Thread: HOTP authentication at log in question

does know if/how possible integrate hotp authentication gdm login manager?

want have ask password of account, prompt come asking code account.

know how set up, i'm know if modifying pam module requiring oath/hotp authentication make happen or if break system...and 1 thing don't want have fix.

your options are:

-- use dedicated module, either made others or made you. there appear exist implementations of one-time-password modules (see http://www.kernel.org/pub/linux/libs/pam/modules.html, section "one-time password authentication") managed reach 1 link; rest gave errors. 1 link saw claims module not production-grade yet.

-- use database user-otp pairs , pam_userdb module. example gmd (or gdm3) configuration file inside /etc/pam.d like:

code:

... previous entries  # standard unix password authenication @include common-auth auth    required    pam_userdb.so db=/path/database [... possibly other options; see http://www.kernel.org/pub/linux/libs...am_userdb.html details ]  ... next entries

you need use pam_exec module update database after succesful authentication (either before or after above line, depending on how populate database). see documentation of pam_exec module details: http://www.kernel.org/pub/linux/libs...-pam_exec.html. see pam page http://www.kernel.org/pub/linux/libs/pam/ further documentation links.

therefore, fisrt option has potential scrue things up. use immature or custom-made code. others; if misconfigure pam typically end-up locked out of system.

second option uses more standard , possibly better tested approach. need implement code populate , keep in sync database one-time passwords.

in case, since modifying files inside /etc/pam.d, relatively easy restore system, copying old versions (provided of course manage login system). if system in question local, 1 can boot rescue disk , restore old configuration back. if system remote, 1 must ensure root shell console remains open while testing new configuration, old configuration can restored right away.

there third option if interested in local logins only: instead of using hotp, use pamusb (that presence of usb dongle in addition password), features 1 time pad mechanism, not easy forge device serials. not same thing, works , may adequate security needs.

Forum The Ubuntu Forum Community Ubuntu Specialised Support Security [ubuntu] HOTP authentication at log in question

Ubuntu