Logging In to Mac OS X Using a HyperFIDO U2F Security Key

Transcription

1 Logging In to Mac OS X Using a HyperFIDO U2F Security Key 9/27/2017 HSTE-NB RV 1.0 HYPERSECU INFORMATION SYSTEMS INC # Westminster Hwy, Richmond, BC V7C 4V4 Canada 1 (604) hypersecu.com

2 Table of Contents What is HyperFIDO? 3 Requirements 3 Installing the U2F Module and Registering Your HyperFIDO Security Key 4 Configuring PAM Rules 5 Logging In With Your HyperFIDO Security Key 7 Hypersecu Information Systems Inc 2 HSTE-NB RV 1.0

3 What is HyperFIDO? Logging In to Mac OS X Using a HyperFIDO U2F Security Key The HyperFIDO U2F security key is designed to quickly and easily secure online accounts with any service compatible with FIDO, including GitHub, Facebook, Google Account services such as Gmail, and more. FIDO promotes convenience while increasing protection by reducing reliance on vulnerable static passwords, meaning you are no longer required to create long complicated passwords. HyperFIDO does all the work for you with a single press of a button. This document will demonstrate how to register and use your HyperFIDO U2F security key to log in to your Mac OS X. IMPORTANT: The procedures in this document require accessing a command line interface. Configuration errors may result in errors within your operating system. Ensure you are comfortable using command line interfaces before proceeding. Hypersecu is not liable for any errors that may result from following the procedures in this document. Requirements Before you register your HyperFIDO security key, you will need: MacOS Sierra or above An available USB port A HyperFIDO U2F security key Hypersecu Information Systems Inc 3 HSTE-NB RV 1.0

4 Installing the U2F Module and Registering Your HyperFIDO Security Key 1. Open the Terminal application. 2. Install Homebrew by entering the following command. Enter your password if prompted: /usr/bin/ruby -e "$(curl -fssl l)" 3. Install the U2F module for UNIX system's Pluggable Authentication Module (PAM) by entering one of the following commands: If you are running Mac OS with System Integrity Protection: brew install pam-u2f If you are running Mac OS without System Integrity Protection: sudo ln -s /usr/local/cellar/pam-u2f/1.0.4/lib/pam/pam_u2f.so /usr/lib/pam/ 4. Create a folder to store your HyperFIDO security key credentials by entering the following command. For this example, we will name the folder HSFIDO. mkdir -p ~/.config/hsfido/ 5. Insert your HyperFIDO security key and enter the following command: pamu2fcfg > ~/.config/hsfido/u2f_keys 6. Press the button on your security key to register the key. 7. Ensure the key was set up correctly by entering the command below. If the key was registered correctly, the Terminal will fetch the key string. cat ~/.config/hsfido/u2f_keys Hypersecu Information Systems Inc 4 HSTE-NB RV 1.0

5 Configuring PAM Rules The procedures below will show you how to modify the screensaver and authorization files. However, it is recommended you test the procedures using your sudo configuration file first to ensure all configurations are working properly. IMPORTANT: If you are using Mac OS with System Integrity Protection, you must add the following line to both the screeensaver and authorization configuration files in addition to the procedures described in this section: auth sufficient /usr/local/cellar/pam-u2f/1.0.4/lib/pam/pam_u2f.so 1. Navigate to the pam.d directory and retrieve its contents by entering the following command: cd /etc/pam.d/ && ls 2. Open the screensaver configuration file in a text editor or within the Terminal and add the following line to the file: auth sufficient pam_u2f.so authfile=[file path] Your file configuration should look similar to the image below, with the file path being your own: NOTE: If you don't know your file path, you can locate it by entering the command find ~/ -name "u2f_ keys" 3. Save the file and exit. 4. Open the authorization configuration file and add the same line as you did to the screensaver configuration file: auth sufficient pam_u2f.so authfile=[file path] Your file configuration should look similar to the image below, with the file path being your own: Hypersecu Information Systems Inc 5 HSTE-NB RV 1.0

6 5. Save the file and exit. WARNING: Using the command line flag sufficient will ensure you can still log in to your computer with only your password if your security key is not available. If you want your computer to require both the password and security key at all times, use the flag required, but you will be locked out of your computer if you no longer have access to your security key. Hypersecu Information Systems Inc 6 HSTE-NB RV 1.0

7 Logging In With Your HyperFIDO Security Key 1. Press Enter at the log in screen. You do not need to type your password. 2. Press the button on your HyperFIDO security key to log in. NOTE: If you have your U2F security key set as sufficient in your configuration files, you can log in using only your password if your security key is not inserted. If your U2F security key is set as required, you must have your security key in order to log in or you will be locked out of your computer. Hypersecu Information Systems Inc 7 HSTE-NB RV 1.0