Last week I received my Yubikey and promptly figured out how to use it
with my Drupal
installation
using the Yubico authentication server. Since then life got in the way
and I haven't had a chance to work on my other projects that I want to
get working. I did get a chance to do some research on the mechanics
behind the Yubikey and figured out that I'm going to need a few more
Yubikeys for all my projects.
The vulnerability I'm trying to combat is a replay
attack.
This means that different
AES
keys
are needed for each authentication server or replay attacks are a real
possibility.
I have three uses for my Yubikey:
- Authentication to websites utilizing the Yubico authentication
server.
- Authentication into Fedora servers
using the Fedora authentication
server.
- Authentication into my local computer using a local
database.
I THINK I can setup my Yubikey to handle two of these using different
profiles in the token but not the third. Perhaps I'll be able to get
everything functioning soon.