Passwordless Logins with Yubikey
adl1995.github.io
Passwordless Logins with Yubikey
1–10 of 66 posts
Re: Passwordless Logins with Yubikey
#2Any way to do it with an older type of USB token? Like Safenet eTokens?
Re: Passwordless Logins with Yubikey
#3I just bought two yubikeys; a month later, I returned both. Here is a (major) problem. On a ubuntu box, I installed `libpam-u2f` and set it up for one user account. Turns out it breaks all other user accounts on this ubuntu box, meaning no other user could log in without the key. I contacted their support. No solution.
Re: Passwordless Logins with Yubikey
#4Any way to do it with an older type of USB token? Like Safenet eTokens?
The auto lock on device removal with udev rule would be the same idea, in fact you could use any USB device like a basic flash drive if you wanted. Changing PAM's login to use the device for login would require a bit more device-specific stuff--I'd search around to see if Safenet already provides a module to drive PAM auth.
Re: Passwordless Logins with Yubikey
#5Alternate title: guide to changing your single factor authentication from "something you know" to "something you have."
Re: Passwordless Logins with Yubikey
#6Any way to do it with an older type of USB token? Like Safenet eTokens?
The auto lock on device removal with udev rule would be the same idea, in fact you could use any USB device like a basic flash drive if you wanted. Changing PAM's login to use the device for login would require a bit more device-specific stuff--I'd search around to see if Safenet already provides a module to drive PAM auth.
This pam_usb fork can be used to set up any USB for authentication: https://www.linuxuprising.com/2021/02/how-to-login-with-usb-...
Re: Passwordless Logins with Yubikey
#7Cool. Now where's the guide to embed NFC enabled yubikeys in your hand?
Re: Passwordless Logins with Yubikey
#8I feel like these devices generally give the illusion of security while really giving an adversary a single device to target. As another user had suggested, using udev rules and some device encryption would likely be a much better option... if not as an alternative, at least in conjunction with something like this.
Re: Passwordless Logins with Yubikey
#9Alternate title: guide to changing your single factor authentication from "something you know" to "something you have."
"Something you have" is generally an improvement over "something you know" for most people's account security.
You have to remember where we are starting from - most people are still using the same password across all their accounts.
Re: Passwordless Logins with Yubikey
#10Alternate title: guide to changing your single factor authentication from "something you know" to "something you have."
"Something you have" is generally an improvement over "something you know" for most people's account security. You have to remember where we are starting from - most people are still using the same password across all their accounts.
How is that? Everybody living in my house can get my Yubikey yet doesn't know my password. If I get robbed, my bank account is still (relatively) safe.