PAM_U2F(8) | PAM U2F Module Manual | PAM_U2F(8) |
NAME¶
pam_u2f - Module for U2F authenticationSYNOPSIS¶
pam_u2f [...]DESCRIPTION¶
The module provides U2F authentication against Yubikeys and other compliant authenticators.OPTIONS¶
debugdebug_file
origin=origin
appid=appid
authfile=file
authpending_file=file
nouserok
openasuser
alwaysok
max_devices=n_devices
interactive
[prompt=your prompt here]
manual
cue
nodetect
EXAMPLES¶
auth sufficient pam_u2f.so debug origin=pam://$HOSTNAME appid=pam://$HOSTNAMEauth required pam_u2f.so origin=http://example.com appid=http://example.com authfile=/etc/yubikey_mappings
CAVEATS¶
Using pam-u2f to secure the login to a computer while storing the mapping file in an encrypted home directory, will result in the impossibility of logging into the system. The partition is decrypted after login and the mapping file can not be accessed.NOTES¶
The "nodetect" option should be used with caution. pam_u2f checks that a key configured for the user is inserted before performing the full tactile authentication. This detection is done by sending a "check-only" authentication request to all inserted tokens to so see if at least one of them responds affirmatively to one or more of the keyhandles configured for the user. By doing this, pam_u2f can avoid emitting the "cue" prompt (if configured), which can cause some confusing UI issues if the cue is emitted followed by the underlying library immediately failing the tactile authentication. This option is also useful to avoid an unintended 1-second delay prior to the tactile authentication caused by versions of libu2f-host <= 1.1.5.If pam_u2f is configured to "cue" and "nodetect", an attacker can determine that pam_u2f is part of the authentication stack by inserting any random U2F token and performing an authentication attempt. In this scenario, the attacker would see the cue message followed by an immediate failure, whereas with detection enabled, the U2F authentication will fail silently. Understand that an attacker could choose a U2F token that alerts him or her in some way to the "check-only" authentication attempt, so this precaution only pushes the issue back a step.
In summary, the detection feature was added to avoid confusing UI issues and to prevent leaking information about the authentication stack in very specific scenario when "cue" is configured. The "nodetect" option was added to avoid buggy sleep behavior in older versions of libu2f-host and for hypothetical tokens that do not tolerate the double authentication. Detection is performed, and likewise "nodetect" honored, regardless of whether "cue" is also specified.
BUGS¶
Report pam-u2f bugs in the issue tracker: https://github.com/Yubico/pam-u2f/issuesSEE ALSO¶
pam(7)The pam-u2f home page: https://developers.yubico.com/pam-u2f/
YubiKeys can be obtained from Yubico: http://www.yubico.com/
Version 1.0.6 | pam-u2f |