Yubico/yubico-pam
FreeYubico Pluggable Authentication Module (PAM)
FreeFree tier
About Yubico/yubico-pam
The Yubico PAM module integrates YubiKey two-factor authentication into existing PAM-based authentication systems on GNU/Linux, Solaris, and macOS. It supports both online validation via YubiCloud or a private validation service, and offline HMAC-SHA1 challenge-response authentication (requires YubiKey 2.2 or later). The module is licensed under a BSD license and is available as packages for Fedora/EPEL, Ubuntu (via PPA), and FreeBSD ports.
Key Features
Integrates YubiKey authentication into PAM (Pluggable Authentication Modules) for GNU/Linux, Solaris, and macOS
Online validation using YubiCloud or a custom private validation service
Offline authentication via HMAC-SHA1 Challenge-Response (YubiKey 2.2 and later)
Multi-user system support
Open source under a BSD license
Available via package managers for Fedora, Ubuntu, and FreeBSD
Pros & Cons
Pros
- Leverages the widely-used PAM framework for easy integration
- Supports both online and offline validation modes for flexibility
- Backed by Yubico, a trusted security hardware company
- Available as pre-built packages for major Linux distributions and FreeBSD
Cons
- Repository archived as of February 2025, meaning no active development or official support
- Offline authentication requires YubiKey 2.2 or newer
- Relies on several external dependencies (libykclient, cURL, libyubikey, etc.)
- Primarily targeted at Unix-like systems; no Windows support
Best For
Add two-factor authentication to SSH logins on Linux serversProtect sudo and login screens with YubiKeyEnhance authentication for any PAM-aware service (e.g., web applications via PAM)Secure access for Unix-like workstations and laptops
FAQ
What is the Yubico PAM module?
It is a PAM module that allows you to use a YubiKey for two-factor authentication on systems using PAM, such as GNU/Linux, Solaris, and macOS.
How does online validation work?
The module sends the YubiKey's one-time password to a validation service (default is YubiCloud, or a custom service specified via the 'urllist' parameter) for verification.
Does the module support offline authentication?
Yes, since version 2.6, the module supports offline authentication using HMAC-SHA1 Challenge-Response, which works with YubiKey 2.2 and later.
How can I install the Yubico PAM module?
It is available from package managers: on Fedora/EPEL use 'sudo yum install pam_yubico'; on Ubuntu via the Yubico PPA use 'sudo add-apt-repository ppa:yubico/stable && sudo apt-get install libpam-yubico'; and on FreeBSD it is available in the ports tree.