How I set up OS X to require a Yubikey for local login. (Obsolete)

Update

So funny story. I set all this up, and then one day I forgot my Yubikey and needed to get into the computer.

There is no better test of your own security than getting locked out by your own security.

So it turns out that I hadn’t really thought this through. You can get into single user mode (or whatever Mac OS calls it) with just a password and from there change the config to disable the yubikey module.

I’m leaving this here for posterity, but don’t do it. It’s pointless.

A YubiKey is a small hardware device that offers two-factor authentication with a simple touch of a button. It appears like a USB human interface device (read: keyboard) and under normal conditions, when you press the button, it emits some random characters as if you typed them.

The garbage printed is actually a proprietary one-time-pad which can be verified against a network service.

Challenge and Response

I wanted my mac to require my YubiKey in order to log in locally. Using a OTP that must be verified over the network isn’t going to cut it.

Fortunately yubikeys support a challenge & response mode. In this mode supported software issues a challenge to the Yubikey (some random bytes), and the Yubikey uses the secret key only it knows to sign those random bytes. The signature becomes the response.

The host system can verify that an authorized yubikey is present by validating the signature.

Configuring your Yubikey

Configure your Yubikey for challenge-response. I used the Yubikey Personalization tool and slot #2 of my Yubikey.

Configuring PAM on OSX

PAM is the software that manages the rules for authenticating users. Yubico provide a PAM module the supports Yubikey in Challenge-Response mode.

Install the yubikey PAM module:

brew install yubico-pam

The challenge data are stored per user in ~/.yubico.

mkdir -m0700 -p ~/.yubico
ykpamcfg -2

Dipping a toe in

I was concerned about locking myself out, so to start I only worked on the lock screen. That way if I broke the configuration, a simple reboot would get me logged back in.

The file that controls the rules for unlocking the screen when it is locked is /etc/pam.d/screensaver. I added a line referencing the new PAM module:

    # screensaver: auth account
    auth required /usr/local/Cellar/pam_yubico/2.16/lib/security/pam_yubico.so mode=challenge-response
    auth       optional       pam_krb5.so use_first_pass use_kcminit
    auth       required       pam_opendirectory.so use_first_pass nullok
    account    required       pam_opendirectory.so
    account    sufficient     pam_self.so
    account    required       pam_group.so no_warn group=admin,wheel fail_safe
    account    required       pam_group.so no_warn deny group=admin,wheel ruser fail_safe

If your version of pam_yubico is different than 2.16 you’ll want to specify a slightly different path here.

Taking the plunge

The file that controls the rules for initial login is /etc/pam.d/authorization. I added the same line from the screensaver and all works as expected.

# authorization: auth account
auth required /usr/local/Cellar/pam_yubico/2.16/lib/security/pam_yubico.so mode=challenge-response
auth       optional       pam_krb5.so use_first_pass use_kcminit
auth       optional       pam_ntlm.so use_first_pass
auth       required       pam_opendirectory.so use_first_pass nullok
account    required       pam_opendirectory.so

User Experience

There is no user interface to speak of. There is no little box that prompts you to insert your token. The light starts flashing and you push the button twice.

Caveats

If you use full disk encryption, the key is derived only from the password. This makes it inferior to the old eToken + PGP desktop thing we used to do on Windows.

References