Setting up Two-Factor Authentication - YubiKey

YubiKey is a physical key made by Yubico, that ensures secure and strong user authentication. You can set up two-factor authentication with YubiKey in PAM360 by following the steps detailed in this document.

You will learn the following topics in this document:

1. YubiKeys Compatible with PAM360
2. Legacy YubiKeys Compatible with PAM360
3. Configuring and Enforcing Two-Factor Authentication using YubiKey
4. Connecting to PAM360 Web Interface after Yubikey TFA is Enabled

1. YubiKeys Compatible with PAM360

• YubiKey 5 NFC
• YubiKey 5C
• YubiKey 5 Nano
• YubiKey 5C Nano

2. Legacy YubiKeys Compatible with PAM360

• YubiKey 4
• YubiKey 4 Nano
• YubiKey 4C
• YubiKey 4C Nano
• YubiKey NEO
• YubiKey Edge
• YubiKey Edge-n
• YubiKey NEO-n

3. Configuring and Enforcing Two-Factor Authentication using YubiKey

3.1 Configuring Two-Factor Authentication using YubiKey

1. Navigate to Admin >> Authentication >> Two-factor Authentication.

   

2. In the window that opens, select YubiKey and click Save.

   

3. Click Confirm to enable YubiKey two-factor authentication.

   

3.2 Enforcing YubiKey Two-Factor Authentication

1. Once you confirm YubiKey two-factor authentication in the previous step, a new window will prompt you to select the users for whom two-factor authentication should be enforced.
2. Click Enable to select the required users for whom you want to enforce Yubikey two-factor authentication.

   

3. You can also select the users later by navigating to Users >> More Actions >> Two-factor Authentication.
4. In the pop-up window, select the users for whom you want to enforce YubiKey two-factor authentication by clicking Enable.

   

4. Connecting to PAM360's Web Interface after YubiKey TFA is Enabled

While logging into PAM360, the users for whom two-factor authentication is enabled will have to authenticate twice successively. The first level of authentication will be through the usual authentication method i.e., through PAM360's local authentication or AD/LDAP authentication, whichever is enabled for the user.

1. Launch PAM360's web interface, enter the Username and Password (local authentication or AD/LDAP), and click Login.
2. Once the first level of authentication succeeds, PAM360 will prompt you to enter your YubiKey one-time password.

   
   

3. Insert the YubiKey into the USB port of your laptop or computer.

   
   

4. Before generating a one-time password, you need to decide which slot of the YubiKey (slot 1 or slot 2) you're going to use for authentication throughout.
   • Slot 1: If you tap the YubiKey once, it generates a 44-character security key whose first 12 characters are unique to this slot. For every subsequent login through this slot, the first 12 characters remain the same and the rest of the 32 characters are randomized.
   • Slot 2: If you tap and hold the YubiKey for 2-5 seconds, it generates a 44-character security key whose first 12 characters are unique to this slot. For every subsequent login through this slot, the first 12 characters will remain the same and the rest of the 32 characters will be randomized.
   • Here's a sample output from a YubiKey where the button has been pressed three times.

     cccjgjgkhcbbirdrfdnlnghhfgrtnnlgedjlftrbdeut

     cccjgjgkhcbbgefdkbbditfjrlniggevfhenublfnrev

     cccjgjgkhcbbcvchfkfhiiuunbtnvgihdfiktncvlhck

Note : By default, YubiKey generates slot 1 passcode for NFC configured mobile devices. You can set slot 2 passcode as default by changing the setting from slot 1 to slot 2 using the Yubikey Personalization tool.



5. PAM360 matches the 12-character key against your account in its database and verifies the same for the second level of authentication during future login attempts.
6. After submitting the YubiKey one-time password, click Register and Login.