GSP
Quick Navigator

Search Site

Unix VPS
A - Starter
B - Basic
C - Preferred
D - Commercial
MPS - Dedicated
Previous VPSs
* Sign Up! *

Support
Contact Us
Online Help
Handbooks
Domain Status
Man Pages

FAQ
Virtual Servers
Pricing
Billing
Technical

Network
Facilities
Connectivity
Topology Map

Miscellaneous
Server Agreement
Year 2038
Credits
 

USA Flag

 

 

Man Pages


Manual Reference Pages  -  PAM_YUBICO (8)

NAME

pam_yubico - Module for YubiKey authentication

CONTENTS

Synopsis
Description
Options
Examples
Bugs

SYNOPSIS

pam_yubico [...]

DESCRIPTION

The module is for authentication of YubiKeys, either with online validation of OTP, or offline validation with HMAC-SHA1 challenge-response.

OPTIONS

debug Turns on debugging to STDOUT
mode=[client|challenge-response]
  Set the mode of operation, client for OTP validation and challenge-response for challenge-response validation, client is the default.
authfile=file
  Set the location of the file that holds the mappings of Yubikey token IDs to user names. The format is username:first_public_id:second_public_id:... default location of the file is $HOME/.yubico/authorized_yubikeys.
id=id Set to your client identity.
key=key
  Set to your client key in base64 format. The client key is also known as API key, and provides integrity in the communication between the client (you) and the validation server. If you want to get one for use with the default YubiCloud service, visit this URL:
\(laURL: https://upgrade.yubico.com/getapikey/ \(ra
alwaysok
  Set to enable all authentication attempts to succeed (aka presentation mode).
try_first_pass
  Before prompting the user for their password, the module first tries the previous stacked module´s password in case that satisfies this module as well.
use_first_pass
  The argument use_first_pass forces the module to use a previous stacked modules password and will never prompt the user - if no password is available or the password is not appropriate, the user will be denied access.
urllist=list
  List of URL templates to be used. This is set by calling ykclient_set_url_bases. The list should be in the format
\(laURL: https://api1.example.com/wsapi/2.0/verify;https://api2.example.com/wsapi/2.0/verify \(ra
url=url
  This option should not be used, please use the urllist option instead. Set the URL template to use, this is set by calling ykclient_set_url_template. The URL should be set in the format
\(laURL: https://api.example.com/wsapi/2.0/verify?id=%d&otp=%s \(ra
capath=path
  Specify the path where X509 certificates are stored. This is required if ’https’ or ’ldaps’ are used in ’url’ and ’ldap_uri’ respectively.
verbose_otp
  This argument is used to show the OTP (One Time Password) when it is entered, i.e. to enable terminal echo of entered characters. You are advised to not use this, if you are using two factor authentication because that will display your password on the screen. This requires the service using the PAM module to display custom fields. For example, OpenSSH requires you to configure "ChallengeResponseAuthentication no".
ldap_uri=uri
  Specify the LDAP server URI (e.g. ldap://localhost).
ldap_server=server
  Specify the LDAP server host (default LDAP port is used). Deprecated. Use ldap_uri instead.
ldapdn=dn
  The dn where the users are stored (eg: ou=users,dc=domain,dc=com).
user_attr=attr
  The LDAP attribute used to store user names (eg:cn).
yubi_attr=attr
  The LDAP attribute used to store the Yubikey id.
yubi_attr_prefix=prefix
  The prefix of the LDAP attribute’s value, in case of a generic attribute, used to store several types of ids.
token_id_length=length
  Length of ID prefixing the OTP (this is 12 if using the YubiCloud).

EXAMPLES

auth sufficient pam_yubico.so id=16 debug
auth required pam_yubico.so mode=challenge-response
 

BUGS

Report yubico-pam bugs in the issue tracker \(laURL: https://github.com/Yubico/yubico-pam/issues/ \(ra

SEE ALSO

The yubico-pam home page \(laURL: https://developers.yubico.com/yubico-pam/ \(ra

ykpamcfg(1), pam(7)

YubiKeys can be obtained from Yubico \(laURL: https://www.yubico.com/ \(ra.

Search for    or go to Top of page |  Section 8 |  Main Index


yubico-pam PAM_YUBICO (8) October 2013

Powered by GSP Visit the GSP FreeBSD Man Page Interface.
Output converted with manServer 1.07.