Re: Yubikeys are now supported

On Fri, Oct 08, 2010 at 12:07:34AM -0400, Matthew Miller wrote:
> On Thu, Oct 07, 2010 at 11:30:43PM -0400, Toshio Kuratomi wrote:
> > The newer yubikey hardware has provision for two AES keys but I'm not sure
> > how that works and whether it actually allows you to use separate keys with
> > separate servers.  Someone will need to look into this.
> 
> Yes, separate keys -- basically two separate configurations in one device.
> 
After a bit of trial and error, I got this working.  I now have my
yubikey-v2 to send a otp that's associated with fas if I hold the contact
for  0.3 ? 1.5 seconds and a otp that's registered with yubico's servers if
I press for 2.5 ? 5 seconds.  The sparsity of introductory docs on
ykpersonalize made this harder than it should have been.  I pieced together
the necessary information from this page:

http://www.teaparty.net/technotes/yubikey.html

and the official upload instructions linked from here:

http://www.yubico.com/developers/aeskeys/

and the user's manual

http://yubico.com/files/YubiKey_manual-2.0.pdf


Writing the second key slot was kinda like this:

sudo ykpersonalize -2 -o fixed=vvXXXXXXXX  -a KEY
-o -static-ticket -o -strong-pw1 -o -strong-pw2
-o -man-update -o -append-cr -ouid=YYYYY

Figuring out XXXX,KEY, and YYY were what I needed to read those documents
for.

-Toshio
_______________________________________________
infrastructure mailing list
infrastructure-TuqUDEhatI4ANWPb/1PvSmm0pvjS0E/A@public.gmane.org
https://admin.fedoraproject.org/mailman/listinfo/infrastr...