yubico-pam: Breaks in macOS 10.15

Any updates on a potential fix for this issue? It’s been a while since Catalina was released. Currently our company is not security compliant since we require Yubikey 2FA at logon. Why isn’t Yubico providing us updates/information on this issue? This is an important feature, one of the reasons we chose for the Yubikey…

Mostly as an update. Yubico has no more information about this, we’ve opened a radar with apple and tried to get clarity with no answers so far.

@Frederick888 yes. but please be aware of the fact that this is a work around and might stop working at any time.

Not excatly. Of course, you need a PIN to use the certificates on the smartcard. But it’s not 2FA for the Mac, as you can log-in into the mac without the smartcard but with your password only. You may define a quite complex password (maybe a combination of some chars you enter and a static password provided by pressing the button on same Yubikey (you have to configure the key accordingly)) to get a little bit more security. But it’s not 2FA as we know it from the challenge response method configured in the PAM config files.

In their zeal to remain “inventive”/ahead of the curve, Apple manages to break things that work such as Yubikey/PAM auth… along with other useless innovations, like the function key touchbar …

There has been a workaround committed for this in the yubikey-personalization repo.

If you run homebrew, try applying this diff to the ykpers formula: https://github.com/nevun/homebrew-core/commit/8f433b6c2e87d2aeb91a7663f52364d0332b035c

…and then do brew reinstall ykpers. This made it work for me on catalina

% sw_vers 
ProductName:	Mac OS X
ProductVersion:	10.15.7
BuildVersion:	19H2

debug: pam_yubico.c:838 (parse_cfg): called.
debug: pam_yubico.c:839 (parse_cfg): flags -2147483648 argc 3
debug: pam_yubico.c:841 (parse_cfg): argv[0]=mode=challenge-response
debug: pam_yubico.c:841 (parse_cfg): argv[1]=debug
debug: pam_yubico.c:841 (parse_cfg): argv[2]=debug_file=/tmp/lol
debug: pam_yubico.c:842 (parse_cfg): id=0
debug: pam_yubico.c:843 (parse_cfg): key=(null)
debug: pam_yubico.c:844 (parse_cfg): debug=1
debug: pam_yubico.c:845 (parse_cfg): debug_file=5
debug: pam_yubico.c:846 (parse_cfg): alwaysok=0
debug: pam_yubico.c:847 (parse_cfg): verbose_otp=0
debug: pam_yubico.c:848 (parse_cfg): try_first_pass=0
debug: pam_yubico.c:849 (parse_cfg): use_first_pass=0
debug: pam_yubico.c:850 (parse_cfg): nullok=0
debug: pam_yubico.c:851 (parse_cfg): authfile=(null)
debug: pam_yubico.c:852 (parse_cfg): ldapserver=(null)
debug: pam_yubico.c:853 (parse_cfg): ldap_uri=(null)
debug: pam_yubico.c:854 (parse_cfg): ldap_bind_user=(null)
debug: pam_yubico.c:855 (parse_cfg): ldap_bind_password=(null)
debug: pam_yubico.c:856 (parse_cfg): ldap_filter=(null)
debug: pam_yubico.c:857 (parse_cfg): ldap_cacertfile=(null)
debug: pam_yubico.c:858 (parse_cfg): ldapdn=(null)
debug: pam_yubico.c:859 (parse_cfg): user_attr=(null)
debug: pam_yubico.c:860 (parse_cfg): yubi_attr=(null)
debug: pam_yubico.c:861 (parse_cfg): yubi_attr_prefix=(null)
debug: pam_yubico.c:862 (parse_cfg): url=(null)
debug: pam_yubico.c:863 (parse_cfg): urllist=(null)
debug: pam_yubico.c:864 (parse_cfg): capath=(null)
debug: pam_yubico.c:865 (parse_cfg): cainfo=(null)
debug: pam_yubico.c:866 (parse_cfg): proxy=(null)
debug: pam_yubico.c:867 (parse_cfg): token_id_length=12
debug: pam_yubico.c:868 (parse_cfg): mode=chresp
debug: pam_yubico.c:869 (parse_cfg): chalresp_path=(null)
debug: pam_yubico.c:899 (pam_sm_authenticate): pam_yubico version: 2.26
debug: pam_yubico.c:914 (pam_sm_authenticate): get user returned: user
debug: pam_yubico.c:490 (do_challenge_response): Checking for user challenge files
debug: pam_yubico.c:493 (do_challenge_response): Challenge files found
debug: util.c:222 (check_firmware_version): YubiKey Firmware version: 3.5.0

debug: pam_yubico.c:528 (do_challenge_response): Loading challenge from file /Users/user/.yubico/challenge-7346642
debug: util.c:437 (load_chalresp_state): Challenge: 860d5142c4535001d5c6f58ffa6879baf37d9468cbe219561292ef868f0cec258fdc4646cee54707df7bf184c3acc9b2b7a0d2121bd640655c2f539ca71a16, hashed response: cce19f04672c22899c7288ebc4248296d9f9e535, salt: bf26a4e37b149057465e7a23edbcabd6a8a3bdc6dd98bd71894e3311b5a41d9b, iterations: 10000, slot: 2
debug: pam_yubico.c:604 (do_challenge_response): Got the expected response, generating new challenge (63 bytes).
debug: pam_yubico.c:690 (do_challenge_response): Challenge-response success!
debug: pam_yubico.c:1220 (pam_sm_authenticate): done. [success]

FYI, we put together a small guide on the macOS smart card support, heavily based on Apples documentation, available here: https://developers.yubico.com/PIV/Guides/Smart_card-only_authentication_on_macOS.html

No updates on the pam module as far as I know.

I did not try it, mayba you can follow this guide:

https://osxdominion.wordpress.com/2015/04/21/signing-mobileconfig-profiles-with-keychain-certificates/

Well… it originally was, but you can actually do all sorts of stuff with it. I do prefer ProfileCreator from Github over it, because it’s more easy to use. But as always, ymmv.

@tob1k technically smartcard is 2FA - you’ve the physical card w/the certs that authenticate you as the 2nd factor and the PIN you must enter to unlock the card. Neither one would work without the other.

On MacOS you can also disable anything except Smartcard logins, which should provide you with an extra layer of security.

Could anyone post instructions on how to remedy this from recovery mode? I’m struggling with Terminal and am locked out. Thank you for any help!

@Frederick888 in regards to you comment about the pam.d files being reset, I always assume that anything I customize on a mac will be reset. I treat OS updates a “firmware” updates. For this reason, I configure a LaunchDaemon that will reprogram anything I ever edit on a mac. In this case I run a carefully crafted awk and sed script that will update pam.d files every time the computer is rebooted, fairly robustly. This has kept my yubikey setting since I started using it a year and a half ago.

After updating to from 10.15.1 to 10.15.2, logging in with the yubikey worked without issue (It’s been working for login only in Catalina this whole time, just not screensaver or privilege elevation). But after a second reboot, it stopped working.

1. Insert Yubikey
2. Log in with correct password
3. It does not wait for you to press the yubikey, but it did blink, and the screen turns white for a few seconds
4. The login screen restarts, including the MOTD prompt showing up again.

So Apple has at least made it 100% broken instead of 80% broken.

@klali I really believe you guys need to talk to Apple about this. I don’t think such kind of technical feedback from individual customers who are not familiar with either macOS entitlements or yubico-pam per se like me would attract much attention from them.