rooty/yubico-pam
1
0
Fork 0
mirror of https://github.com/Yubico/yubico-pam.git synced 2025-02-27 06:54:15 +01:00
Code Issues Projects Releases Wiki Activity

rename to be consistent with other docs

fredrikt 2012-05-09 01:17:40 -07:00
parent 043941c753
commit 88093bc2b0
1 changed files with 6 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
Setting-up-your-YubiKey-for-challenge-response-authentication-(on-Max-OS-X).md → ChallengeResponse-(on-Mac-OS-X).md

@ -1,13 +1,15 @@
# Setting up your YubiKey for challenge response authentication (on Max OS X)
This article explains the process to get the challenge-response authentication possible with newer YubiKeys working on Mac OS X. Since Mac OS X uses PAM like most other Unix/POSIX systems do, most of this should apply to other operating systems, too.
# Getting yubico-pam
### Getting yubico-pam
First you will have to install yubico-pam and its dependencies required for challenge-response authentication. Use your distribution's package manager to get it, or build from source. If you're on OS X you can use [MacPorts](http://www.macports.org/) to install yubico-pam:
sudo port install yubico-pam
**Note**: This will probably not work in non-superuser installations of MacPorts, because it needs to place the yubico PAM module into `/usr/lib/pam`.
# Configuring your YubiKey
### Configuring your YubiKey
The next step would be to set up your YubiKey for challenge-response authentication, if you haven't done so already. Although this is possible with the command line `ykpersonalize` tool, the GUI "YubiKey Personalization Tool" is a more comfortable way to do this.
1. Plug in your YubiKey and start the YubiKey Personalization Tool
@ -25,7 +27,7 @@ Apparently Yubico-OTP mode doesn't work with yubico-pam at the moment.
You won't need this key again, it's sufficient to have it on your YubiKey. Note that the YubiKey Personalization Tool by default logs the key to configuration_log.csv in your home directory. Consider turning this off in the settings before writing or shredding the file after writing.
8. Click "Write Configuration"
# Configuring your user account to accept the YubiKey
### Configuring your user account to accept the YubiKey
After setting up your YubiKey you need to configure your account to accept this YubiKey for authentication. To do this, open a terminal and run
# create the directory where ykpamcfg will store the initial challenge
@ -41,7 +43,7 @@ This step will create a file with a challenge and the expected response (that ca
[1]: This is also the reason why you should avoid having copies of the key in other places than your YubiKey!
# Configuring your system to use Yubico PAM for authentication
### Configuring your system to use Yubico PAM for authentication
Linux, Solaris, OS X and most BSD variants use the [Pluggable Authentication Modules (PAM)](http://en.wikipedia.org/wiki/Pluggable_Authentication_Modules) framework to handle authentication. Using PAM you can specify which modules are used for authentication of users and which of them are required, optional and/or sufficient to authenticate a user. Using PAM you can for example set up multiple-factor authentication, by chaining multiple required modules.
PAM is configured through files in `/etc/pam.d` on most systems. Each file in this directory is used for a specific service, i.e. the file `/etc/pam.d/sudo` is used to authenticate users for the `sudo` program. Debian, for example, uses include directives in these files to have a central place to configure authentication; in this case we are not using this on purpose, because challenge-response authentication doesn't work remotely (e.g. via SSH), so we only want to configure it for services we use when on site.