Yubikey as a second factor in OpenBSD

[bceverly]

Hi all,

I'm wanting to use my YubiKey as a second factor when logging into my OpenBSD laptop (in other words, I want to still be required to type a correct password but want it to fail unless the YubiKey has been inserted and the metal button touched).

From reading login_yubikey's manpage, I'm seeing how to do it as a replacement for a password but not IN ADDITION TO a password.

Does anyone know if this is possible? In Linux, there is a pam module that works the correct magic behind the scenes but I'm not seeing it available in the ports tree.

Thanks!

[jggimi]

It looks like login_yubikey(8) supports using challenge / response services, which might provide the additional authentication you seek. Challenge and response services are described in login.conf(5). Unfortunately I don't have a Yubikey so cannot do any testing.