pam_sotp 0.3.3 manual

1.1. Usage scenario

The user is provided with a list of one time passwords. each time the user wants to authenticate against an sotp-enabled service he or she will be asked to enter an specific password of the list. in case of successful authentication that password will become invalid or valid only for a configured period of time (depending on how the service was configured) and the service will ask for a different password next time.

This list of one time passwords (OTP list) is typically stored in print form and stored in the user's wallet or in electronic form in the user's PDA or cell phone.

Optionally passwords can be configured with a 'prefix', which is another password which the user has to memorize and which has to be written as a prefix of the requested one time password. The prefix acts as a security measure in case that the OTP list is lost or stolen from the user.

The system administrator can configure a service in such a way that entered passwords are valid for a configured period of time. This feature, which we will call password lifespan, is useful when the application requesting the authentication will have to authenticate several more times in a period of time (for example, a webmail application authenticating against the IMAP server).

3.1. Creating a new authentication database

pam_sotp stores authentication information in authentication databases. Each authentication database contains the information used to authenticate one user. Authentication databases are grouped into authentication directories. Each pam_sotp-enabled PAM service will authenticate against an authentication directory (by default /etc/sotp, but this can be changed for each service). If the user to be authenticated doesn't have an authentication database under the inspected authentication directory, pam_sotp refuses to authenticate him/her, giving control back to the PAM module stack.

The support utilities for pam_sotp have been merged into one utility: otppasswd. Once you have installed pam_sotp all you have to do to create a new authentication databasefor your user is to run the otppasswd command. otppasswd usage is straightforward:

$ otppasswd -h
otppasswd v.0.3.3  (C) 2004 Pedro Diaz (sotp@cavecanen.org)

Usage: otppasswd [OPTIONS]

Available options:

  -o file           File used to store the OTP list
  -n number         Number of passwords to generate (default: 20)
  -p prefix         Prefix to add in each generated password (default: No prefix)
  -l length         Length of each generated password (default: 5)
  -t lifespan       Built-in password lifespan, in seconds (default: 0)
  -e days           Make the auth database expire in x days (default: don't expire)
  -c charset        Charset used when generating passwords (default: 0123456789)
  -d authdir        Authentication directory (default: /etc/sotp/)
  -P                Pretty-print the OTP list
  -D                Disable the auth database
  -E                Enable the auth database
  -h                Show this help message

If the options -D or -E are not specified, otppasswd will create a new authentication database overwriting any previous database that the user might have in the authentication directory. This means that you can use otppasswd to generate a new OTP list when you are near to run out of passwords. Keep in mind that since otppasswd overwrites the previous database your previous OTP list won't be valid anymore.

The option -D disables an existing authentication database. The authentication data will still be there but pam_sotp will refuse to use it. The option -E enables a previously disabled database.

3.2. Configuring the pam_sotp module

The pam_sotp.so module accepts the following options:

• auth_dir=path Path to the SOTP authentication directory. If not specified the default (specified with the configure script when pam_sotp was compiled, or /etc/sotp if none was specified) will be used

• fail_delay=nsecs Plan a delay of at least nsecs seconds after a failed authentication. The actual number of seconds of waiting depends on PAM and the module stack. The default for this option is zero seconds.

• prompt_number=<yes|no> Include the password number in the prompt. The default for this option is to include the password number in the prompt.

• pw_lifespan=nsecs Set the password lifespan value for this service. The default for this option is cero seconds.

auth sufficient pam_sotp.so prompt_number=yes 
account required        pam_unix.so

	odiel:~# telnet localhost
	Trying 127.0.0.1...
	Connected to localhost.localdomain.
	Escape character is '^]'.
	Debian GNU/Linux 3.1 odiel
	odiel login: susan

	One time password [01]: 
	Password:

	odiel:~# telnet localhost
	Trying 127.0.0.1...

	Connected to localhost.localdomain.
	Escape character is '^]'.
	Debian GNU/Linux 3.1 odiel
	odiel login: pdiaz
	Password:

3.3. Other issues