Zen

Source string Source string

Register YubiKey(s) with your local account(s)
46/10000 · 46

The string is read-only.

English Actions
For YubiCloud use the following:
#%PAM-1.0
auth required pam_yubico.so id=[Your API Client ID] key=[Your API Client Key]
#%PAM-1.0
auth sufficient pam_yubico.so id=[Your API Client ID] key=[Your API Client Key]
Note that the key is optional but without it there is no TLS verification which makes this susceptible to MitM attacks by default. Obtain a key at https://upgrade.yubico.com/getapikey[Yubico].
Note that the online auth method won't work if the device is offline and can't reach the YubiCloud.
If you have SELinux on the enforcing mode (the default mode), you should flip on the allow_ypbind boolean first, because pam_yubico needs to be able to connect to Yubico's online authentication. servers.
[…]$ sudo setsebool -P allow_ypbind=1
For challenge-response use the following:
#%PAM-1.0
auth required pam_yubico.so mode=challenge-response
#%PAM-1.0
auth sufficient pam_yubico.so mode=challenge-response
You may add the debug option at the end of these lines right after the mode option to get troubleshooting information in journald.
If you want to use both methods for different use-cases just create the respective configuration files and use them as includes as described in the next section accordingly.
Create two base configuration files in /etc/pam.d/u2f-required and u2f-sufficient.
#%PAM-1.0
auth required pam_u2f.so
#%PAM-1.0
auth sufficient pam_u2f.so
Register YubiKey(s) with your local account(s)
If you use the online YubiCloud method you need the ID of your YubiKey. For this just enter the key and retrieve an OTP code with a short press on the button and extract the first 12 characters - this is your key ID.
cccccbcgebif | bclbtjihhbfbduejkuhgvhkehnicrfdj
Create a configuration file ~/.yubico/authorized_keys with your user account followed by key IDs separated by colons.
fedora-user:cccccbcgebif[:<another-key-id>]
Alternatively, activate challenge-response in slot 2 and register with your user account. The first command (ykman) can be skipped if you already have a challenge-response credential stored in slot 2 on your YubiKey. (Verify with 'ykman otp info') Repeat both or only the last step if you have a backup key (strongly recommended).
[…]$ ykman otp chalresp --generate --touch 2 […]$ ykpamcfg -2
Stored initial challenge and expected response in '/home/<username>/.yubico/challenge-1...5'.
Or for any other system user using sudo.
[…]$ sudo -u someuser ykpamcfg -2
Use the tool pamu2fcfg to retrieve a configuration line that goes into ~/.config/Yubico/u2f_keys. This configuration line consists of a username and a part tied to a key separated by colon.
fedora-user:owBYtPIH2yzjlSQaRrVcxB...Pg==,es256,+presence
If the key is PIN protected you'll be asked to enter the PIN for this operation.
[…]$ mkdir -p ~/.config/Yubico […]$ pamu2fcfg > ~/.config/Yubico/u2f_keys
If you have a backup key add it with the --nouser option and append it to the existing key (line). (All output should end up in the same line.)
[…]$ pamu2fcfg -n >> ~/.config/Yubico/u2f_keys

Loading…

User avatar None

String updated in the repository
Register YubiKey(s) with your local account(s)
Register YubiKey(s) with your local account(s)
2 years ago
Browse all string changes

Things to check

Unpluralised 1

The string is used as plural, but not using plural forms

Reset

Glossary

English English
No related strings found in the glossary.

12592995 String information

Source string description
type: Title ===
Flags
no-wrap, read-only
Source string location
./pages/using-yubikeys.adoc:135
String age
2 years ago
Last updated
a year ago
Source string age
2 years ago
Translation file
pot/master/pages/using-yubikeys.pot, string 50