-
Notifications
You must be signed in to change notification settings - Fork 1
/
Copy pathChangeLog
259 lines (245 loc) · 13.3 KB
/
ChangeLog
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
ChangeLog / TODO
================
[+] New functionality
[!] Fixed error
[%] Found bug
[*] Changes in existing functionality
[-] Feature in TODO
[?] New feature in TODO
Trying to sort tasks according to their priority.
2009-12-13 v0.5
Done:
* [+] Check bit distribution for alphabets not divisible by 2
* [+] Remove dont-skip option.
* [+] GMP might leak information with reallocs of it's mpz_t
Fixed by substituting alloc functions. num_init() must
be called before any other gmp functions.
* [+] Testcases added into make, with coverage measurement.
They will modify your state data though so beware!
PAM testcase added! Including coverage support, whoa!
* [!] Bug in num.c/reallocate fixed. Did not exist in 0.4
* [!] New testcase allowed to detect some memory leaks.
Possibly exist in 0.4
* [+] Improve error messages when state file is not found.
* [+] Config file in /etc/security
pam_access parses this file itself; samba(winbind) uses
iniparser library (on MIT license)
* [+] See how functions in otpasswd_actions initialize and
deinitialize state, see if they can use ppp_, if not
make them so they can. Or write some local static functions
to handle errors during lock&load.
* [+] Fix db* functions to return values from enum in ppp_common.h
* [!] Skipping to 'next' not by 6...
* [+] Removed dependency - OpenSSL
* [+] Modify build config to work with CMake v2.4.7
* [+] Config file revised.
* [+] Multiple alphabet support
* [+] Passing -f, -d, -c along with the -k.
* [+] Partial policy implemented.
Ensure that if the invalid state is read from file
that the authentication will never succeed.
* [+] Check if OOB script is not SUID?
* [+] Ensure that PAM session can display warning in three calls
to conversation function. If not, we must build a buffer
(See for example how winscp shows that warning)
(FIXED by simplifying warnings)
* [+] Because of signals - redo permissions. (SUID required)
* [+] The key/counter length is not checked when read from file.
* [+] Big thing - Move state files to /etc + SUID.
* [+] Manuals - Plenty of things finished thanks to Hannes Beinert.
* [+] fsync before rename/unlock (see ext4 problem)
sync() call inserted after fclose and before rename.
* [+] First unlink lock file, then unlock to omit race condition?
* [+] Add -r option to remove key and disable OTP.
* [+] Fix user interface a bit.
* [+] Keeping track of failures.
Implemented, but not tested.
* [+] Any possibility to change directory from /etc/otpasswd?
This is going to be compile time option. Also otshadow
will be required to reside inside.
* [+] right trim values from config?
* [+] Check custom alphabet correction (whitespaces or multiple
occurences of same character not allowed.
TODO Major:
* [?] Logging warnings printed to user at WARN level
* [?] Key quality checking (duplicates)
* [?] Verify SIGCHLD won't clobber anything.
* [-] "Problem solving section" in docs, mentioning use of -v on
errors in the first place.
* [%] Should we start suid root then drop to some config-defined user
so attacker who breaks otpasswd can't modify the executable?
Probably yes. Two modes of operation.
* [?] Global DB should work with users which aren't in passwd.
* [?] Check if lock files are links. if so. fail. Or rather always unlink
before overwritting.
* [?] Logging into syslog from utility if SUID; Also deny -v.
* [?] Security: Do we need to change something regarding ulimits?
* [-] Implement static passwords;
They might be required always or just to perform some commands
like second-channel usage.
* [?] Cleanup PPP interface. This should look like follows.
"State" is class implementing some basic features of
state management. From this 'class' ppp is derived.
ppp implements high-level functions which should be used
explicitly to manage state information unless something
more fine-grained is necessary. State on the other hand
uses 'db' backend for operating on files/databases.
* Lots of things done in direction to finish this task
* [-] Scan all FIXME/TODO entries
* [?] Use locales for user messages [_("")? ]
* [?] SELinux compatibility.
* [?] Import/export of ascii state lines...
* [%] User can always remove DISABLED flag if he can regenerate state.
Should he be allowed to do this?
* [?] Make otpasswd work with su (there's additional information 'who
is trying to get authenticated'. Just test it.
* [?] Skip policy; deny skipping backwards. Add some semantic for
skipping count of passcards?
Todo Minor:
* [?] Sourced key generation (from file, string...)
* [?] Add error_t and bool_t to differentiate differently
used ints?
* [?] Improve LaTeX output (some colors, borders?)
* [?] Incorporate SSH key fingerprints on passcards?
Use some file as passcard background, allow hook
regenerating this passcard
* [-] Keep lines below 75 columns? Or 80?
2009-12-13 v0.4
* [!] Fixed some memory leaks.
* [!] Ensure state loaded correctly when label/caption full
* [+] Improve testcases so when they fail it's clearly visible.
* [+] Fixed licensing so the project can be hosted on Savannah
* [+] CHECK: Can pam module use openlog()? Maybe the log is already opened? I guess so...
Seems ok. pam_unix defines pam_syslog as openlog, vsyslog,
closelog.
* [+] Warnings when on last passcard
* [+] Add information to state files about last usage of second
channel. Important to limit number of e.g. sent sms.
Second-channel itself still not implemented
* [+] Calling external script for mailing/sms
* [+] Key generation might be to slow on systems without mouse...
Maybe use openssl prng and initialize it from urandom?
Also is there any reason to use SHA256 on RANDOM data?
Maybe few bytes from rng + some from prng and SHA out of it?
* [+] Place common functions inside a shared library
* [+] Check bit distribution for alphabets not divisible by 2
Added separate testcase evaluating character distribution
instead of bits. This testcase shows that distribution
is in correct range.
* [-] Keeping track of failures.
Started (place in state files created)
* [-] Implement static passwords;
They might be required always or just to perform some commands
like second-channel usage.
* [%] GMP might leak information with reallocs of it's mpz_t
* [?] Cleanup PPP interface. This should look like follows.
"State" is class implementing some basic features of
state management. From this 'class' ppp is derived.
ppp implements high-level functions which should be used
explicitly to manage state information unless something
more fine-grained is necessary.
* [-] Scan all FIXME/TODO entries
* [-] Manuals
* [-] Improve error messages when state file is not found.
* [?] Big thing - Move state files to /etc + SUID.
* [?] Use locales for user messages [_("")? ]
* [?] Config file in /etc/security
pam_access parses this file itself; samba(winbind) uses
iniparser library (on MIT license)
* [%] Ensure that PAM session can display warning in three calls
to conversation function. If not, we must build a buffer
(See for example how winscp shows that warning)
* [?] Use PAM_SERVICE_ERR
Low-priority:
* [?] Improve LaTeX output (some colors, borders?)
* [?] Incorporate SSH key fingerprints on passcards?
* [-] Keep lines below 75 columns? Or 80?
* [-] off-by-one testcases; a bit tests done.
To be removed:
* [-] Single-authentication/locking per user option to prevent DoS
This would enable attacker to perform just another DoS attack.
* [-] Share objects between targets (CMake)
Splitting project into shared lib, util + pam is better
2008-12-02 v0.3
* [!] Fixed some memory leaks.
* [!] Ensure state loaded correctly when label/caption full
* [+] Fixed licensing so the project can be hosted on Savannah
* [-] CHECK: Can pam module use openlog()? Maybe the log is already opened? I guess so...
* [-] Warnings when on last passcard
* [-] Calling external script for mailing/sms
* [-] Share objects between targets (CMake)
I'll rather ignore it. .so must have -fPIC, util shouldn't...
* [?] Scan all FIXME/TODO entries
* [?] Keep lines below 75 columns? Or 80?
* [?] off-by-one testcase; a bit done
* [?] manuals
* [%] GMP might leak information with reallocs of it's mpz_t
* [?] Single-authentication/locking per user option to prevent DoS
* [?] Check bit distribution for alphabets not divisible by 2
* [?] Error messages when no state file.
* [?] Key generation might be to slow on systems without mouse...
Maybe use openssl prng and initialize it from urandom?
Also is there any reason to use SHA256 on RANDOM data?
Maybe few bytes from rng + some from prng and SHA out of it?
* [?] Keeping track of failures.
Started (place in state files created)
2009-12-01 v0.2
* [!] One off-by-one error fixed
* [+] Implement label and contact setting
* [+] Differentiate abnormal errors from normal errors
* [+] 'next' behaviour with LaTeX (+6!)
* [+] Decide on state file look, add version
* [+] ppp testcase - statistical
* [+] Check all assertions! If they don't contain anything important
* [%] Ensure state loaded correctly when label/caption full
* [-] CHECK: Can pam module use openlog()? Maybe the log is already opened? I guess so...
* [-] Warnings when on last passcard
* [-] Calling external script for mailing/sms
* [-] Share objects between targets (CMake)
* [-] Using Gecos field for phone information?
* [?] Scan all FIXME/TODO entries
* [?] Keep lines below 75 columns? Or 80?
* [?] off-by-one testcase; a bit done
* [?] manuals
* [%] GMP might leak information with reallocs of it's mpz_t
2009-12-01 v0.1 first working version
* [!] CHECK: Make testcase to check if locking file and then rewritting it has any sense.
It didn't; rewritten code uses .lck file
* [+] Implement/debug Retries
* [+] Implement skipping
* [+] Implement next functionality
* [+] Printing 'next' passcard.
* [+] Ensure passcards/codes passed by user are in range and won't get larger because of increments.
Needs debuging. Especially internal incrementation.
* [+] Ensure file permissions are always set correctly
* [+] If not locked when storing/loading lock it for this procedure.
* [-] CHECK: Can pam module use openlog()? Maybe the log is already opened? I guess so...
* [-] Warnings when on last passcard
* [-] Decide on state file look, add version
* [-] Implement label and contact setting
* [-] Calling external script for mailing/sms
* [-] Share objects between targets (CMake)
* [-] Using Gecos field for phone information?
* [?] Keep lines below 75 columns? Or 80?
* [?] 'next' behaviour with LaTeX (+6!)
* [?] ppp testcase - statistical
* [?] off-by-one testcase
* [?] manuals
2009-11-24 intro/rapid-development TODO
== "Roadmap" to v1.0 ==
* [-] CHECK: Can pam module use openlog()? Maybe the log is already opened? I guess so...
* [-] CHECK: Make testcase to check if locking file and then rewritting it has any sense.
* [-] Implement/debug Retries
* [-] Implement skipping
* [-] Implement next functionality
* [-] Warnings when on last passcard
* [-] Printing 'next' passcard.
* [-] Ensure passcards/codes passed by user are in range and won't get larger because of increments.
* [-] Ensure file permissions are always set correctly
* [-] If not locked when storing/loading lock it for this procedure.
* [-] Decide on state file look, add version
* [-] Implement label and contact setting
* [-] Calling external script for mailing/sms
* [-] Share objects between targets (CMake)
* [-] Using Gecos field for phone information?
vim: expandtab:ts=8