mainOATH Toolkit - Support: sr #108435, Documentation doesn't talk about...

 
 

sr #108435: Documentation doesn't talk about keys, proposes very insecure configuration

Submitter:  Robin <eythian>
Submitted:  Thu 07 Nov 2013 11:07:14 PM UTC
   
 
Category:  None Priority:  5 - Normal
Severity:  4 - Important Status:  Ready For Test
Privacy:  Public Assigned to:  None
Open/Closed:  Open Operating System:  None
* Mandatory Fields

Add a New Comment Rich Markup
   

Tue 12 Nov 2013 01:30:24 PM UTC, comment #1: 

I agree.  The manual should point to http://code.google.com/p/mod-authn-otp/wiki/UsersFile which contains the file format.  The URL is probably found in some places, but didn't make it all the way up to the PAM README file.  I have pushed this:

http://git.savannah.gnu.org/cgit/oath-toolkit.git/commit/?id=e9d90cd579bb65f15184605f38a23d8857c8747d

It could be improved further, but I'm not sure how to best recommend people to generate a good quality key (dd+perl?).

/Simon

Simon Josefsson <jas>
Group administrator
Thu 07 Nov 2013 11:07:14 PM UTC, original submission:  

From the manual:

> The above added an OATH secret of all-zeros.


this is the worst thing to do. It should be replaced with instructions on how to create a randomly generated key that isn't all zeros. If you follow these instructions at all naively, you'll end up with the most insecure OTP system possible. Additionally, the manual should show you where in the config the keys go because at the moment you can't really tell.

Robin <eythian>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by jas (Posted a comment)
  • -email is unavailable- added by eythian (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follows 1 latest change.

    Date Changed by Updated Field Previous Value => Replaced by
    2013-11-12 jas StatusNone Ready For Test

    Back to the top

    Powered by Savane 3.13-02a9.
    Corresponding source code