I'm considering using yubikey (5 NFC model) as second factor for couple of Linux hosts. I'm interested in sticking it somewhere in PAM stack, so things like sudo are protected. Most of those hosts are only remote, that is I can't plug they key in the remote host. I have following options:

  1. use yubico-pam with their YubicoCloud verifying every code the key provides. Simple enough to set up and convenient to use (touch to auth) but completely useless for a host that can't talk to Yubico's servers (eg. in a private network without Internet access) and a potential problem for server that loses its network connectivity (eg. crappy uplink).
  2. use pam_oath with HOTP-OATH configured in one of the key's slots. This does away with the dependency on the third party and maintains convince of "touch to auth". On a flip side, there's only room for one secret, so every host would have to use it - if a host is compromised, you need to reissue the secret on all hosts
  3. use pam_oath with yubikey's OATH application. Can have multiple secrets (32?), with the downside that I now need to run ykman oath code ... in order to get the code. This won't work if the client is a Chromebook for example. Plus you need to copy&paste the code.

There's mode=challenge-response in yubico-pam but from what I understand, the key needs to be plugged in directly into the host where this pam stack is running in order to receive the challenge.

Is there any other method that I have missed? Have I missed anything in terms of upsides/downsides and limitations? With just a handful of hosts I'm partial to the second method, but I wonder what are people using for large deployments and large number of hosts?


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.