This module implements PAM over U2F, providing an easy way to integrate the YubiKey (or other U2F compliant authenticators) into your existing infrastructure.
This project uses autoconf, automake, pkg-config and libtool to achieve portability and ease of use.
In addition, both the Yubico U2F libu2f-host-dev and libu2f-server-dev libaries are needed.
Debian: apt-get install autoconf automake libtool pkg-config libu2f-host-dev libu2f-server-dev --no-install-recommends
If you downloaded a tarball, build it as follows.
$ ./configure $ make
You may check out the sources using Git with the following command:
$ git clone git://github.com/Yubico/pam-u2f.git
This will create a directory pam-u2f. Enter the directory:
$ cd pam-u2f
Autoconf, automake, libtool, and libpam must be installed. AsciiDoc and xsltproc are used to generate the manpages.
Debian: apt-get install autoconf automake libtool libpam-dev libu2f-host-dev libu2f-server-dev asciidoc xsltproc libxml2-utils docbook-xml --no-install-recommends
Generate the build system using:
$ autoreconf --install
Then build as usual, see above under Building.
Once the module is built copy the file pam_u2f.so to the correct
directory for your system. Typically /lib/security/ or
/lib/x86_64-linux-gnu/security/. This is automated by make install
assuming that the pam directory chosen by configure is correct.
If that is not the case it can be specified with ./configure --with-pam-dir=.
Create a file for a new service in /etc/pam.d/ or edit an already
existing one by adding a line similar to this:
auth sufficient pam_u2f.so debug
Supported parameters for the module are:
| debug |
Enables debug output |
| debug_file |
Filename to write debug to, file must exist and be a regular file, or may be one of "stderr", "stdout", or "syslog". STDERR is the default. |
| origin=origin |
Set the origin for the U2F authentication procedure. If no value is specified, the origin "pam://$HOSTNAME" is used. |
| appid=appid |
Set the application ID for the U2F authentication procedure. If no value is specified, the same value used for origin is taken ("pam://$HOSTNAME" if also origin is not specified). |
| authfile=file |
Set the location of the file that holds the mappings of user names
to keyHandles and user keys. The format is
|
| authpending_file=file |
Set the location of the file that is used for touch request notifications.
This file will be opened when pam-u2f starts waiting for a user to touch the device,
and will be closed when it no longer waits for a touch.
Use inotify to listen on these events, or a more high-level tool like yubikey-touch-detector.
Set an empty value in order to disable this functionality, like so: |
| nouserok |
Set to enable authentication attempts to succeed even if the user trying to authenticate is not found inside authfile or if authfile is missing/malformed. |
| openasuser |
Setuid to the authenticating user when opening the authfile. Useful when the user’s home is stored on an NFS volume mounted with the root_squash option (which maps root to nobody which will not be able to read the file). |
| alwaysok |
Set to enable all authentication attempts to succeed (aka presentation mode). |
| max_devices=n_devices |
Maximum number of devices allowed per user (default is 24). Devices specified in the authentication file that exceed this value will be ignored. |
| interactive |
Set to prompt a message and wait before testing the presence of a U2F device. Recommended if your device doesn’t have a tactile trigger. |
| [prompt=your prompt here] |
Set individual prompt message for interactive mode. Watch the square brackets around this parameter to get spaces correctly recognized by PAM. |
| manual |
Set to drop to a manual console where challenges are printed on screen and response read from standard input. Useful for debugging and SSH sessions without U2F-support from the SSH client/server. If enabled, interactive mode becomes redundant and has no effect. |
| cue |
Set to prompt a message to remind to touch the device. |
| nodetect |
Set to skip detecting if a suitable U2F token is inserted before performing the full tactile authentication. This detection was created to avoid emitting the "cue" message if no suitable token exists, because doing so leaks information about the authentication stack if a token is inserted but not configured for the authenticating user. However, it was found that versions of libu2f-user 1.1.5 or less has buggy iteration/sleep behavior which causes a 1-second delay to occur for this initial detection. For this reason, as well as the possibility of hypothetical tokens that do not tolerate this double authentication, the "nodetect" option was added. |
A mapping must be made between the YubiKey token and the user name, see here for details on how to perform the registration using the bundled tool.
There are two ways to do this, either centrally in one file, or individually, where users can create the mapping in their home directories. If the central authorization mapping file is being used, user home directory mappings will not be used and the opposite applies if user home directory mappings are being used, the central authorization mappings file will not be used.
|
Important
|
Using pam-u2f to secure the login to a computer while storing the mapping file in an encrypted home directory, will result in the impossibility of logging into the system. The partition is decrypted after login and the mapping file can not be accessed. |
Create a file e.g. /etc/u2f_mappings., The file must contain
a user name, the number of registered Yubikeys and the information
obtained during the registration procedure.
The mappings should look like this, one per line:
<username1>:<KeyHandle1>,<UserKey1>:<KeyHandle2>,<UserKey2>:... <username2>:<KeyHandle1>,<UserKey1>:<KeyHandle2>,<UserKey2>:...
Now add authfile=/etc/u2f_mappings to your PAM configuration line, so it
looks like:
auth sufficient pam_u2f.so authfile=/etc/u2f_mappings
|
Important
|
On dynamics networks (e.g. where hostnames are set by DHCP), users should not rely on the default origin and appid ("pam://$HOSTNAME") but set those parameters explicitly to the same value. |
Each user creates a ~/.config/Yubico/u2f_keys file inside of their home
directory and places the mapping in that file, the file must have only one
line:
<username>:<KeyHandle1>,<UserKey1>:<KeyHandle2>,<UserKey2>:...
This is much the same concept as the SSH authorized_keys file.
In order to obtain the required information for the authentication procedure, a token should be first registered. This can be done by using the command line configuration tool provided with the module:
$ pamu2fcfg -uusername -opam://myorigin -ipam://myappid
the tool will register a connected token by using the specified origin and
appid. If neither are specified they will default to pam://$HOSTNAME.
During the U2F registration, the user is required to touch the token.
On success the tool prints to standard output a configuration line that
can be directly used with the module. For additional information on the
tool read the relative manpage (man pamu2fcfg)
Multiple devices are supported. If more than one device is specified, authentication against them is attempted sequentially as they are defined in the configuration file of the module. If during an authentication attempt a connected device is removed or a new device is plugged in, the authentication restarts from the top of the list.
This fork has an experimental implementation of passing U2F registration and authentication requests through an SSH Agent. This will allow programs running on a remote system to use your U2F device that is plugged in locally. One possible use case is to require your U2F device to be able to run sudo on a remote system.