[question]Is it safe for authfile to be readable by everyone?

[Maryse47]

Is it safe for authfile being readable by everyone? Is there anything attacker can gain by reading authfile? Is it worth to restrict authfile readability similar to /etc/shadow?

[a-dma]

The Principle of Least Privilege applies in this case. There are now "game over" kind of information in that file, but it all boils down to what your threat model is. For example the user login name would be in the file.

Depending on what options you set and how you're using the module (which user is PAM running as), you may have different requirements. My suggestion is to give to the file the most restrictive set of permissions that you can get away with.

[Maryse47]

I don't consider user login name as sensitive, it's freely available in /etc/passwd anyway. I'm concerned with u2f credentials (keys) stored in authfile. What would be the worst scenario if they're leaked?

The problem with restricting read access to authfile is mostly related to screen lockers. They usually run as unprivileged process and they need to read the authfile. It's possible to set screenlock binary as setuid or grant them cap_read_search which will allow reading authfile even when it's restricted to root but granting such privileges is potential security hole on its own. Therefore if stealing u2f credentials from authfile won't allow doing anything malicious then I would prefer making authfile readable on my system. Just want to know what consequences of doing this may occur.

This is also relevant for yubico-pam although the dilemma is even worse there because they need also write access.

[a-dma]

Keep in mind that you can have the authfile inside the user home directory where it is safer to grant read access to the user.

Generally speaking the information within that file will allow to "register" a user, but for that to happen write access to the authfile is required.
Also, by knowing the keyhandle it is possible to check whether a specific device is registered for that specific host/RP.