The YubiKey 5 has two slots that can be configured: One for a short press of the finger (0.3–1.5 seconds), and another for long presses (2.5–5 seconds), each of which can be configured separately.īy default, the short press is configured with a default OTP configuration, like the one we are about to set up, however, because we do not know and cannot recover its Private ID, Public ID and Secret, which are necessary to set it up with Duo, we are going to reset the slot so that we can provide the necessary information to Duo. If the application hangs at this point, double-check that you have properly authorized the software as noted in Step 3 above. Open YubiKey Manager, click on “ Applications ” and select “ OTP ” (One-Time Password, which is the functionality that will allow your key to generate passcodes for the SSH login). Note the key Serial Number for later use in Step 10. On macOS, this is in “ System Preferences ” then the “ Privacy ” applet, and the “ Input Monitoring ” pane, the checkbox in front of “ YubiKey Manager ” must be checked on-note that this is only required for the software to program the key, and can be deactivated after the key has been configured without affecting the functionality: You may have to authorize the application to access external devices. Note that this software replaces a previous, deprecated application called the “ YubiKey Personalization Tool ”, to which some documentation still refers.

This step involves manually configuring your YubiKey, which requires downloading the YubiKey Manager application. But it is also possible to use a “ passcode ” which is directly generated by your YubiKey. Many of the options are similar to the Duo web portal. For Duo-enabled SSH connections, you will see a prompt something like this:Įnter a passcode or select one of the following options: It is possible to use a YubiKey to complete a Duo 2FA. The less expensive 'Security Keys' lack OTP features, which will limit the options for using the key. The choice of which key is best suited is left as an exercise for the reader, but we recommend the '5' series keys. T his document explains how to use one of those options, YubiKeys, instead of a smartphone, to accomplish Duo authentication. For those without smartphones, or who wish to limit the use of their smartphone, other options exist. Most users interact with Duo by way of the Duo Mobile application on a smartphone. Since 2016, Princeton has been using Duo for 2-factor authentication (2FA).

Yubikey with duo