Yubico/yubico-pam — pull request #4 by dr8 (2011-10-25 21:52:41+00:00)
Title: Bug fix: PAM_yubico doesn't validate server signature

Fix for bug in pam_yubico.c that means that even if an API key is provided in the PAM configuration file, the yubico client does not validate the server signature.

Without this fix, the PAM module will always accept a server response, no matter what HMAC value is returned.

With this fix, if the server HMAC doesn't match the API key provided, the authentication fails with the error message:
sudo: pam_authenticate: Authentication service cannot retrieve authentication info

This bug is because pam_yubico sets the ykclient API key, but fails to set the variable in ykclient that instructs it to validate the server response.