On Mon, 7 Mar 2022, Blumenthal, Uri - 0553 - MITLL wrote: > > >That's a nice thing about pam_yubico with real Yubikeys: > > >they can be validated against the Yubico cloud API, > > >without any local secrets. > > > > Just to make sure I understand you correctly - a cloud > > service determines whether some access to your server > > is to be granted? > > A cloud service *authenticates* the user. It's the job of *other* > PAM modules and configuration to decide what to *authorize* this > authenticated identity for, including login. No, that is not the case. The module is a HOTP/TOTP implementation that is compatible with the Google Authenticator application, it does consult any cloud service for authentication. -d _______________________________________________ openssh-unix-dev mailing list openssh-unix-dev@xxxxxxxxxxx https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev
