Yubikey - Revision history

imported>Pew at 09:17, 2 January 2018

2018-01-02T09:17:06Z

imported>Echarlie: some more notes on auth with pam

2017-05-23T18:45:22Z

some more notes on auth with pam

imported>Echarlie: /* U2F (Universal Second Factor) with Duo 2FA (Yubikey NEO and 4 only) */

2017-05-17T17:30:22Z

‎U2F (Universal Second Factor) with Duo 2FA (Yubikey NEO and 4 only)

imported>Echarlie: /* PGP Keys */

2017-05-17T17:29:40Z

‎PGP Keys

imported>Echarlie: /* U2F (Universal Second Factor) with Duo 2FA (Yubikey NEO and 4 only) */

2017-05-17T17:23:56Z

‎U2F (Universal Second Factor) with Duo 2FA (Yubikey NEO and 4 only)

imported>Echarlie: /* Using with Virginia Tech 2-Factor (Duo) */

2017-05-17T17:21:29Z

‎Using with Virginia Tech 2-Factor (Duo)

imported>Echarlie: /* sshd */ 2fa notes

2017-05-17T17:18:40Z

‎sshd: 2fa notes

imported>Echarlie: /* Install Packages */

2016-09-05T15:22:14Z

‎Install Packages

imported>Echarlie: /* Install Packages */

2016-09-05T15:21:57Z

‎Install Packages

imported>Bgregos: /* Install Packages */

2016-09-05T04:33:54Z

‎Install Packages

← Older revision		Revision as of 09:17, 2 January 2018
Line 182:		Line 182:
	[[Category:Howtos]]		[[Category:Howtos]]
	[[Category:Hardware]]		[[Category:Hardware]]
−	~~[[Category:Security]]~~

← Older revision		Revision as of 18:45, 23 May 2017
Line 1:		Line 1:
	The '''Yubikey''' is a [[w:security token\|security token]], intended to be used for [[w:Two-factor authentication\|two-factor authentication]], that emulates a keyboard to enter one-time passwords generated using an AES encryption key embedded on the device. There is also support for static passwords and [[w:HMAC\|HMAC-SHA1]] challenge/response authentication. The newest Yubikey models (4 and Neo) also support [https://developers.yubico.com/U2F/ U2F], a standard created by the [https://fidoalliance.org/ FIDO Alliance] for strong 2nd factor authentication. Yubikey supports OAUTH TOTP and HOTP standards for one-time passwords as well, and can be used with open PGP and PIV digital signatures and encryption. Some models also support these features over NFC with Android devices. Yubico, the company which sells the Yubikey, also provides [https://developers.yubico.com/Software_Projects/ software] for many 2FA purposes.		The '''Yubikey''' is a [[w:security token\|security token]], intended to be used for [[w:Two-factor authentication\|two-factor authentication]], that emulates a keyboard to enter one-time passwords generated using an AES encryption key embedded on the device. There is also support for static passwords and [[w:HMAC\|HMAC-SHA1]] challenge/response authentication. The newest Yubikey models (4 and Neo) also support [https://developers.yubico.com/U2F/ U2F], a standard created by the [https://fidoalliance.org/ FIDO Alliance] for strong 2nd factor authentication. Yubikey supports OAUTH TOTP and HOTP standards for one-time passwords as well, and can be used with open PGP and PIV digital signatures and encryption. Some models also support these features over NFC with Android devices. Yubico, the company which sells the Yubikey, also provides [https://developers.yubico.com/Software_Projects/ software] for many 2FA purposes.
		+
		+	PAM modules for the Yubikey make it possible to use it for single or multi-factor authentication schemes on workstations and servers. Of most interest are libpam-yubikey and libpam-u2f, but libpam-pkcs11, libpam-radius-auth, and several htop/totp modules are also likely usable with the yubikey.

	== PAM two-factor Yubikey One-Time Password authentication ==		== PAM two-factor Yubikey One-Time Password authentication ==

@@ Line 115: / Line 115: @@
 == U2F (Universal Second Factor) with Duo [[gp:2FA|2FA]] (Yubikey NEO and 4 only) ==
-[[w:Universal 2nd Factor|U2F] is a new standard from the FIDO alliance for use in web-browsers; it is based on a challenge-response protocol. The most interesting services currently supporting it are Github, Google, and Virginia Tech.
+[[w:Universal 2nd Factor|U2F]] is a new standard from the FIDO alliance for use in web-browsers; it is based on a challenge-response protocol. The most interesting services currently supporting it are Github, Google, and Virginia Tech's Duo Two-factor.
 ===Key Preparation===

@@ Line 109: / Line 109: @@
 The test is needed because the script is run whenever the yubikey is polled for challenge-response authentication (because this causes it to change modes from USB HID to serial and back again), and we only want to lock the screen when the key is actually removed. Note that if you have yubikey auth enabled in /etc/pam.d/su, it must come after <code>auth		sufficient	pam_rootok.so</code>.
 * Put your script to lock the screen in /usr/local/bin/lock. You must set DISPLAY=:0 to have the screen locker work correctly if you're not using a daemonized locker such as xscreensaver or gnome-screensaver.
 == U2F (Universal Second Factor) with Duo [[gp:2FA|2FA]] (Yubikey NEO and 4 only) ==

← Older revision		Revision as of 17:23, 17 May 2017
Line 111:		Line 111:

	== U2F (Universal Second Factor) with Duo [[gp:2FA\|2FA]] (Yubikey NEO and 4 only) ==		== U2F (Universal Second Factor) with Duo [[gp:2FA\|2FA]] (Yubikey NEO and 4 only) ==
		+	[[w:Universal 2nd Factor\|U2F] is a new standard from the FIDO alliance for use in web-browsers; it is based on a challenge-response protocol. The most interesting services currently supporting it are Github, Google, and Virginia Tech.

	===Key Preparation===		===Key Preparation===

@@ Line 161: / Line 161: @@
 ===Using with Virginia Tech 2-Factor (Duo)===
-There are two ways to use two factor with CAS login. Both will require Chrome (Chromium may work, but is currently untested). Option 2 allows Firefox usage after the initial setup.
+There are two ways to use two factor with Shibboleth ''login''. Both will require Chrome or Chromium . Option 2 allows Firefox usage after the initial setup.
 . Open Chrome. When logging in using CAS, the Duo popup will open asking what source to use for two factor. On the sidebar, click add device. It will want to confirm using an existing method first. Then, select that you want to enroll a U2F token. Follow the instructions onscreen to enroll. Once completed, you can just tap your Yubikey (or other U2F token) to authenticate.

@@ Line 60: / Line 60: @@
 After editing the configuration, restart sshd.
-Unfortunately, you cannot use two-factor Yubikey authentication in combination with SSH public key authentication at the current time; you must pick one.
+If you would like to use two-factor Yubikey authentication in combination with SSH public key authentication at the current time, you should look at [http://undeadly.org/cgi?action=article&sid=20130616112437 this Undeadly article] and the ''AuthenticationMethods'' option for openssh.
 == PAM two-factor HMAC-SHA1 authentication ==

@@ Line 158: / Line 158: @@
 * For Fedora: <code>dnf install libu2f-host</code>
-* For ArchLinux <code>pacman -S libu2f-host</code>
+* For ArchLinux: <code>pacman -S libu2f-host</code>
 ===Using with Virginia Tech 2-Factor (Duo)===

@@ Line 155: / Line 155: @@
 ===Install Packages===
-You may need to install an extra package if using Linux. It doesn't seem to be required on Ubuntu 16.04, but does on Fedora 24.
+You will likely need to install the u2f udev rules for it to work. Ubuntu ships with these udev rules.
-<code>For Fedora: sudo dnf install libu2f-host</code>
+* For Fedora: <code>dnf install libu2f-host</code>
 ===Using with Virginia Tech 2-Factor (Duo)===