other versions
- jessie-backports 1.0.4-2~bpo8+1
- stretch 1.0.4-2
- testing 1.0.7-1
- unstable 1.0.7-1
PAM_U2F(8) | PAM U2F Module Manual | PAM_U2F(8) |
NAME¶
pam_u2f - Module for U2F authenticationSYNOPSIS¶
pam_u2f [...]DESCRIPTION¶
The module provides U2F authentication against Yubikeys and other compliant authenticators.OPTIONS¶
debugTurns on debugging to STDOUT
origin=origin
Set the origin for the U2F authentication procedure. If
no value is specified, the origin "pam://$HOSTNAME" is used.
appid=appid
Set the application ID for the U2F authentication
procedure. If no value is specified, the same value used for origin is taken
("pam://$HOSTNAME" if also origin is not specified).
authfile=file
Set the location of the file that holds the mappings of
user names to keyHandles and user keys. The format is
username:keyHandle1,public_key1:keyHandle2,public_key2:... the default
location of the file is $XDG_CONFIG_HOME/Yubico/u2f_keys. If the environment
variable is not set, $HOME/.config/Yubico/u2f_keys is used.
nouserok
Set to enable authentication attempts to succeed even if
the user trying to authenticate is not found inside authfile.
alwaysok
Set to enable all authentication attempts to succeed (aka
presentation mode).
max_devices=n_devices
Maximum number of devices allowed per user (default is
24). Devices specified in the authentication file that exceed this value will
be ignored.
interactive
Set to prompt a message and wait before testing the
presence of a U2F device. Recommended if your device doesn’t have
tactile trigger.
manual
Set to drop to a manual console where challenges are
printed on screen and response read from standard input. Useful for debugging
and SSH sessions without U2F-support from the SSH client/server. If enabled,
interactive mode becomes redundant and has no effect.
cue
Set to prompt a message to remind to touch the
device.
EXAMPLES¶
auth sufficient pam_u2f.so debug origin=pam://$HOSTNAME appid=pam://$HOSTNAME auth required pam_u2f.so origin=http://example.com appid=http://example.com authfile=/etc/yubikey_mappingsCAVEATS¶
Using pam-u2f to secure the login to a computer while storing the mapping file in an encrypted home directory, will result in the impossibility of logging into the system. The partition is decrypted after login and the mapping file can not be accessed.BUGS¶
Report pam-u2f bugs in the issue tracker: https://github.com/Yubico/pam-u2f/issuesSEE ALSO¶
pam(7) The pam-u2f home page: https://developers.yubico.com/pam-u2f/ YubiKeys can be obtained from Yubico: http://www.yubico.com/Version 1.0.4 | pam-u2f |