Yubikey One Time Passwords for SSH Two Factor

Wikis & How-to Guides
, ,
1

Commands to accompany the video if you want to follow along. This was done on Debian client, Ubuntu host. Commands may differ on other distros.

Install desktop tool to configure Yubikey

# Add repository
sudo add-apt-repository ppa:yubico/stable

# Install OTP GUI
sudo apt-get install yubikey-personalization-gui

Install PAM on host

 sudo add-apt-repository ppa:yubico/stable
 sudo apt-get update
 sudo apt-get install libpam-yubico

Create the authorized yubikeys file to associate yubi ID with system user in format (username):(yubi id) where yubi ID is first 12 characters of the OTP output

sudo vim /etc/ssh/authorized_yubikeys

Add yubikey to PAM configuration

sudo vim /etc/pam.d/sshd

Under PAM configuration (line 1) enter:

auth required pam_yubico.so id=\<client id\> key=\<secret key\> authfile=/etc/ssh/authorized_yubikeys

Modify sshd config

sudo vim /etc/ssh/sshd_config

Change the following directives to ‘yes’:

...
ChallengeResponseAuthentication yes
UsePAM yes
...

Reload systemd daemons since the configuration of sshd changed on disk

sudo systemctl daemon-reload

Restart sshd

sudo systemctl restart sshd

Then simply use ssh to (re)connect to your host and you should be met with a key prompt before the password.

ssh [hostname]
6 Likes
4

“Prison wallet” rotflmao…

2 Likes
5

I love my Yubikey NEO and I feel that you didn’t mention the other uses for one. In my mind the best use for it is 2FA for online services so that each time you log in you either need the yubikey itself (insert then tap button) or have to tap the yubikey to your phones NFC to show the OTP codes in the yubico app. This can be set up for any account that has a QR code for 2FA to be set up. Examples that I have: Discord, google, nintendo, reddit and a whole bunch more accounts. Perhaps this deserves another video with more information about this aspect.

I am surprised these never took off more than they did because to me it is the right level of extra security for the effort without going too tinfoil hat. Plus once the habit is changed it changes for the better imo.

1 Like
6

Prison wallet had me almost spit out my coffee.