Yubico Helper

用于配置您的 Linux 系统与 Yubikey 的工具。目前处理 PAM 和 udev。因此，您可以使用 Yubikey 进行二次验证登录或使用它来登录会话。如果希望每次都不输入密码，Sudo 和 polkit 也会被管理。

使用方法

以下是有关各种辅助子命令的帮助信息。该工具管理的 PAM 配置文件是以下三个文件

• sudo : sudo 命令行身份验证机制
• polkit-1 : Windows 环境使用的策略包
• system-auth : 系统身份验证（这不是显而易见的吗？）

这三个文件同时处理，不能单独管理。该工具在某个模式之前插入配置片段，这些模式是

• system-auth : ^auth.*pam_unix.so
• sudo : ^auth.*pam_env.so
• polkit-1 : ^auth.*pam_env.so

$ yubico_helper -h
Configure your system to use a Yubikey using either pam_yubico or pam_u2f module.

Usage: yubico_helper [OPTIONS] <COMMAND>

Commands:
  yubico  Configure pam_yubico for your system
  u2f     Configure pam_u2f for your system
  udev    Use UDev to automatically lock your session when you unplugged your key Display the status without arguments provided
  help    Print this message or the help of the given subcommand(s)

Options:
  -c, --cleanup
          Cleanup yubico_helper configuration snippets from files
  -d, --dryrun
          Dry run the modification and displaying them in the stdout
  -v, --verbose
          Increase verbosity
      --pam-systemauth-file <PAM_SYSTEMAUTH_FILE>
          Specify where is the system-auth pam file [default: /etc/pam.d/system-auth]
      --pam-polkit-file <PAM_POLKIT_FILE>
          Specify where is the polkit-1 pam file [default: /etc/pam.d/polkit-1]
      --pam-sudo-file <PAM_SUDO_FILE>
          Specify where is the sudo pam file [default: /etc/pam.d/sudo]
  -h, --help
          Print help
  -V, --version
          Print version

$ yubico_helper u2f -h
Configure pam_u2f for your system

Usage: yubico_helper u2f [OPTIONS] <AUTH>

Arguments:
  <AUTH>  How do you prefer to use pam_yubico [possible values: sufficient, required]

Options:
  -d, --debug    Enable or disable the debug flag
  -f, --force    Force to write no matter if an existing line using U2F PAM modules exists
  -h, --help     Print help (see more with '--help')
  -V, --version  Print version

$ yubico_helper yubico -h
Configure pam_yubico for your system

Usage: yubico_helper yubico [OPTIONS] --id <ID> <AUTH> <AUTHMODE>

Arguments:
  <AUTH>      How do you prefer to use pam_yubico [possible values: sufficient, required]
  <AUTHMODE>  Which mode you want to use with pam_yubico [possible values: client, challenge-response]

Options:
  -d, --debug    Enable or disable the debug flag
  -i, --id <ID>  Your API Client ID inf the Yubico validation server. Go here to use the default YubiCloud service: https://upgrade.yubico.com/getapikey
  -f, --force    Force to write no matter if an existing line using Yubico PAM module exists
  -h, --help     Print help (see more with '--help')
  -V, --version  Print version

$ yubico_helper udev -h
Use UDev to automatically lock your session when you unplugged your key Display the status without arguments provided

Usage: yubico_helper udev [OPTIONS]

Options:
  -e, --enabled  Add an Udev rules to automatically lock your session when the usb key is unplugged
  -d, --disabled  Comment the rule that autolock your session when the yubikey is unplugged
  -h, --help     Print help
  -V, --version  Print version

使用/示例

对您的系统进行干燥运行配置，以使用 Yubikey 和通用双因素 PAM 模块登录

$ sudo yubico_helper -c -d u2f sufficient

显示是否设置了自动锁定会话的 udev 规则

$ sudo yubico_helper udev
Udev rule is not set.

在 USB Yubikey 拔出时启用会话自动锁定

$ sudo yubico_helper udev --enabled

作者

• @claneys