rooty/yubico-pam
1
0
Fork 0
mirror of https://github.com/Yubico/yubico-pam.git synced 2025-02-22 00:54:30 +01:00
Code Issues Projects Releases Wiki Activity

Revise ykpamcfg.1.txt man page

Browse Source
This commit is contained in:
Karol Babioch 2018-05-02 14:31:22 +02:00
parent b86e9a2b42
commit 67a40dbd2d
1 changed files with 15 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

30
ykpamcfg.1.txt
View File

@ -12,56 +12,56 @@ ykpamcfg - Manage user settings for the Yubico PAM module
== OPTIONS == OPTIONS
*-1*:: *-1*::
use slot 1. This is the default. Use slot 1. This is the default.
*-2*:: *-2*::
use slot 2. Use slot 2.
*-A* _action_:: *-A* _action_::
choose action to perform. See ACTIONS below. Choose action to perform. See ACTIONS below.
*-p* _path_:: *-p* _path_::
specify output file, default is ~/.yubico/challenge Specify output file, default is `~/.yubico/challenge`.
*-i* _iterations_:: *-i* _iterations_::
number of iterations to use for pbkdf2 of expected response Number of iterations to use for PBKDF2 of expected response.
*-v*:: *-v*::
enable verbose mode. Enable verbose mode.
*-V*:: *-V*::
display version and exit Display version and exit.
*-h*:: *-h*::
display help and exit Display help and exit.
== ACTIONS == ACTIONS
=== add_hmac_chalresp === add_hmac_chalresp
The PAM module can utilize the HMAC-SHA1 Challenge-Response mode found in YubiKeys starting with version 2.2 for *offline authentication*. This action creates the initial state information with the C/R to be issued at the next logon. The PAM module can utilize the HMAC-SHA1 Challenge-response (C/R) mode found in YubiKeys starting with version 2.2 for *offline authentication*. This action creates the initial state information with the C/R to be issued at the next logon.
The utility currently outputs the state information to a file in the current user's home directory (_\~/.yubico/challenge-123456_ for a YubiKey with serial number API readout enabled, and _~/.yubico/challenge_ for one without). The utility currently outputs the state information to a file in the current user's home directory (`~/.yubico/challenge-123456` for a YubiKey with serial number API readout enabled, and `~/.yubico/challenge` for one without).
The PAM module supports a system wide directory for these state files (in case the user's home directories are encrypted), but in a system wide directory, the 'challenge' part should be replaced with the username. Example : _/var/yubico/challenges/alice-123456_. The PAM module supports a system-wide directory for these state files (in case the user's home directories are encrypted), but in a system-wide directory, the 'challenge' part should be replaced with the username. Example: /var/yubico/challenges/alice-123456
To use the system-wide mode, you currently have to move the generated state files manually and configure the PAM module accordingly. To use the system-wide mode, you currently have to move the generated state files manually and configure the PAM module accordingly.
== EXAMPLES == EXAMPLES
First, program a YubiKey for challenge-response on Slot 2: First, program a YubiKey for challenge-response on slot 2:
$ ykpersonalize -2 -ochal-resp -ochal-hmac -ohmac-lt64 -oserial-api-visible $ ykpersonalize -2 -ochal-resp -ochal-hmac -ohmac-lt64 -oserial-api-visible
... ...
Commit? (y/n) [n]: y Commit? (y/n) [n]: y
Now, set the current user to require this YubiKey for logon : Now, set the current user to require this YubiKey for logon:
$ ykpamcfg -2 -v $ ykpamcfg -2 -v
... ...
Stored initial challenge and expected response in '/home/alice/.yubico/challenge-123456'. Stored initial challenge and expected response in '/home/alice/.yubico/challenge-123456'.
Then, configure authentication with PAM for example like this (_make a backup first_) : Then, configure authentication with PAM for example like this (_make a backup first_):
_/etc/pam.d/common-auth_ (from Ubuntu 10.10) : _/etc/pam.d/common-auth_ (from Ubuntu 10.10):
auth required pam_unix.so nullok_secure try_first_pass auth required pam_unix.so nullok_secure try_first_pass
auth [success=1 new_authtok_reqd=ok ignore=ignore default=die] pam_yubico.so mode=challenge-response auth [success=1 new_authtok_reqd=ok ignore=ignore default=die] pam_yubico.so mode=challenge-response