Using a YubiKey with the Journalist Interface

This guide describes in detail how to set up a YubiKey for two-factor authentication on the Journalist Interface. This setup is performed once per journalist to create a secure log-in method. The process requires some configuration steps using a separate software tool.

Note

You will do all of these steps from within the Tails operating system.

What is a YubiKey?

A YubiKey is a physical token used for two-factor authentication. They are made by a company called Yubico and are commercially available.

Download and Launch the YubiKey Personalization Tool

  1. Start Tails. At the log in-screen, choose the option to allow an administrator passphrase.
  2. Open a terminal and enter
sudo apt-get update;
sudo apt-get install yubikey-personalization-gui
  1. Once you have downloaded and installed the personalization program, open a Root Terminal by choosing Applications ▸ System Tools ▸ Root Terminal.
  2. Open the YubiKey personalization tool by entering
yubikey-personalization-gui

Setting Up Hardware-Based Codes

After opening the personalization tool, click the heading OATH-HOTP. This will bring you to a window called Program in OATH-HTOP mode.

Click on the Quick button.

YubiKey Overview

Under Configuration Slot, click Configuration Slot 1.

Note

If you are already using this YubiKey for something else, you should choose Configuration Slot 2. You will have to press and hold for several seconds to use the token from Slot 2 instead of the one in Slot 1. See the YubiKey manual for more information.

In the section titled OATH-HOTP parameters, uncheck the box for OATH Token Identifier (6 bytes). Next, uncheck the box for Hide secret. This will display the Secret Key (20 bytes Hex) field.

Important

Make a note somewhere safe of the Secret Key (20 bytes Hex) value.

YubiKey Config

When ready, click the Write Configuration button.

Click through the warning about overwriting the configuration slot and choose a location to save the log file. When the configuration is done, you should see green text saying YubiKey configured at the top of the window.

Adding Users

When adding new users, a SecureDrop administrator will need the Secret Key value described above. She will enter it after selecting the I’m Using a YubiKey option while adding users.

Using Your YubiKey

When using a Yubikey to log-in to the Journalist Interface, insert the Yubikey into the USB port and enter your username and passphrase. Then click the Two-factor Code field to focus the cursor there. Quickly press the lighted button on your YubiKey. This will insert the 6-digit code that you will need to log in.

Note

When using Configuration Slot 2, be sure to press and hold the YubiKey button for approximately 3 seconds.