3 ms·
No, that guide uses PAM and OTP. This [1] is the guide. It uses OpenSC and the smartcard feature of the YubiKey (not all support this but my YubiKey Neo (3rd ge
by Fnoord 7y ago
No, that guide uses PAM and OTP. This [1] is the guide. It uses OpenSC and the smartcard feature of the YubiKey (not all support this but my YubiKey Neo (3rd gen) and YubiKey Nano 4 both do). Neither of them supports FIDO2 though; other than that they are feature rich.
[1] https://support.yubico.com/support/solutions/articles/15000006468-using-your-yubikey-as-a-smart-card-in-macos https://support.yubico.com/support/solutions/articles/150000...
- miles 7y agoThanks so much for your reply, Fnoord. Does that approach allow instantly locking the screen if the YubiKey is removed? It's not mentioned in the guide, so I just want to be sure.
- Fnoord 7y agoYes, it does, though I had to set it to lock immediately in System Preferences (triggers immediately the screensaver; first guide you linked explains how to do this). I'm using the Word Of The Day screensaver, so it is really inspiring to get back from grabbing a cup of coffee. Also, remember you only need to enter the PIN, which I'd argue is a good thing as I don't want to enter my password in public (I don't even know my password out of my head). If you boot up, you need a password of a username to unlock FileVault, but I use a different username for that (who does not have root, though for forensics this is an attack vector).
- Fnoord 7y agoAnd enable "Turn on screensaver when login token is removed" at System Preferences -> Security & Privacy -> General -> Advanced