auth include system-auth
...
makes sudo work happily with OTPs, which is extremely useful for me.
On my colocated box, I don't currently use sudo. I'd like to, but I
don't want sudoers to have the option to use password authentication; the
yubikey will be mandatory. In this case, I made a copy of
/etc/pam.d/system-auth called /etc/pam.d/system-yubiauth,
then deleted all non-auth lines
and commented out the following line in /etc/pam.d/system-yubiauth:
#auth sufficient /lib/security/$ISA/pam_unix.so likeauth nullok
and changed the start of /etc/pam.d/sudo to read
#%PAM-1.0
auth sufficient pam_yubikey.so
auth include system-yubiauth
account include system-auth
...
Now, if a user prompted for a yubikey OTP just hits return, the
sudo fails instead of passing him/her to password authentication.
Using squirrelmail
Squirrelmail plugin at
http://code.google.com/p/yubico-squirrelmail-plugin/, also under GPL2.
MORE NEEDED. SCRATCH PAD STARTS:
Back to Technotes index
Back to main page
