PAM and YubiKeys

[Jack]

Hi List,

I am trying to get authentication to Dovecot with a Yubikey OTP.

I have the PAM modules installed and can successfully authenticate to 
ssh with the Yubikey, so I am confident that the network level and 
Yubikey configuration is correct. I can also authenticate to Dovecot via 
PAM using a plain password, however when I try to use the Yubikey 
authentication with Dovecot things don't go well. Network monitoring 
reveals that the software does not even attempt to connect to the 
authentication servers.

My Dovecot authentication is configured as follows :-

passdb {
   driver = pam
   args = failure_show_msg=yes dovecot

   override_fields = proxy host=1.2.3.4 master=XXXXXX pass=XXXXXX
}

userdb {
   driver = passwd-file
   args = username_format=%u /etc/dovecot/users
}

The dovecot Pam config file is :-

auth sufficient pam_yubico.so id=99999 key="xxxxxxxxxxx" 
authfile=/etc/yubikey_mappings debug
@include common-auth
@include common-account
@include common-session

When failing to authenticate with Dovecot, the PAM debug log shows :-

[../pam_yubico.c:parse_cfg(761)] called.
[../pam_yubico.c:parse_cfg(762)] flags 0 argc 4
[../pam_yubico.c:parse_cfg(764)] argv[0]=id=xxxxxx
[../pam_yubico.c:parse_cfg(764)] argv[1]=key="xxxxxx"
[../pam_yubico.c:parse_cfg(764)] argv[2]=authfile=/etc/yubikey_mappings
[../pam_yubico.c:parse_cfg(764)] argv[3]=debug
[../pam_yubico.c:parse_cfg(765)] id=xxxxxx
[../pam_yubico.c:parse_cfg(766)] key="xxxxxxxxx"
[../pam_yubico.c:parse_cfg(767)] debug=1
[../pam_yubico.c:parse_cfg(768)] alwaysok=0
[../pam_yubico.c:parse_cfg(769)] verbose_otp=0
[../pam_yubico.c:parse_cfg(770)] try_first_pass=0
[../pam_yubico.c:parse_cfg(771)] use_first_pass=0
[../pam_yubico.c:parse_cfg(772)] authfile=/etc/yubikey_mappings
[../pam_yubico.c:parse_cfg(773)] ldapserver=(null)
[../pam_yubico.c:parse_cfg(774)] ldap_uri=(null)
[../pam_yubico.c:parse_cfg(775)] ldapdn=(null)
[../pam_yubico.c:parse_cfg(776)] user_attr=(null)
[../pam_yubico.c:parse_cfg(777)] yubi_attr=(null)
[../pam_yubico.c:parse_cfg(778)] yubi_attr_prefix=(null)
[../pam_yubico.c:parse_cfg(779)] url=(null)
[../pam_yubico.c:parse_cfg(780)] capath=(null)
[../pam_yubico.c:parse_cfg(781)] token_id_length=12
[../pam_yubico.c:parse_cfg(782)] mode=client
[../pam_yubico.c:parse_cfg(783)] chalresp_path=(null)
[../pam_yubico.c:pam_sm_authenticate(823)] get user returned: jack
[../pam_yubico.c:pam_sm_authenticate(929)] conv returned 44 bytes
[../pam_yubico.c:pam_sm_authenticate(947)] Skipping first 0 bytes. 
Length is 44, token_id set to 12 and token OTP always 32.
[../pam_yubico.c:pam_sm_authenticate(954)] OTP: 
ccccccbcitfdueencldivbcjvghvikdtrnujbgubirru ID: ccccccbcitfd
[../pam_yubico.c:pam_sm_authenticate(985)] ykclient return value (101): 
Could not parse server response
[../pam_yubico.c:pam_sm_authenticate(1038)] done. [Authentication 
service cannot retrieve authentication info]

A successful authentication (via ssh) looks like

[../pam_yubico.c:parse_cfg(761)] called.
[../pam_yubico.c:parse_cfg(762)] flags 1 argc 4
[../pam_yubico.c:parse_cfg(764)] argv[0]=id=xxxx
[../pam_yubico.c:parse_cfg(764)] argv[1]=key="xxxxxxxxxxxxxxxxxx"
[../pam_yubico.c:parse_cfg(764)] argv[2]=authfile=/etc/yubikey_mappings
[../pam_yubico.c:parse_cfg(764)] argv[3]=debug
[../pam_yubico.c:parse_cfg(765)] id=xxxxxx
[../pam_yubico.c:parse_cfg(766)] key="xxxxxxxxxxxxxxxxxxx"
[../pam_yubico.c:parse_cfg(767)] debug=1
[../pam_yubico.c:parse_cfg(768)] alwaysok=0
[../pam_yubico.c:parse_cfg(769)] verbose_otp=0
[../pam_yubico.c:parse_cfg(770)] try_first_pass=0
[../pam_yubico.c:parse_cfg(771)] use_first_pass=0
[../pam_yubico.c:parse_cfg(772)] authfile=/etc/yubikey_mappings
[../pam_yubico.c:parse_cfg(773)] ldapserver=(null)
[../pam_yubico.c:parse_cfg(774)] ldap_uri=(null)
[../pam_yubico.c:parse_cfg(775)] ldapdn=(null)
[../pam_yubico.c:parse_cfg(776)] user_attr=(null)
[../pam_yubico.c:parse_cfg(777)] yubi_attr=(null)
[../pam_yubico.c:parse_cfg(778)] yubi_attr_prefix=(null)
[../pam_yubico.c:parse_cfg(779)] url=(null)
[../pam_yubico.c:parse_cfg(780)] capath=(null)
[../pam_yubico.c:parse_cfg(781)] token_id_length=12
[../pam_yubico.c:parse_cfg(782)] mode=client
[../pam_yubico.c:parse_cfg(783)] chalresp_path=(null)
[../pam_yubico.c:pam_sm_authenticate(823)] get user returned: jack
[../pam_yubico.c:pam_sm_authenticate(929)] conv returned 44 bytes
[../pam_yubico.c:pam_sm_authenticate(947)] Skipping first 0 bytes. 
Length is 44, token_id set to 12 and token OTP always 32.
[../pam_yubico.c:pam_sm_authenticate(954)] OTP: 
ccccccbcitfdetdfkbjrtfbuhgbtjgethkdebcgthgde ID: ccccccbcitfd
[../pam_yubico.c:pam_sm_authenticate(985)] ykclient return value (0): 
Success
[../pam_yubico.c:authorize_user_token(221)] Using system-wide auth_file 
/etc/yubikey_mappings
[../pam_yubico.c:check_user_token(178)] Authorization line: 
jack:ccccccbcitfd
[../pam_yubico.c:check_user_token(182)] Matched user: jack
[../pam_yubico.c:check_user_token(187)] Authorization token: 
ccccccbcitfd
[../pam_yubico.c:check_user_token(190)] Match user/token as 
jack/ccccccbcitfd
[../pam_yubico.c:pam_sm_authenticate(1038)] done. [Success]

I have just noticed that the 'flags' is set to 1 by ssh. I don't know 
where (or if) I can control how Dovecot sets that flag or if it has any 
relevance.
The Pam configuration line for Yubikey is identical in the ssh 
configuration.

Does anyone have any idea what is going wrong?

Thanks in advance,

Jack