PAM_YUBICO(8) PAM (NAME) pam_yubico - YubiKey (SYNOPSIS) pam_yubico [...] (DESCRIPTION) YubiKey (OTP) - HMAC-SHA1. (OPTIONS) debug . debug_file=file . (stdout) . mode=[client|challenge-response] client OTP challenge-response -. client . authfile=file YubiKey . username:first_public_id:second_public_id:... . $HOME/.yubico/authorized_yubikeys . id=id API . key=key base64. API () . YubiCloud : https://upgrade.yubico.com/getapikey alwaysok ( ). try_first_pass PAM . use_first_pass . always_prompt YubiKey . ldap_bind_as_user ( YubiKey+OTP) . nullok LDAP . YubiKey . ldap_starttls (bind) LDAP STARTTLS . TLS . ldap_bind_as_user LDAP. PAM . ldapdn uid_attr . ldap_bind_user ldap_bind_password . urllist=list URL . ykclient_set_url_bases . : https://api1.example.com/wsapi/2.0/verify;https://api2.example.com/wsapi/2.0/verify url=url urllist . URL ykclient_set_url_template . URL : https://api.example.com/wsapi/2.0/verify?id=%d&otp=%s capath=path X509 . https ldaps url ldap_uri . cainfo=file CA (CA bundle) . proxy=proxy . http://, https://, socks4://, socks4a://, socks5:// socks5h:// . socks5h (DNS) . HTTP . : socks5h://user:pass@10.10.0.1:1080 verbose_otp (echo) . . PAM . OpenSSH . ldap_uri=uri URI LDAP ( ldap://localhost). ldap_server=server LDAP ( LDAP ). . ldap_uri . ldapdn=dn (DN) (: ou=users,dc=domain,dc=com). ldap_filter . ldap_clientcertfile=clientcertfile LDAP. ldap_clientkeyfile . ldap_clientkeyfile=clientkeyfile LDAP. ldap_clientcertfile . user_attr=attr LDAP (: cn). yubi_attr=attr LDAP YubiKey. yubi_attr_prefix=prefix LDAP . token_id_length=length OTP ( YubiCloud ). ldap_bind_user=user (bind) LDAP . ldap_bind_password=password LDAP. ldap_filter=filter LDAP LDAP. %u . ldap_cacertfile=cacertfile (CA) LDAP. chalresp_path=path - . $HOME/.yubico/. mysql_server=mysqlserver / mysql. : 10.0.0.1 mysql_port=mysqlport mysql. mysql_user=mysqluser . . mysql_password=mysqlpassword mysql . mysql_database=mysqldatabase . : otp (EXAMPLES) auth sufficient pam_yubico.so id=16 debug auth required pam_yubico.so mode=challenge-response auth required pam_yubico.so id=16 ldap_uri=ldaps://ldap.example.com ldap_filter=(uid=%u) yubi_attr=yubiKeyId (FILES) $HOME/.yubico/authorized_yubikeys authfile YubiKey client . $HOME/.yubico/challenge, $HOME/.yubico/challenge-serial_number chalresp_path challenge-response . chalresp_path challenge username . (BUGS) yubico-pam : https://github.com/Yubico/yubico-pam/issues (SEE ALSO) ykpamcfg(1), pam(7) yubico-pam: https://developers.yubico.com/yubico-pam YubiKey Yubico : http://www.yubico.com yubico-pam Version 2.27 PAM_YUBICO(8)