I am attempting to configure OpenSSH on a Debian based system to always require a yubikey TOTP AND either a publickey OR password.

I realise other combinations are possible through AuthenticationMethods, but this combination does not appear to be possible with that method.

If password were independent of PAM, sshd_config would look like this:

UsePAM yes
ChallengeResponseAuthentication yes
AuthenticationMethods publickey,keyboard-interactive password,keyboard-interactive

/etc/pam.d/sshd must include the Yubico PAM for SSHD to utilise it:

auth required pam_yubico.so id=foo key=bar

The above example will fail to achieve the desired combinations because password-auth and yubico-auth are performed through the same mechanism (PAM) defined in the same file (pam.d/sshd) using the same interface (password or keyboard-interactive), with the only difference being the later's capability to handle multiple user inputs via challenge-response.

For example publickey,keyboard-interactive results in publickey + yubikey + password and password,keyboard-interactive results in yubikey + password + yubikey + password - except it is not possible to satisfy due to passwords single input limit. Disabling common-auth in pam.d/sshd will satisfy the first combination but make the second impossible.

The crux of this problem seems to be both the inability of OpenSSH AuthenticationMethods to separate PAM requirements from each other, and the inability of PAM to understand SSH publickey auth (which would allow the "publickey OR password" condition to be defined in PAM instead and just use keyboard-interactive alone in sshd).

Is there another way to achieve this with OpenSSH and pam_yubico.so?

Alternatively if it were possible to distinguish password mode from keyboard-interactive mode from within pam.d/sshd then pam_succeed_if.so could be used to to exclude pam_yubico.so or common-auth respectively.

  • Why don't you use public key with the Yubikey? This includes the best of all worlds: public key authentication, requires a secure token with a well protected private key and a password (the Yubikey PIN). – Johan Myréen Dec 6 at 16:13
  • I am, i'm just also trying to allow password + yubikey for convenience when working on different machines... walking around with a private key on a usb stick + a yubikey is not secure and it's difficult to add a public key from each potential machine you are working on in advance of using it... I will unfortunately end up reverting to password+yubkey on it's own if I can't find a way for it to co-exist with optional publickeys. – Thomas Brierley Dec 6 at 16:23
  • The private key is on the Yubikey, no need to carry around a separate usb stick for that. The private key is secured on the Yubikey, you can't get it out of it even if you wanted to. The public key should of course be put on all servers you want to access, but that needs to be done anyway. – Johan Myréen Dec 6 at 16:56
  • I'm talking about a separate private key, a normal RSA private key kept in .ssh (i know it's posisble to use GPG agent to store private keys on the yubikey but that's not what i'm doing here). The yubikey is being used for yubico TOTP through pam_yubico not SSH key pair through GPG agent. – Thomas Brierley Dec 6 at 16:59
  • Well, what I'm suggesting is the use of a normal RSA key, but stored in and operated upon on the Yubikey and the corresponding public key stored on the servers I want to access. IMO, this should be secure enough without the need to use any additional one-time password. This is what I use, without a GPG agent or any other agent. – Johan Myréen Dec 6 at 17:13

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.