tr3buchet tr3buchet

the grand idea

I like public key auth. I feel safer using them instead of a username and password login. But, I might not have my private key with me at a time where I need access.

I started using yubikey with LastPass and since I have it always on my keychain, I decided to find more ways to make use of it.

I wasn't originally aware, but if you pass a private key to ssh and sshd is configured to accept a key, it appears pam isn't used. Your authorized keys are checked and you are logged in. If you don't pass a private key, ssh falls back to the more standard un*x style login found in /etc/pam.d/sshd. This is where we'll add the yubikey pam. I am currently unaware of a way to use both public key auth and yubikey for login.

These steps worked for me on debian squeeze/wheezy.

more info at the yubico-pam github repo

make sure any needed utilities are installed

sudo aptitude install debootstrap coreutils util-linux e2fsprogs

get usb device

df -h

	(trey\|n3va)~/nova> cat novarc
	NOVA_KEY_DIR=$(pushd $(dirname $BASH_SOURCE)>/dev/null; pwd; popd>/dev/null)
	export EC2_ACCESS_KEY="admin:openstack"
	export EC2_SECRET_KEY="5a7fc8fe-4029-4046-82fc-b8b45a5ef0e8"
	export EC2_URL="http://10.127.4.150:8773/services/Cloud"
	export S3_URL="http://10.127.4.150:3333"
	export EC2_USER_ID=42 # nova does not use user id, but bundling requires it
	export EC2_PRIVATE_KEY=${NOVA_KEY_DIR}/pk.pem
	export EC2_CERT=${NOVA_KEY_DIR}/cert.pem
	export NOVA_CERT=${NOVA_KEY_DIR}/cacert.pem

	### note
	I installed keyring with pip install --user, so my keyring binary is at ~/.local/bin/keyring

	# add public github token to keyring
	[trey\|d3v ~]% keyring set gister public_oauth
	Password for 'public_oauth' in 'gister': <paste github oauth token here>
	[trey\|d3v ~]% keyring get gister public_oauth
	your_token_will_be_displayed_if_you_do_this

	# add private github token to keyring

	[trey\|d3v ~/git/gister]% curl -u 'your_user_name' -d '{"scopes":["gist"],"note":"gister script test"}' https://api.github.com/authorizations
	{
	"created_at": "2012-01-08T03:19:47Z",
	"app": {
	"url": "http://developer.github.com/v3/oauth/#oauth-authorizations-api",
	"name": "gister script test (API)"
	},
	"note": "gister script test",
	"url": "https://api.github.com/authorizations/102557",
	"token": "34v098n3gv09n8345983458g493fm2fm245n03v",

	from datetime import datetime
	import time
	import json


	class A(object):
	def __init__(self, wizards=12, goats='A lot', time_stamp=None):
	self.wizards = wizards
	self.goats = goats
	self.time = time_stamp or datetime.now()

	### Keybase proof

	I hereby claim:

	* I am tr3buchet on github.
	* I am tr3buchet (https://keybase.io/tr3buchet) on keybase.
	* I have a public key whose fingerprint is 9B3A 9015 9077 E86D 02FE 9A67 E4CB 73E4 E1A7 330E

	To claim this, I am signing this object:

tr3buchet tr3buchet

the grand idea

make sure any needed utilities are installed

get usb device

useful links

find your device