pam_u2f - Module for U2F authentication
The module provides U2F authentication against Yubikeys and other compliant
Turns on debugging to STDOUT
Set the origin for the U2F authentication
procedure. If no value is specified, the origin "pam://$HOSTNAME" is
Set the application ID for the U2F
authentication procedure. If no value is specified, the same value used for
origin is taken ("pam://$HOSTNAME" if also origin is not
Set the location of the file that holds the
mappings of user names to keyHandles and user keys. The format is
username:keyHandle1,public_key1:keyHandle2,public_key2:... the default
location of the file is $XDG_CONFIG_HOME/Yubico/u2f_keys. If the environment
variable is not set, $HOME/.config/Yubico/u2f_keys is used.
Set to enable authentication attempts to
succeed even if the user trying to authenticate is not found inside
Set to enable all authentication attempts to
succeed (aka presentation mode).
Maximum number of devices allowed per user
(default is 24). Devices specified in the authentication file that exceed this
value will be ignored.
Set to prompt a message and wait before
testing the presence of a U2F device. Recommended if your device
doesn’t have tactile trigger.
Set to drop to a manual console where
challenges are printed on screen and response read from standard input. Useful
for debugging and SSH sessions without U2F-support from the SSH client/server.
If enabled, interactive mode becomes redundant and has no effect.
Set to prompt a message to remind to touch the
auth sufficient pam_u2f.so debug origin=pam://$HOSTNAME appid=pam://$HOSTNAME
auth required pam_u2f.so origin=http://example.com appid=http://example.com
Using pam-u2f to secure the login to a computer while storing the mapping file
in an encrypted home directory, will result in the impossibility of logging
into the system. The partition is decrypted after login and the mapping file
can not be accessed.
Report pam-u2f bugs in the issue tracker:
The pam-u2f home page: https://developers.yubico.com/pam-u2f/
YubiKeys can be obtained from Yubico: http://www.yubico.com/