mopemope · September 18, 2015 09:32
diff --git a/file0.txt b/file0.txt
 $ packer -S yubikey-personalization yubikey-personalization-gui yubikey-neo-manager
diff --git a/file1.txt b/file1.txt
 $ yubikey-personalization-gui
diff --git a/file10.txt b/file10.txt
 $ ssh -YC ma2@xxxxxxx
 Authenticated with partial success.
 YubiKey for `ma2':
diff --git a/file11.txt b/file11.txt
 auth      sufficient pam_yubico.so  mode=challenge-response chalresp_path=/etc/yubico
diff --git a/file12.txt b/file12.txt
 $ ykpersonalize -2 -ochal-resp -ochal-hmac -ohmac-lt64 -oserial-api-visible
 ...
 Commit? (y/n) [n]: y
 $
diff --git a/file13.txt b/file13.txt
 $ mkdir $HOME/.yubico
 $ ykpamcfg -2 -v
 ...
 Stored initial challenge and expected response in '/home/user/.yubico/challenge-123456'.
 $
diff --git a/file14.txt b/file14.txt
 $ mkdir /etc/yubico
 $ chmod +t /etc/yubico
 $ chmod 777 /etc/yubico
 $ mv /home/user/.yubico/challenge-####### /etc/yubico/username-#######
 ...

diff --git a/file15.txt b/file15.txt
 auth       required   pam_u2f.so           authfile=/etc/u2f_mappings
diff --git a/file16.txt b/file16.txt
 <username1>:<KeyHandle1>,<UserKey1>:<KeyHandle2>,<UserKey2>:...
 <username2>:<KeyHandle1>,<UserKey1>:<KeyHandle2>,<UserKey2>:...
diff --git a/file17.txt b/file17.txt
 $ pamu2fcfg -u <username>  
diff --git a/file18.txt b/file18.txt
 $ sudo ls
 Please touch the device.

diff --git a/file19.txt b/file19.txt
 $ udevadm monitor --environment –udev
diff --git a/file2.txt b/file2.txt
 $ neoman
diff --git a/file20.txt b/file20.txt
 # Yubikey Udev Rule: running a bash script in case your Yubikey is removed
 ACTION=="remove", ENV{ID_VENDOR_ID}=="1050", ENV{ID_MODEL_ID}=="0116", ENV{ID_SERIAL_SHORT}=="00000000000", RUN+="/usr/local/bin/yubikey-lock"
diff --git a/file21.txt b/file21.txt
 #!/bin/bash

 user=`ps aux | grep -v root | grep gdm-x-session | head -n 1 | awk '{print $1}'`
 sessionid=`/bin/loginctl list-sessions | grep ${user} | awk '{print $1}'`

 if [ -z "$(lsusb | grep Yubico)" ]; then
    logger "YubiKey Removed"
    /bin/loginctl lock-session $sessionid
 fi
diff --git a/file3.txt b/file3.txt
 $ packer -S yubico-pam pam_u2f
diff --git a/file4.txt b/file4.txt
 auth      sufficient pam_yubico.so  id={Your ID} key={Your Key} authfile=/etc/yubikey_mappings
diff --git a/file5.txt b/file5.txt
 <first user name>:<Yubikey token ID1>:<Yubikey token ID2>:….
 <second user name>:<Yubikey token ID3>:<Yubikey token ID4>:….
diff --git a/file6.txt b/file6.txt
 $ cccccccgklgcvnkcvnnegrnhgrjkhlkfhdkclfncvlgj
 bash: cccccccgklgcvnkcvnnegrnhgrjkhlkfhdkclfncvlgj: command not found
diff --git a/file7.txt b/file7.txt
 `Modhex encoded: XXXXXXX`
diff --git a/file8.txt b/file8.txt
 auth      required pam_yubico.so  id=xxxxxx key=xxxxxxxxxxxxxxxxxxxxxx authfile=/etc/yubikey_mappings  
 auth      include   system-remote-login
 account   include   system-remote-login
 password  include   system-remote-login
 session   include   system-remote-login
diff --git a/file9.txt b/file9.txt
 ...
 UsePAM yes
 PasswordAuthentication no
 ChallengeResponseAuthentication yes
 AuthenticationMethods publickey,keyboard-interactive
 ...
	$ ssh -YC ma2@xxxxxxx
	Authenticated with partial success.
	YubiKey for `ma2':
	$ ykpersonalize -2 -ochal-resp -ochal-hmac -ohmac-lt64 -oserial-api-visible
	...
	Commit? (y/n) [n]: y
	$
	$ mkdir $HOME/.yubico
	$ ykpamcfg -2 -v
	...
	Stored initial challenge and expected response in '/home/user/.yubico/challenge-123456'.
	$
	$ mkdir /etc/yubico
	$ chmod +t /etc/yubico
	$ chmod 777 /etc/yubico
	$ mv /home/user/.yubico/challenge-####### /etc/yubico/username-#######
	...
	<username1>:<KeyHandle1>,<UserKey1>:<KeyHandle2>,<UserKey2>:...
	<username2>:<KeyHandle1>,<UserKey1>:<KeyHandle2>,<UserKey2>:...
	# Yubikey Udev Rule: running a bash script in case your Yubikey is removed
	ACTION=="remove", ENV{ID_VENDOR_ID}=="1050", ENV{ID_MODEL_ID}=="0116", ENV{ID_SERIAL_SHORT}=="00000000000", RUN+="/usr/local/bin/yubikey-lock"
	#!/bin/bash

	user=`ps aux \| grep -v root \| grep gdm-x-session \| head -n 1 \| awk '{print $1}'`
	sessionid=`/bin/loginctl list-sessions \| grep ${user} \| awk '{print $1}'`

	if [ -z "$(lsusb \| grep Yubico)" ]; then
	logger "YubiKey Removed"
	/bin/loginctl lock-session $sessionid
	fi
	<first user name>:<Yubikey token ID1>:<Yubikey token ID2>:….
	<second user name>:<Yubikey token ID3>:<Yubikey token ID4>:….
	$ cccccccgklgcvnkcvnnegrnhgrjkhlkfhdkclfncvlgj
	bash: cccccccgklgcvnkcvnnegrnhgrjkhlkfhdkclfncvlgj: command not found
	auth required pam_yubico.so id=xxxxxx key=xxxxxxxxxxxxxxxxxxxxxx authfile=/etc/yubikey_mappings
	auth include system-remote-login
	account include system-remote-login
	password include system-remote-login
	session include system-remote-login