Security of yubikey challenge-response file

Help
1

After enabling challenge-response for my yubikeys using ykpamcfg -2 -v, I noticed that the file created has permissions 600. Does this mean I shouldn’t commit this file to a public git repo unencrypted?

2

Although it doesn’t contain any “secrets”, it is not something I would commit to a public git repo unencrypted. It is, after all, authentication state that PAM relies on. You could use git-crypt if you do want to back it up, or better, don’t back it up using vcs at all. Authentication state isn’t something that needs to be version controlled.

3

I was initially using pam_u2f, but for some reason that doesn’t seem to allow me to use my yubikey to log into and use sudo with new hosts, so I thought I’d have better luck with the older method. pam_u2f seems to require me to set it up with every new machine.

4

Afaik you have to run pamu2fcfg on every machine only if you use the default configuration which uses pam://hostname for the relying party id. You could change this to use some other value, and then specify that in the pam_u2f module config, that way you only need to run pamu2fcfg once and copy the file over.

5

Hmm… Could you give me a small example of how to do this in a config? Little confused about it…

6

You should check out security.pam.u2f.settings.origin

By default pam-u2f module sets the origin to pam://$HOSTNAME.

Setting origin to an host independent value will allow you to reuse credentials across machines

When using pamu2fcfg, you can specify your application ID with the -o flag.

1 Like
7

Can it be any random string? Or does it have to be a URI of sorts?

8

I think it can be pam://anything

9

Interesting… I’m not entirely sure what happened, but I can no longer use sudo nor login with my yubikey when using this method and a global u2f auth file…

10

Did you enable security.pam.u2f.enable and set the origin to the same thing you used for pamu2fcfg -o <origin>?

11

… Whoops. Forgot the -o flag. Be right back.

12

Yep. That did the trick for the current system. I’ll test it out on the ISOs and report back.

13

copying the file should work on new machines now

14

Got it. Now if only I can get it to work without touching the contact… Any tips on how I can go about that?

15

As far as I understand yubikeys, touching the contact is a requirement. The key itself can not work without that confirmation.

16

Hmm… From the wiki:

To automatically login, without having to touch the key, omit the --touch option.

Is there no such thing for pam_u2f?

17

There is userpresence=0 that can be set with security.pam.u2f.settings in NixOS.

If your key is old, this might not work.

1 Like
18

Nope! It worked! Now I just need to remember to generate the codes with the appropriate flags if I want to recreate them.

19

Thanks to everyone for all the help!