A plugin to use Yubico's Yubikey 2nd factor with Roundcube webmail.

Installs: 106

Dependents: 0

Suggesters: 0

Stars: 29

Watchers: 8

Forks: 5

Open Issues: 2

Type: roundcube-plugin

1.4 2016-04-06 01:11 UTC


Maintainers Wanted

Use Yubico's YubiKey to authentication to Roundcube webmail.

The Yubikey is a USB key emulating a generic keyboard and make use of One-time Passwords to provide two factor authentication.

  • Some people use this to mitigate the risk/impact of their password getting compromised.
  • Others use it to reduce (but not elimitate) the risk of authenticating to their webemail account from a potentially compromised computer. The one-time password requires the attacker to conduct an active attack on the token or the session instead of simply/passively capturing your password.

The plugin is known to be working with Roundcube version 1.0 to 1.3.1.


  • Support alternative API servers - see yubikey_api_url
  • Validation of the token is done via HMAC-SHA1 authentication over HTTPS (with certificate and hostname validation)
  • Usage enforcement or in other words disallow yubikey opt-out (disabled by default) - see yubikey_disallow_user_changes
  • Multiple keys by users.


  • Curl PHP module with TLS support.


  1. Install the code in the plugin directory and name it exactly yubikey_authentication (roundcube/plugins/roundcube_yubikey_authentication/)

  2. Add the plugin name in the plugins array of the config file (config/ formely It must match the name of the directory used in #1.

    $config['plugins'] = array('roundcube_yubikey_authentication');
  3. Set your API keys in plugins/roundcube_yubikey_authentication/ by visiting

    $rcmail_config['yubikey_api_id']  = 'ID HERE'; 
    $rcmail_config['yubikey_api_key'] = 'KEY HERE';
  4. Login normally and configure your yubikey in "Settings/Server Settings" menu:

  5. Ensure "Require YubiKey OTP" is checked

  6. Set your "YubiKey ID" by simply pressing on your yubikey (only the first 12 chars will be used).

  7. Test your installation. You're done!





This code is based on work done by Oliver Martin which was using patches from dirkm.


  • Stuart Henderson - support alternative API servers and some cosmetic tweaks
  • Peter Kahl - disallow yubikey opt-out
  • Florian Götz - multiple keys per users
  • Mathias - 1.3.1 bug fix


Danny Fullerton - Mantor Organization