Local Authentication Using Challenge Response with Yubikey for CentOS 7
2024-10-21 07:48:57
Connect Yubikey ,then initialize YubiKey slot 2:
ykpersonalize -2 -ochal-resp -ochal-hmac -ohmac-lt64 -oserial-api-visible
...
Commit? (y/n) [n]: y
Create /var/yubico directory for challenge file.
sudo mkdir /var/yubico sudo chown root.root /var/yubico
sudo chmod 700 /var/yubico
ykpamcfg -2 -v
...
Stored initial challenge and expected response in '$HOME/.yubico/challenge-123456'.
sudo mv ~/.yubico/challenge-123456 /var/yubico/xiaoxiaoleo-123456
sudo chown root.root /var/yubico/xiaoxiaoleo-123456
sudo chmod 600 /var/yubico/xiaoxiaoleo-123456
TIPs: xiaoxiaoleo is the login user name.
add pam config before the first line /etc/pam.d/login:
auth required pam_yubico.so mode=challenge-response chalresp_path=/var/yubico
Add debug arg for debug infomation:
auth required pam_yubico.so mode=challenge-response debug chalresp_path=/var/yubico
Create yubico pam debug log file:
touch /var/run/pam-debug.log
chmod go+w /var/run/pam-debug.log
SELinux ERROR:
[pam_yubico.c:do_challenge_response(614)] Cannot open file: /var/yubico/test-5212345(No such file or directory )
Error communicating with Yubikey,please check syslog or contact your system administrator
[pam_yubikco.c:display_error(425)] conv returned:'(null)'
[pam_yubico.c:do_challenge_response(673)] Challenge Response failed: No such file or directory
Create SELinux policy :
grep avc /var/log/audit/audit.log | audit2allow -M yubikey
module yubikey 1.0; define(`r_file_perms', `{ getattr open read ioctl lock }') require { type var_t; type local_login_t; } allow local_login_t var_t:file r_file_perms
Compile and install SELinux policy:
checkmodule -M -m -o yubikey.mod yubikey.te
semodule_package -o yubikey.pp -m yubikey.mod
semodule -i yubikey.pp
最新文章
- IOS开发之新浪围脖
- python 第三方模块 转 https://github.com/masterpy/zwpy_lst
- C++:基类和派生类
- 分享一段H264视频和AAC音频的RTP封包代码
- C++ 虚函数表与内存模型
- Android--WebView控件
- mac os vim 乱码
- Python笔记之面向对象
- Git协作流程(转)
- 学号:201521123116 《java程序设计》第二周学习总结
- 使用Mediaplay类写一个播放器
- angular部署到iis出现404解决方案
- 学习笔记TF045:人工智能、深度学习、TensorFlow、比赛、公司
- scp: command not found
- python urllib2对http的get,put,post,delete
- 【重大更新】DevExpress WinForms v18.2新版亮点(七)
- BZOJ 2663: [Beijing wc2012]灵魂宝石
- 高斯—若尔当(约当)消元法解异或方程组+bitset优化模板
- Swift 2.x 升为 swift 3后语法不兼容问题适配
- Linux下一个简单sniffer的实现