2

Assume you need the OTPs by devices which are separate from the Debian system which generates the codes. Here, the U2F does not work in all cases so I need OTPs. I am trying to add offline OTP functionality by YubiKey Neo in Debian. My idea:

  1. have some key server on your Linux

  2. some frontend to generate OTPs.

I have not found any GUI/UI frontend for the generation of OTPs by apt search .... Things already installed and partially tested

apt search YubiHSM

sudo apt install yubikey-val
sudo apt install python-serial python-crypto
sudo apt install yhsm-tools yhsm-yubikey-ksm yhsm-validation-server yhsm-daemon

I added username:keyID in $HOME/.yubico/authorized_yubikeys. I did not manage to set up any server system in /etc/pam.d/common-auth. Rejected OTP types

  1. [Celada] time-based OTPs (TOPT) because no clock in YubiKey

  2. Ticket #00019568: Their answer says that it is not possible in the following.

    This is not supported by the YubiKey. If you are looking to ask for a new feature request, that is best done at our forum in the Suggestions section (https://forum.yubico.com/viewforum.php?f=12&sid=6d5c3368d99340d20ef691f2146c44c7).

OS: Debian 8.7
Fido U2F: Yubico YubiKey Neo, YubiKey 4 White
Yubico ticket for sequence-based OTPs: #00019568 I want to genarate OTPs by YubiKey Neo. The following thread proposes that OTP should be sequence-based OTPs. How can you genarate such OTPs by YubiKey Neo in Linux Debian 8.7?
Yubico forum thread: How can you genarate OTPs offline by YubiKey in Debian?

Improve this question
6
  • 1
    Instead of using OTPs, you might do better to just use U2F, since your Yubikey token supports it. Then you can just use pam_u2f and call it a day.
    – Celada
    Apr 13, 2017 at 20:24
  • 1
    I guess maybe I'm having trouble understanding your use case. "Debian system which generates the codes" sounds odd. Usually the point is that a token generates the OTPs. Are you looking at OTP standards, like HOTP and TOTP?
    – Celada
    Apr 14, 2017 at 13:05
  • 1
    TOTP requires a clock. Yubikeys don't have clocks.
    – Celada
    Apr 14, 2017 at 13:26
  • 2
    You can't, because it wouldn't be secure. How could the Yubikey trust that it is not being fed a fake clock signal?
    – Celada
    Apr 14, 2017 at 13:45
  • 1
    If you want to use a token that doesn't have a clock then you can't have a time-based OTP. You have to use a sequence-based OTP.
    – Gilles 'SO- stop being evil'
    Apr 14, 2017 at 21:47

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .