Yubikey in authentication in CentOS 8

Issues related to applications and software problems and general support
Post Reply
rcgrar014
Posts: 4
Joined: 2023/09/18 11:51:17

Yubikey in authentication in CentOS 8

Post by rcgrar014 » 2023/09/18 12:23:52

Good morning.

I am in a project where we want to use a Yubikey like second factor to authenticate the users in CentOS.
We have a closed network (without internet connection) with several CentOS (clients) that authenticate users against a CentOS server with an OpenLDAP. We are using the gnome version.
In that way, We tried to use the OTP mode of yubikeys, but we need access to Internet to send and receive requests from an API.
Later we tried to use the challenge-responde mode, but is only valid for local users (not users located in an openLDAP).
Now, we are trying to use the PIV mode, with a PKI and make the authentication with smartcards, but we can't reach that the VM where we are testing read the Yubikeys obtaining a message that said (This smartcard is not valid, please insert another smartcard).

How can use Yubikeys in our project?

Thanks and regards.

rcgrar014
Posts: 4
Joined: 2023/09/18 11:51:17

Re: Yubikey in authentication in CentOS 8

Post by rcgrar014 » 2023/09/27 07:30:21

any help?? :D

User avatar
TrevorH
Site Admin
Posts: 33263
Joined: 2009/09/24 10:40:56
Location: Brighton, UK

Re: Yubikey in authentication in CentOS 8

Post by TrevorH » 2023/09/27 09:26:04

I am not sure why challenge-response would not work for LDAP users. Is that actually documented somewhere?
The future appears to be RHEL or Debian. I think I'm going Debian.
Info for USB installs on http://wiki.centos.org/HowTos/InstallFromUSBkey
CentOS 5 and 6 are deadest, do not use them.
Use the FAQ Luke

rcgrar014
Posts: 4
Joined: 2023/09/18 11:51:17

Re: Yubikey in authentication in CentOS 8

Post by rcgrar014 » 2023/09/27 11:38:08

Hi Trevor.

I followed the instructions of our partnership in my country.

A month aggo tested the mode challenge-response but I don't know if my procedure was correct.
With a OpenLDAP user authenticated in a CentOS client with a password:
- I activated the mode challenge-response.
- A file in $HOME/yubico was created, I changed the name of the file generated with the username (OpenLDAP username).
- I moved it to a different location (/var/yubico).
- And I modified the password-auth file in pam.d to add a line with the attribuites mode challenge-response and chalresp_path with the path where I moved the file (/var/yubico).

With a reboot I tried to login with the openLDAP user and the authentication failed.

But with local users, the mode worked correctly.

Thanks and regards.

rcgrar014
Posts: 4
Joined: 2023/09/18 11:51:17

Re: Yubikey in authentication in CentOS 8

Post by rcgrar014 » 2023/10/17 09:18:23

Good morning!

Any idea?

Thanks

Post Reply