Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The Yubico PAM Module seems to require changes to the PAM stack for each user that will be authenticated with a YubiKey. Specifically, it seems that each user's client identity must be added to the right PAM configuration file before the user can be authenticated.

While it makes sense to add authorized keys to an authentication database such as /etc/yubikey_mappings or ~/.yubico/authorized_yubikeys, it seems like a bad practice to have to edit the PAM stack itself for each individual user. I would definitely like to avoid having to hard-code user identities into the PAM stack this way.

So, is it possible to avoid hard-coding the id parameter to the module itself? If not, are there any other PAM modules that can leverage YubiKey authentication without hard-coding the stack?

share|improve this question
I've read the documentation and it seems to me that the id= parameter is only for Yubico API access, not for actual authentication, so it makes sense to have it set system-wide. – grawity May 14 '12 at 9:44
up vote 4 down vote accepted

This question received no answers here on SuperUser. However, the following answer was received on the Yubico support forums:

The id parameter to the PAM module indicates the API key ID, not the
user ID. This ID is returned with the key you get from the "Get API Key"
form if you're using the public service, or it's in the "clients" table
for your internal validation server, along with the API key.

To clarify, when documentation talks about a "client", that's a piece
of software requesting authentication services from the API -- a user
submits an OTP to the client, which submits it to the server in a request
signed with the API key.
share|improve this answer

You can use LDAP for this and map the user to its Public ID by either using a specific yubikey attribute or by using an existing attribute. The Yubico PAM module can check for this attribute and if the verification of the mapping is OK and the correct OTP has been sent then the module returns OK. An example:

# Fetch LDAP password + OTP, verify OTP and move on ('required' control value).
# LDAP password is stripped and passed on.
auth required id=1234 ldap_uri=ldaps://fqdn.of.ldap.server:port [ldapdn=ou=People,DC=example,DC=com] user_attr=uid yubi_attr=yubikeyid

Instead of yubi_attr you can use a different attribute.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.