{"action":"created","issue":{"url":"https://api.github.com/repos/Yubico/yubico-pam/issues/72","labels_url":"https://api.github.com/repos/Yubico/yubico-pam/issues/72/labels{/name}","comments_url":"https://api.github.com/repos/Yubico/yubico-pam/issues/72/comments","events_url":"https://api.github.com/repos/Yubico/yubico-pam/issues/72/events","html_url":"https://github.com/Yubico/yubico-pam/issues/72","id":100889384,"number":72,"title":"PAM module should allow support to configure specific users to use 2FA natively","user":{"login":"JonnyWhatshisface","id":6776518,"avatar_url":"https://avatars.githubusercontent.com/u/6776518?v=3","gravatar_id":"","url":"https://api.github.com/users/JonnyWhatshisface","html_url":"https://github.com/JonnyWhatshisface","followers_url":"https://api.github.com/users/JonnyWhatshisface/followers","following_url":"https://api.github.com/users/JonnyWhatshisface/following{/other_user}","gists_url":"https://api.github.com/users/JonnyWhatshisface/gists{/gist_id}","starred_url":"https://api.github.com/users/JonnyWhatshisface/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/JonnyWhatshisface/subscriptions","organizations_url":"https://api.github.com/users/JonnyWhatshisface/orgs","repos_url":"https://api.github.com/users/JonnyWhatshisface/repos","events_url":"https://api.github.com/users/JonnyWhatshisface/events{/privacy}","received_events_url":"https://api.github.com/users/JonnyWhatshisface/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-08-13T23:15:03Z","updated_at":"2016-01-15T13:25:37Z","closed_at":null,"body":"As it stands, the most common way I see people implementing YubiKey in a manner that allows them to specify which users should require a key is via a little extended syntax in PAM. Not doing so essentially forces all users to need a YubiKey. That syntax, for those interested in the quick fix (Linux PAM ONLY) is as follows:\r\n\r\nauth [success=1 default=ignore] pam_succeed_if.so quiet user notingroup [groupname]\r\nauth\t\trequired\tpam_yubico.so mode=challenge-response\r\n\r\nThat success=1 will tell PAM to skip the next X lines (in this case, 1) if the user is not in the specified group. However, if you're NetBSD'ish or on Mac OS X, you're using OpenPAM which does not support this extended syntax.\r\n\r\nMy solution was originally going to be to simply look in the users home directory for a .yubico directory, and just return PAM_SUCCESS and skip over everything if it didn't exist. However, it seems the most common method of assigning which accounts should use the key thus far has been to create a group and add users to it. So, I figured, why not stick to that methodology?\r\n\r\nI'm going to use getgrouplist() to identify whether or not the user is in the group. This should work across Linux and BSD alike. \r\n\r\nThis will certainly meet the needs for my implementation... The question is, will anyone else be interested in such an addition? If so, I'll setup a pull request once I get it done (some time tonight or early tomorrow morning). If a pull request isn't desired or you aren't interested in it as being part of the module, I will simply put the modifications here in a comment for anyone else that may be interested.\r\n"},"comment":{"url":"https://api.github.com/repos/Yubico/yubico-pam/issues/comments/171960758","html_url":"https://github.com/Yubico/yubico-pam/issues/72#issuecomment-171960758","issue_url":"https://api.github.com/repos/Yubico/yubico-pam/issues/72","id":171960758,"user":{"login":"steverweber","id":1800619,"avatar_url":"https://avatars.githubusercontent.com/u/1800619?v=3","gravatar_id":"","url":"https://api.github.com/users/steverweber","html_url":"https://github.com/steverweber","followers_url":"https://api.github.com/users/steverweber/followers","following_url":"https://api.github.com/users/steverweber/following{/other_user}","gists_url":"https://api.github.com/users/steverweber/gists{/gist_id}","starred_url":"https://api.github.com/users/steverweber/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/steverweber/subscriptions","organizations_url":"https://api.github.com/users/steverweber/orgs","repos_url":"https://api.github.com/users/steverweber/repos","events_url":"https://api.github.com/users/steverweber/events{/privacy}","received_events_url":"https://api.github.com/users/steverweber/received_events","type":"User","site_admin":false},"created_at":"2016-01-15T13:25:36Z","updated_at":"2016-01-15T13:25:36Z","body":"related: https://github.com/Yubico/yubico-pam/issues/20"}}