So I've got this slick little yubikey and I want to add an additional layer of security when authenticating ssh sessions. On the server side I've already disabled password authentication and only permit the use of ssh keys when logging in.

The problem is, after configuring sshd and PAM for yubikey auth, sshd still only requires an ssh key, I'm never asked to provide a response from the yubikey.

How do I require both and ssh key and a yubikey?

(ubuntu 14.04 - trusty)


auth    required    pam_yubico.so mode=client try_first_pass id=<id> key=<secret>
auth    [success=1 default=ignore]  pam_unix.so nullok_secure try_first_pass
# here's the fallback if no module succeeds
auth    requisite           pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
auth    required            pam_permit.so
# and here are more per-package modules (the "Additional" block)
auth    optional            pam_cap.so
# end of pam-auth-update config



PasswordAuthentication no
ChallengeResponseAuthentication yes
UsePAM yes
  • BTW, if you don't get a satisfactory answer in a couple days, ping me and I'll put a healthy bounty on the question. I have rep to burn, and I'm interested in this answer as well. :) – EEAA Dec 10 '15 at 6:03

Ok, I kept at it and I think I've come up with a reasonable solution. The primary thing I was previously missing was sshd's AuthenticationMethods publickey,password. This enforces the requirement for both a publickey and a password -- "password"s now being handled by PAM->auth-yubi. Additional changes were also needed, see below:

(ubuntu 14.04 - trusty):


auth    required pam_yubico.so mode=client try_first_pass id=<id> key=<key>

Note: you can obtain your access ID and secret key here


# Standard Un*x authentication.
#@include common-auth

# Yubikey auth
@include yubi-auth


UsePAM yes
ChallengeResponseAuthentication no
AuthenticationMethods publickey,password
PasswordAuthentication yes

service ssh restart


SSH from a remote host without a public key

root@0a6442bcb21c:/# ssh ben@
The authenticity of host ' (' can't be established.
ECDSA key fingerprint is ea:2a:e3:98:35:72:66:b1:e0:65:6b:3f:60:8a:af:ab.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '' (ECDSA) to the list of known hosts.
Permission denied (publickey).

SSH from a remote host with a public key

$ ssh ben@
Authenticated with partial success.
ben@'s password:
Welcome to Ubuntu 14.04.3 LTS (GNU/Linux 3.19.0-33-generic x86_64)


It would be nice to see "Yubikey Auth:" instead of "password:" from the remote ssh server when authenticating.

What happens when the ssh server is unable to contact yubico's auth verification system? An ideal solution would be entirely self-contained.

Comments and suggestions appreciated.


Setting up 2FA with Yubikey can be tricky (thought there is openssh patch for U2F), but the easiest way is probably the one described on Yubico official website.

It is basically the way of storing your private key on the Yubikey and protecting it with PIN. It is not exactly the 2FA you are described (but it is something what you have and and what you know), but it increases the security even more (Yubikey locks after some unsuccessful tries).


OPENSC_LIBS=`locate opensc-pkcs11.so`
yubico-piv-tool -s 9a -a generate -o public.pem
yubico-piv-tool -a verify-pin -P 123456 -a selfsign-certificate -s 9a \
  -S "/CN=SSH key/" -i public.pem -o cert.pem
yubico-piv-tool -a import-certificate -s 9a -i cert.pem
ssh-keygen -D $OPENSC_LIBS/opensc-pkcs11.so -e
ssh -I $OPENSC_LIBS/opensc-pkcs11.so user@remote.example.com
  • "I believe the pam module is able to authenticate only local Yubikeys, not the ones over ssh" - I'm not entirely sure what you mean by that. Do you mean that a Yubikey can't be used to authenticate to a remote ssh server via PAM? – MadHatter Dec 10 '15 at 8:49
  • Yes. Because it needs the way to communicate with the yubikey and it is probably done using some local library. There is no code for this in ssh. – Jakuje Dec 10 '15 at 8:51
  • That is definitely wrong. I have configured my remote servers to accept yubikey-based authentication in both native yubikey mode and OATH mode. The whole point of a yubikey is a to provide a short(ish) string to transmit over a potentially-insecure channel, to act as a one-time password. If the yubikey had to be physically attached to the system it was authenticating to, it would be a lot less useful. I think you're wrong about the yubikey locking in PKCS mode, as well. – MadHatter Dec 10 '15 at 8:54
  • OK, you are right. For OTP mode it is possible. But the locking is part of PKCS11 standard. – Jakuje Dec 10 '15 at 8:58
  • 1
    Thank you for that - I feel your answer is much better for the improvements, and will remove my downvote. – MadHatter Dec 10 '15 at 9:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.