Getting the most out of YubiKeys for your business
blog.congruentlabs.co
Getting the most out of YubiKeys for your business
1–10 of 77 posts
Re: Getting the most out of YubiKeys for your business
#2Does anyone use YubiKeys on OSX for business use? I've tried integrating them on my personal mac before, but the U2F PAM experience was pretty clunky, and caused weird messages from services like Keychain that (I guess) couldn't decrypt without normal credentials being provided at logon.
Re: Getting the most out of YubiKeys for your business
#3Anyone know how to use a Yubikey for FIDO or WebAuthN from INSIDE an RDP session?
Re: Getting the most out of YubiKeys for your business
#4Anyone know how to use a Yubikey for FIDO or WebAuthN from INSIDE an RDP session?
I've personally never seen it work that way - usually because RDP doesn't pass through direct USB devices, only their abstracted forms (e.g. smartcards don't get passed through, only the "Smart Card" device registered in the OS, and only if you enable that to be passed through in an mstsc session.
There are products like Silverfort (https://www.silverfort.com/) that can handle agentless auth, and might be able to do that kind of MFA inside an RDP session. But, products like this usually require some 3rd device (i.e. your phone) to perform the MFA action, which is kind of not really just a simple WebAuthn logon...
Re: Getting the most out of YubiKeys for your business
#5Does anyone use YubiKeys on OSX for business use? I've tried integrating them on my personal mac before, but the U2F PAM experience was pretty clunky, and caused weird messages from services like Keychain that (I guess) couldn't decrypt without normal credentials being provided at logon.
[deleted]
Re: Getting the most out of YubiKeys for your business
#6Does anyone use YubiKeys on OSX for business use? I've tried integrating them on my personal mac before, but the U2F PAM experience was pretty clunky, and caused weird messages from services like Keychain that (I guess) couldn't decrypt without normal credentials being provided at logon.
How were you integrating them on your personal OSX system?
Re: Getting the most out of YubiKeys for your business
#7Does anyone use YubiKeys on OSX for business use? I've tried integrating them on my personal mac before, but the U2F PAM experience was pretty clunky, and caused weird messages from services like Keychain that (I guess) couldn't decrypt without normal credentials being provided at logon.
How were you integrating them on your personal OSX system?
Luckily I wrote down the steps I took. Based on this, but the original seems to be gone now: https://nicluo.com/projects/secure-your-mac-with-yubico-u2f-...
brew install pam-u2f
mkdir -p ~/.config/Yubico/
pamu2fcfg > ~/.config/Yubico/u2f_keys
cat ~/.config/Yubico/u2f_keys # should output :
In /etc/pam.d/screensaver
Add to the top:
auth sufficient pam_u2f.so
In /etc/pam.d/authorization
Add to the top:
auth sufficient pam_u2f.soRe: Getting the most out of YubiKeys for your business
#8Virtually every u2f implementation I've ever seen allows otp as a backup, reducing the security of one to the other. U2f is so much nicer than otp but hardware keys have devolved to being convenient not more secure than otp.
Re: Getting the most out of YubiKeys for your business
#9Anyone know how to use a Yubikey for FIDO or WebAuthN from INSIDE an RDP session?
It's kind of a pain, but possible. You have to redirect it as a generic USB device. I wrote a guide here:
https://queensidecastle.com/guides/use-a-yubikey-remotely-ov...
Re: Getting the most out of YubiKeys for your business
#10Why is there so little competition for these? $50 for a key that maybe costs $5 to manufacture (yes, including software development, at their volume) is a little too rich for my blood.