So I've got this slick little yubikey and I want to add an additional layer of security when authenticating ssh sessions. On the server side I've already disabled password authentication and only permit the use of ssh keys when logging in.
The problem is, after configuring sshd and PAM for yubikey auth, sshd still only requires an ssh key, I'm never asked to provide a response from the yubikey.
How do I require both and ssh key and a yubikey?
(ubuntu 14.04 - trusty)
auth required pam_yubico.so mode=client try_first_pass id=<id> key=<secret> auth [success=1 default=ignore] pam_unix.so nullok_secure try_first_pass # here's the fallback if no module succeeds auth requisite pam_deny.so # prime the stack with a positive return value if there isn't one already; # this avoids us returning an error just because nothing sets a success code # since the modules above will each just jump around auth required pam_permit.so # and here are more per-package modules (the "Additional" block) auth optional pam_cap.so # end of pam-auth-update config
... PasswordAuthentication no ChallengeResponseAuthentication yes UsePAM yes