SOLVED - YubiKey + Configure 2FA TOTP

[MaDe]

Good day,

is there a way to use the YubiKey for WebGui login? I followed this tutorial https://docs.opnsense.org/manual/how-tos/two_factor.html and it is working.
But questions was if it also possible with a YubiKey OTP.
Thanks for your advice.

[bartjsmit]

If you have the Yubico Authenticator app running on the same computer where you had the QR code up, it will grab it and offer it as a new TOTP. You can grab the same QR with your phone before you move on.

If you want to stick with the one you have set up, then in Google authenticator, hit the 3-dot menu and select Transfer accounts. Select Export, pick the OPNsense account and render the QR.

It will not let you screenshot it, so you'll need to photograph it with another phone or put it on a scanner to transfer it. Once you have it as an image file, import it into the Yubico Authenticator.

Bart...

[MaDe]

Hi Bart,
thanks for your reply. But I'm lost....
I don't want to use the Yubico app. I use the MS authenticator app, works for me.
But I also have a 'YubiKey 5 NFC' and I thought it would be possible to use the key. In the case what I have faster at hand either the MS app or the key.

Made

[bartjsmit]

I have a NEO plugged into my desktop. Are you looking to use the NFC interface to browse to the OPNsense GUI on your phone? Not sure how that will input the OTP code for you.

Do you copy and paste the OTP digits from the MS authenticator to the GUI just now?

Bart...

[MaDe]

I would like to use both, either the YubiKey or the MS app. For example, if I forget the key at home I still have the app, or the other way around.

[bartjsmit]

You need to import the OPNsense TOTP into the Yubico app, desktop or phone. If you can't export it from the MS authenticator, you'll need to create a new code and import it into both apps on your phone.

[MaDe]

I need the Yubico app to use the Yubikey and also the MS authenticator app? That does not make it easier.
Thought I can just use the Yubikey as a 'backup' in case I don't have the phone with me.

Thx,
MaDe

[bartjsmit]

The Yubikey is just a store for secrets. You need some software to retrieve its secrets and a device to display them. 

The only key fob I have used that is standalone is the RSA SecurID: https://www.rsa.com/content/dam/en/data-sheet/rsa-securid-hardware-tokens.pdf but these are reserved for large enterprises.

If you store the secrets on your phone (in the MS or Google app) then there is little point in carrying the Yubikey as well since it mitigates against your phone getting hacked, thereby compromising your codes.

You can use the Yubikey with your phone and your other devices as a single store but I would make sure there is some off-line backup (codes on paper, SD card, etc.) in case you lose it or it breaks.

Bart...

[MaDe]

Thanks for helping me out, Bart.