ykpamcfg(1) General Commands Manual ykpamcfg(1)NAME
ykpamcfg - Manage user settings for the Yubico PAM module.
SYNOPSIS
ykpamcfg [-1 | -2] [-A] [-v] [-h]
OPTIONS -1 use slot 1. This is the default.
-2 use slot 2.
-A action
choose action to perform. See ACTIONS below.
-v enable verbose mode.
ACTIONS
add_hmac_chalresp
The PAM module can utilize the HMAC-SHA1 Challenge-Response mode found in YubiKeys starting with version 2.2 for offline authentica-
tion. This action creates the initial state information with the C/R to be issued at the next logon.
The utility currently outputs the state information to a file in the current user's home directory (~/.yubico/challenge-123456 for a
YubiKey with serial number API readout enabled, and ~/.yubico/challenge for one without).
The PAM module supports a system wide directory for these state files (in case the user's home directories are encrypted), but in a
system wide directory, the 'challenge' part should be replaced with the username. Example : /var/yubico/challenges/alice-123456.
To use the system-wide mode, you currently have to move the generated state files manually and configure the PAM module accordingly.
EXAMPLE
First, program a YubiKey for challenge response on Slot 2 :
$ ykpersonalize -2 -ochal-resp -ochal-hmac -ohmac-lt64 -oserial-api-visible
...
Commit? (y/n) [n]: y
$
Now, set the current user to require this YubiKey for logon :
$ ykpamcfg -2 -v
...
Stored initial challenge and expected response in '/home/alice/.yubico/challenge-123456'.
$
Then, configure authentication with PAM for example like this (make a backup first) :
/etc/pam.d/common-auth (from Ubuntu 10.10) :
auth required pam_unix.so nullok_secure try_first_pass
auth [success=1 new_authtok_reqd=ok ignore=ignore default=die] pam_yubico.so mode=challenge-response
auth requisite pam_deny.so
auth required pam_permit.so
auth optional pam_ecryptfs.so unwrap
BUGS
Report ykpamcfg bugs in the issue tracker <http://code.google.com/p/yubico-pam/issues/list>
SEE ALSO
The yubico-pam home page <http://code.google.com/p/yubico-pam/>
YubiKeys can be obtained from Yubico <http://www.yubico.com/>.
yubico-pam March 2011 ykpamcfg(1)
Check Out this Related Man Page
yhsm-import-keys(1) General Commands Manual yhsm-import-keys(1)NAME
yhsm-import-keys - import YubiKey secrets to YubiHSM
SYNOPSIS
yhsm-import-keys --key-handles ... [options]
DESCRIPTION
Read YubiKey token data from standard input, and store it in files or in the YubiHSM internal database.
The default mode is to turn each YubiKey secret into an AEAD (Authenticated Encryption with Associated Data) block that is stored in a file
on the host computer (one file per YubiKey). This enables validation of virtually unlimited numbers of YubiKey's OTPs.
If --internal-db is used, the YubiKey secret will be stored inside the YubiHSM, and complete validation (including counter management) will
be done inside the YubiHSM. The internal database is currently limited to 1024 entrys.
OPTIONS -D, --device
device file name (default: /dev/ttyACM0)
-v, --verbose
enable verbose operation
--debug
enable debug printout, including all data sent to/from YubiHSM
--public_id_chars num
number of chars to pad public id to (default: 12)
--key-handles kh
key handles to use for decoding OTPs. Examples : "1", "0xabcd"
--output-dir dir, --aead-dir dir, -O dir
base directory for AEADs (default: /var/cache/yubikey-ksm/aeads)
--internal-db
add entrys to YubiHSM internal database, rather than creating AEAD files
INPUT FORMAT
The format of the input matches the export format of various Yubico tools, notably the PHP based soft KSM <http://code.google.com/p/
yubikey-ksm/>.
An example file, with a single entry for id 4711 would be :
# ykksm 1
123456,ftftftcccc,534543524554,fcacd309a20ce1809c2db257f0e8d6ea,000000000000,,,
(seqno, public id, private uid, AES key, dunno,,,)
The #ykksm 1 is a file marker, and has to be on the very first line of input.
BUGS
Report python-pyhsm/yhsm-import-keys bugs in the issue tracker <https://github.com/Yubico/python-pyhsm/issues/>
SEE ALSO
The python-yubico home page <https://github.com/Yubico/python-pyhsm/>
YubiHSMs can be obtained from Yubico <http://www.yubico.com/>.
python-pyhsm December 2011 yhsm-import-keys(1)