Yubico PAM 2.9 (IMPORTANT)

[Fredrik Thulin]

There is a bug in all current versions (<= 2.6) of ykclient (a.k.a.
yubico c client) that makes it require opt-in to validate the
validation servers HMAC-SHA-1 signature rather than opt-out.

We will release version 2.7 of ykclient shortly, but in order to make
Yubico PAM secure even with ykclient <= 2.6, we hereby release Yubico
PAM 2.9 that explicitly asks ykclient to verify signatures.

Get it from

http://code.google.com/p/yubico-pam/downloads/list

or from my PPA (https://launchpad.net/~fredrikt/+archive/yubico) if
you are using Ubuntu.

/Fredrik

[Fredrik Thulin]

On Nov 17, 9:38 pm, Fredrik Thulin <fredrikyub...@gmail.com> wrote:
> There is a bug in all current versions (<= 2.6) of ykclient (a.k.a.
> yubico c client) that makes it require opt-in to validate the
> validation servers HMAC-SHA-1 signature rather than opt-out.
>
> We will release version 2.7 of ykclient shortly, but in order to make
> Yubico PAM secure even with ykclient <= 2.6, we hereby release Yubico
> PAM 2.9 that explicitly asks ykclient to verify signatures.

Sorry, I forgot to give due credit in the announcement.

This rather serious issue was reported and patched by Dominic
Rutherford <dom...@rutherfordfamily.co.uk>. Thanks!

/Fredrik