Hi all,
As promised I’ve put up some of the ebuilds needed to use the YubiKey in Gentoo. This includes a PAM module for stand-alone authentication with the YubiKey, which I have patched to support concatenated two-factor authentication. These are in a new overlay:
- git://git.longlandclan.yi.org/overlays/yubikey.git
- http://git.longlandclan.yi.org/git/overlays/yubikey.git
Stand-alone two factor authentication: Password + YubiKey with YubiPAM
The procedure for setting this up is pretty simple. First, grab the overlay:
stuartl@beast /home/portage/overlays $ git clone git://git.longlandclan.yi.org/overlays/yubikey.git Cloning into yubikey... remote: Counting objects: 16, done. remote: Compressing objects: 100% (13/13), done. remote: Total 16 (delta 2), reused 16 (delta 2) Receiving objects: 100% (16/16), 4.15 KiB, done. Resolving deltas: 100% (2/2), done.
Now add it to your make.conf as per usual procedure, then unmask and install YubiPAM and ykpers ebuilds. At last check, you need the live git ebuild for ykpers and libyubikey if you use the latest revision (2.2) keys like those handed out at linux.conf.au. For the PAM module, I recommend using the non-live version, although a live ebuild is there for the adventurous (I had buffer overflow glitches).
# ( echo =sys-auth/yubipam-1.1_beta1 > echo =sys-auth/ykpers-99999999 > echo =sys-auth/libyubikey-99999999 ) >> /etc/portage/package.keywords # emerge ykpers yubipam
This will install some tools to personalise the YubiKey and the PAM module. At this step it’s now time to program the YubiKey. This will break its ability to be used on the Yubico servers until you upload a copy of your new AES key to their site (see below).
Choose your public and private IDs, then program with the following command. The fixed parameter should be 6-8 bytes long in hexadecimal. If you intend to use this on Yubico servers later, it must be 6 bytes long, and must begin with ff.
# ykpersonalize -ofixed=$( modhex -h ffeeddccbbaa ) -ouid=112233445566
Firmware version 2.2.2 Touch level 1283 Program sequence 3
Passphrase to create AES key:
Type in a long string of gobbledegook with lots of random letters,
numbers and punctuation (not like this!) to keep people guessing.
This will seed the AES keygen.
fixed: m:vvuuttrrnnll
uid: h:112233445566
key: h:afaaaa6021303d90740579cd7fc4e87f
acc_code: h:000000000000
ticket_flags: APPEND_CR
config_flags:
extended_flags:
At the bottom it asks whether you wish to program the key. It didn’t here because in fact I had snuck in a little parameter which I haven’t shown here. You’ll want to make a note of the parameters it tells you though, especially the generated key.
Once complete, you then need to tell YubiPAM about it:
# ykpasswd -a -c -f ffeeddccbbaa -k afaaaa6021303d90740579cd7fc4e87f -p 112233445566 \
--user stuartl -o vvuuttrrnnlllrgjglvnicujhnhhecfeitjureidlcer
Adding Yubikey entry for stuartl
Using public UID: ff ee dd cc bb aa
Using private UID: 11 22 33 44 55 66
Passcode: Completed successfully.
The last bit should be generated from the YubiKey itself, just type the rest in then press the button and it should add you after asking for a passcode (which can be different to your regular system password). The final step is to set it up with PAM. This I’m not 100% sure of, but I achieved working authentication by configuring my /etc/pam.d/system-auth as follows:
vk4mslp2 yubikey # cat /etc/pam.d/system-auth auth required pam_env.so auth sufficient pam_yubikey.so concat_two_factor auth required pam_unix.so try_first_pass likeauth nullok
It should be noted; test the configuration in a new console session, do not log out or else you may lock yourself out. There is a ykvalidate tool for testing, but it doesn’t seem to work properly with two-factor authentication.
The concat_two_factor parameter to pam_yubikey relies on a patch present in the ebuild, which I have sent up-stream, and is a work-around for (some would say, broken) PAM clients that do not support multiple Password fields such as KDM.
To log-in, type in your username. In the password field, enter the passcode followed by a space, then tap the YubiKey to enter the OTP. It should log you in.
Uploading the key to Yubico
First, a warning
The whole point of one-time password generators such as this, is to prevent someone intercepting your password and logging in to your systems. If a one-time-password is captured, it’s useless because in the ideal case, all systems know it has already been used. I say in the ideal case. In this scenario, if you use the key on a public server, it is possible for someone to capture that OTP, and re-play it to the stand-alone system using YubiPAM to gain access. They of course can only do this once, but that may be enough for them to make themselves at home.
With some care, you can reduce the risk of this … for instance making a point of gratuitously logging in to each system using the key immediately after using it on any of the systems is one way to try and manually synchronise the OTPs. I’m giving this problem some thought, for my needs it isn’t such a big deal as it’s mostly for fun anyway, but this is a factor that must be considered when using the YubiKey (or any OTP device) in this manner.
How to
Go to https://upload.yubico.com/. Enter the data as follows.
- Your email address (needs no explanation)
- The YubiKey’s serial number: printed on the back, 6 digit decimal code
- YubiKey Prefix: This is also called the “fixed UID” and appears as the first 12 characters of the OTP. It should be in modhex format. In the above example, the prefix would be vvuuttrrnnll.
- Internal identity: This is also called the “private UID”. It should be in hexadecimal format. In the above example, the internal identity would be 112233445566
- AES Key: Again in hexadecimal… the key used in this example was afaaaa6021303d90740579cd7fc4e87f
- Finally, an OTP from the device. Don’t fill this in yet.
Below this form there is a Capcha field to stop spambots. Fill in the challenge and click the “I’m a human” button, and copy the text into the other box as it asks. Now go back to the other form, click on the OTP field and press the YubiKey button. You should then be able to test it on their demo server and use the key simultaneously on the web and your local systems.
Cool beans. I had started down this path but never got around to adding all the packages and figuring out how to do the PAM integration. I was also having to patch some issues and send the patch upstream to address some QA notices.
Do you think this can be used to set up two factor auth (for ssh and the like) on a private network?
Most certainly can, in fact, that’s what I’m doing here, using the YubiKey for authentication on my laptops and desktop.
In the case of the laptops, it was of paramount importance that the set up be able to work stand-alone without an Internet connection.
So you can either do this networked (not contacting yubico.com though) or standalone?
YubiPAM *only* works stand-alone, not networked at all. This does mean that systems using YubiPAM are not synchronised at all. i.e. if I were to log in to my desktop and someone captured the OTP and password, they can replay that OTP and password to another of my systems to log in.
I’m giving this problem some thought, for my needs it isn’t a big issue. I’m thinking along the lines of a multicast UDP protocol for LAN synchronisation, with a plaintext HTTP-based protocol for over-the-Internet synchronisation. We’ll see though.
FYI, this document indicates that it is possible to use an online validation server, see the “If using HTTPS to authenticate the validation server” section:
https://wiki.archlinux.org/index.php/Yubikey
Yes, pam-yubico (Yubico’s PAM module for the YubiKey) uses their cloud services, YubiPAM does not.
There are actually two modules available to service the YubiKey integration into pam, one produced by Yubico themselves, the other, third party, both open-source. Yubico’s module uses their cloud to authenticate, YubiPAM uses its own locally stored database.