YubiKey NEO で Linux でも ２段階認証しよう！ ref: http://qiita.com/mopemope/items/779a5a4da734914b9cd0

file0.txt

$ packer -S yubikey-personalization yubikey-personalization-gui yubikey-neo-manager

file1.txt

$ yubikey-personalization-gui

file10.txt

$ ssh -YC ma2@xxxxxxx
Authenticated with partial success.
YubiKey for `ma2':

file11.txt

auth      sufficient pam_yubico.so  mode=challenge-response chalresp_path=/etc/yubico

file12.txt

$ ykpersonalize -2 -ochal-resp -ochal-hmac -ohmac-lt64 -oserial-api-visible
...
Commit? (y/n) [n]: y
$

file13.txt

$ mkdir $HOME/.yubico
$ ykpamcfg -2 -v
...
Stored initial challenge and expected response in '/home/user/.yubico/challenge-123456'.
$

file14.txt

$ mkdir /etc/yubico
$ chmod +t /etc/yubico
$ chmod 777 /etc/yubico
$ mv /home/user/.yubico/challenge-####### /etc/yubico/username-#######
...

file15.txt

auth       required   pam_u2f.so           authfile=/etc/u2f_mappings

file16.txt

<username1>:<KeyHandle1>,<UserKey1>:<KeyHandle2>,<UserKey2>:...
<username2>:<KeyHandle1>,<UserKey1>:<KeyHandle2>,<UserKey2>:...

file17.txt

$ pamu2fcfg -u <username>  

file18.txt

$ sudo ls
Please touch the device.

file19.txt

$ udevadm monitor --environment –udev

file2.txt

$ neoman

file20.txt

# Yubikey Udev Rule: running a bash script in case your Yubikey is removed
ACTION=="remove", ENV{ID_VENDOR_ID}=="1050", ENV{ID_MODEL_ID}=="0116", ENV{ID_SERIAL_SHORT}=="00000000000", RUN+="/usr/local/bin/yubikey-lock"

file21.txt

#!/bin/bash

user=`ps aux | grep -v root | grep gdm-x-session | head -n 1 | awk '{print $1}'`
sessionid=`/bin/loginctl list-sessions | grep ${user} | awk '{print $1}'`

if [ -z "$(lsusb | grep Yubico)" ]; then
    logger "YubiKey Removed"
    /bin/loginctl lock-session $sessionid
fi

file3.txt

$ packer -S yubico-pam pam_u2f

file4.txt

auth      sufficient pam_yubico.so  id={Your ID} key={Your Key} authfile=/etc/yubikey_mappings

file5.txt

<first user name>:<Yubikey token ID1>:<Yubikey token ID2>:….
<second user name>:<Yubikey token ID3>:<Yubikey token ID4>:….

file6.txt

$ cccccccgklgcvnkcvnnegrnhgrjkhlkfhdkclfncvlgj
bash: cccccccgklgcvnkcvnnegrnhgrjkhlkfhdkclfncvlgj: command not found

file7.txt

`Modhex encoded: XXXXXXX`

file8.txt

auth      required pam_yubico.so  id=xxxxxx key=xxxxxxxxxxxxxxxxxxxxxx authfile=/etc/yubikey_mappings  
auth      include   system-remote-login
account   include   system-remote-login
password  include   system-remote-login
session   include   system-remote-login

file9.txt

...
UsePAM yes
PasswordAuthentication no
ChallengeResponseAuthentication yes
AuthenticationMethods publickey,keyboard-interactive
...