Les Cunliffe, 123RF.com
Two-factor authentication for WordPress blogs
Key Ring
YubiKey is a two-factor authentication hardware tool combined with one-time passwords (OTPs). To authenticate, users need their standard password and a one-time password, which YubiKey creates. The key is very practical because it emulates a USB keyboard and is identified by the PC as such. In other words, you don't need a special driver – assuming your computer supports USB keyboards.
If the USB ports in your local Internet cafÈ are not disabled, you can even use the YubiKey/OTP combination to log in there and thus give yourself additional protection. If hackers manage to sniff or log a one-time password, they can't do anything with it because it expires after use. Also, no one can do anything with your YubiKey if you lose it, because another password is still needed to authenticate.
One practical application of this tool is protecting a WordPress blog with the technique I just mentioned and a separate plugin for the YubiKey [1]. WordPress is a PHP application, which explains why the plugin accesses the YubiKey PHP library; the library is free, as are the libraries for many other languages [2]. If you modify the blog privileges so that the web server can write to the corresponding directories, you can install the plugin directly via the WordPress administrative interface. Otherwise, you can use SSH to unpack the package or upload via FTP for the installation. Then, you can enable the plugin in the admin interface.
At the Press of a Button
To configure the plugin, you'll need a Yubico ID and an API key, which you can request from their website [3]. Enter your email address in the field at the top, move the cursor to the lower field, and then press the button to enable YubiKey (
...
Buy this article as PDF
(incl. VAT)
Buy ADMIN Magazine
US / Canada
UK / Australia
Related content
-
Hardware MFA: Death to the password!
Around since the 1960s, passwords are still the mainstay for authentication. The good news is you have alternatives in hardware multifactor authentication. - Yubico Recalls FIPS Yubikeys
-
Flexible user authentication with PAM
PAM is a very powerful framework for handling software- and hardware-based user authentication, giving administrators a choice of implementation methods. -
Multifactor authentication from FIDO
The FIDO Alliance is working to build open solutions for the future of authentication. -
Hardening SSH authentication to the max
Public key authentication further supplemented with one-time password or hardware authentication methods improves SSH security while offering genuine convenience.
Subscribe to our ADMIN Newsletters
Subscribe to our Linux Newsletters
Find Linux and Open Source Jobs
Most Popular
Support Our Work
ADMIN content is made possible with support from readers like you. Please consider contributing when you've found an article to be beneficial.
