One-Time Password Authentication System - Summary
This project is not part of the GNU Project.
Intro
A one-time password (OTP) is a password that is only valid for a single login session or transaction (usually along a normal static password). Using them reduces risks associated with login into your system from unsecure (keylogged) workstations.
PAM module enables (for example) OpenSSH to do an authentication using
one-time password with the information from user state file. Instead of using passcards one can also configure OTPasswd to send passcode over a secure channel (like SMS).
Implementation
The program is written in C (C99) and implements OTP as described in
"Perfect Paper Passwords v3". OTPasswd also kind of extends this idea with "salt". Program shares all main ideas with ppp-pam project. It tries to extend it and fix it's deficiencies.
OTPasswd is in development. In ChangeLog there's a list of things I'd like to implement before publishing this as a version 1.0. Most of features work (as of v0.3) but of course - it requires tests. Think of this as an alpha software.
Features of 0.4v
- Passcard output in plain ASCII or in LaTeX
- Secure locking of state files to resolve race conditions.
- Many user definable options:
- two alphabets to choose (of 64 or 88 characters)
- (not)skipping on failures
- (not)showing entered passcodes
- selectable passcode length (from 2 to 16)
- Many admin definable options
- enforcing passcode skipping
- enforcing otpasswd usage
- enforcing passcode (not)show setting
- enabling passcode retry on failure
- May warn user during login if he's running out of passcodes.
- Written with respect for security.
- Compatible with Perfect Paper Passwords version 3 if salting is disabled during key creation.
- Salt support (see README for details). Makes pretty impossible known-plain-text attacks on the AES cypher even more impossible (as plain-text is no longer known for the attacker) and increases total key length from 256 to 352 bits which makes impossible brute-force attacks even more impossible.
- SMS/Mail/pigeon notification of current passcode.
Some of features added in 0.5v
- Two modes of operations with either state kept in user homes, or in /etc/otpasswd/otshadow (global database).
- Versatile system-wide policy when using global database.
- README/INSTALL rewritten/cleanup.
- LOTS of new documentation written thanks to Hannes Beinert (including manual pages)
- Global configuration file.
- User interface revised and cleaned up.
- Failure counting / warning.
- Out-of-band messaging can be secured with password.
- Custom alphabet support.
- Prepared for localization.
- Tested on FreeBSD
- Dropped dependency on OpenSSL
Installation
First of all in case of any problems see INSTALL/README file! I distribute .ebuild file for Gentoo distribution which should ease the installation a lot. If you happen to create a package for any other distribution - let me know, I can publish it then.
Fragments of README regarding installation:
To install otpasswd and configure it to work with ssh you have to:
0. Have all required dependencies (with headers)
1. Compile and install the package
2. Enable its use in /etc/pam.d
3. Configure ssh to use PAM.
4. Generate keys for user (and print at least one password card)
5. Tweak PAM module configuration
So.
0) Package requires gmp library and it's header files (see -dev packages) and cmake tool. They should be available in the repository of your distribution.
1) Check if the package is not in your distribution package manager. If it is - install it as any other software. Otherwise fallback to compilation:
$ cd otpasswd
$ cmake . # This will generate makefiles; will fail if you lack packages!
$ make # This should compile anything
$ make install # This should install binaries into system.
Instead of using make install you can just copy two files, PAM module into /lib/security and otpasswd password manager to /usr/bin. There's also exemplary pam configuration in example/otpasswd-login this can be copied to /etc/pam.d (which itself won't change anything in your PAM config).
Registration Date: Tue 01 Dec 2009 01:15:23 PM UTC
License: GNU General Public License v3 or later
Development Status: 4 - Beta

