YubiKey Support

This article describes how to set up a server for YubiKey authentication as a second authentication factor.

The FIDO2-based SSH keys article describes how to use Yubikey with hardware-based SSH keys.

1 – Run to set up required packets:

sudo add-apt-repository ppa:yubico/stable
sudo apt-get update
sudo apt-get install libpam-yubico

sudo yum install pam_yubico

sudo yum install epel-release
sudo yum install pam_yubico

2 – Open /etc/passwd and add to the end of it:

<username>:<YubiKey token ID>

where username is the name of user who is going to authorize with YubiKey, and YubiKey token ID is a user's YubiKey token identification, e.g.:

pam_user:cccccchvjdse

If you have several Yubikey tokens for one user, add YubiKey token ID of the other devices separated with :, e.g. with 3 Yubikey tokens:

pam_user:cccccchvjdse:cccccchvtbdr:ccccccundggr

3 – Create a mapping file, e.g. /var/yubico_passwd.

The file should contain a single record:

<user name>:<YubiKey token ID>

If you have several Yubikey tokens for one user, add YubiKey token ID of the other devices separated with :, e.g. with 3 Yubikey tokens:

pam_user:cccccchvjdse:cccccchvtbdr:ccccccundggr

4 – Open /etc/pam.d/sshd and add to the very beginning:

auth required pam_yubico.so id=CLIENT_ID debug authfile=pathToMappingFile

You can get the CLIENT_ID parameter value at https://upgrade.yubico.com/getapikey; pathToMappingFile is the path to the mapping file (/var/yubico_passwd).

5 – Open /etc/ssh/sshd_config and set the following parameters:

PubkeyAuthentication no
HostbasedAuthentication no
PermitEmptyPasswords no
ChallengeResponseAuthentication yes
PasswordAuthentication no
UsePAM yes

6 – Then restart the server using the ssh command:

sudo service ssh restart

From now on, during authorization, the user should be asked for the YubiKey code.

System Requirements

Authorize with YubiKey