diff --git a/ChangeLog b/ChangeLog index 076c686..e6bef8e 100644 --- a/ChangeLog +++ b/ChangeLog @@ -27,6 +27,7 @@ Trying to sort tasks according to their priority. ppp implements high-level functions which should be used explicitly to manage state information unless something more fine-grained is necessary. + * [-] Passing -f, -d, -c along with the -k. * [-] Scan all FIXME/TODO entries * [-] Manuals * [-] Improve error messages when state file is not found. diff --git a/examples/otpasswd-login b/examples/otpasswd-login index a05cb56..17744b1 100644 --- a/examples/otpasswd-login +++ b/examples/otpasswd-login @@ -3,9 +3,8 @@ auth required pam_shells.so auth required pam_nologin.so auth required pam_env.so auth requisite pam_unix.so try_first_pass likeauth nullok -# Without OOB -auth required pam_otpasswd.so retry=2 -# Example with OOB -# auth required pam_otpasswd.so retry=2 debug oob=1 oob_path=/etc/security/otpasswd_oob.sh +# You can pass 'debug' or 'silent' options here. +# Rest of the configuration is done in /etc/security/otpasswd.conf +auth required pam_otpasswd.so session optional pam_otpasswd.so diff --git a/examples/otpasswd.conf b/examples/otpasswd.conf index c52e762..1bd9082 100644 --- a/examples/otpasswd.conf +++ b/examples/otpasswd.conf @@ -115,7 +115,13 @@ MAX_ALPHABET_LENGTH=88 # Set default passcode and alphabet length ## DEF_PASSCODE_LENGTH=4 -DEF_ALPHABET_LENGTH=64 + +# 0 - 64 character long alphabet: +# !#%+23456789:=?@ABCDEFGHJKLMNPRSTUVWXYZabcdefghijkmnopqrstuvwxyz +# 1 - 88 character long: +# !"#$%&'()*+,-./23456789:;<=>?@ABCDEFGHJKLMNOPRSTUVWXYZ +# [\\]^_abcdefghijkmnopqrstuvwxyz{|}~ +DEF_ALPHABET=0 ## # 0 - Disallow generation of salt diff --git a/libotp/config.c b/libotp/config.c index 90eaa69..412cd8f 100644 --- a/libotp/config.c +++ b/libotp/config.c @@ -52,7 +52,7 @@ static void _config_defaults(cfg_t *cfg) .def_passcode_length = 4, .min_passcode_length = 2, .max_passcode_length = 16, - .def_alphabet_length = 64, + .def_alphabet = 0, .min_alphabet_length = 64, .max_alphabet_length = 88, .allow_salt = 1, @@ -207,7 +207,7 @@ static int _config_parse(cfg_t *cfg, const char *config_path) /* Parsing PAM configuration */ } else if (_EQ(line_buf, "show")) { - REQUIRE_ARG(1,3); + REQUIRE_ARG(0,2); cfg->show = arg; } else if (_EQ(line_buf, "enforce")) { REQUIRE_ARG(0, 1); @@ -217,7 +217,7 @@ static int _config_parse(cfg_t *cfg, const char *config_path) cfg->retry = arg; } else if (_EQ(line_buf, "retries")) { REQUIRE_ARG(2, 5); - cfg->retry = arg; + cfg->retries_count = arg; } else if (_EQ(line_buf, "logging")) { REQUIRE_ARG(0, 2); cfg->logging = arg; @@ -269,9 +269,9 @@ static int _config_parse(cfg_t *cfg, const char *config_path) REQUIRE_ARG(2, 16); cfg->max_passcode_length = arg; - } else if (_EQ(line_buf, "def_alphabet_length")) { - REQUIRE_ARG(64, 88); - cfg->def_alphabet_length = arg; + } else if (_EQ(line_buf, "def_alphabet")) { + REQUIRE_ARG(0, 1); + cfg->def_alphabet = arg; } else if (_EQ(line_buf, "min_alphabet_length")) { REQUIRE_ARG(64, 88); cfg->min_alphabet_length = arg; diff --git a/libotp/config.h b/libotp/config.h index cbddbdb..50fb71e 100644 --- a/libotp/config.h +++ b/libotp/config.h @@ -90,6 +90,9 @@ typedef struct { */ int retry; + /* How many retries are allowed */ + int retries_count; + /* Shall we echo entered passcode? * 1 - user selected * 0 - (noshow) echo disabled @@ -135,7 +138,10 @@ typedef struct { int max_passcode_length; /* Alphabet configuration. Default, minimal and maximal */ - int def_alphabet_length; + /* def=0 - 64 long alphabet + * def=1 - 88 long alphabet + */ + int def_alphabet; int min_alphabet_length; int max_alphabet_length; diff --git a/libotp/ppp.c b/libotp/ppp.c index eeac87b..ecacb8d 100644 --- a/libotp/ppp.c +++ b/libotp/ppp.c @@ -475,6 +475,17 @@ int ppp_release(state *s, int store, int unlock) return retval; } +/******************** + * Accessors + *******************/ +const char *ppp_get_username(const state *s) +{ + return s->username; +} + +/******************* + * Atomic combos + *******************/ int ppp_increment(state *s) { int ret; diff --git a/libotp/ppp.h b/libotp/ppp.h index b0b855b..47f255b 100644 --- a/libotp/ppp.h +++ b/libotp/ppp.h @@ -106,6 +106,8 @@ extern int ppp_load(state *s); */ extern int ppp_release(state *s, int store, int unlock); +extern const char *ppp_get_username(const state *s); + /* * 1. Lock file * 2a. Open it diff --git a/libotp/state.c b/libotp/state.c index 6dd63b7..792f763 100644 --- a/libotp/state.c +++ b/libotp/state.c @@ -649,9 +649,6 @@ int state_init(state *s, const char *username) assert(cfg->def_passcode_length >= 2 && cfg->def_passcode_length <= 16); - assert(cfg->def_alphabet_length == 64 || - cfg->def_alphabet_length == 88); - mpz_init(s->counter); mpz_init(s->sequence_key); mpz_init(s->latest_card); @@ -676,7 +673,7 @@ int state_init(state *s, const char *username) s->code_length = cfg->def_passcode_length; if (cfg->show != 0) s->flags = FLAG_SHOW; - if (cfg->def_alphabet_length == 88) + if (cfg->def_alphabet == 1) s->flags |= FLAG_ALPHABET_EXTENDED; s->failures = 0; diff --git a/pam/pam_helpers.c b/pam/pam_helpers.c index 410e618..b28eea0 100644 --- a/pam/pam_helpers.c +++ b/pam/pam_helpers.c @@ -29,14 +29,6 @@ /* kill() */ #include - - -#define PAM_SM_AUTH -#define PAM_SM_SESSION -//#define PAM_SM_ACCOUNT -//#define PAM_SM_PASSWORD -#define _PAM_EXTERN_FUNCTIONS - #include /* FreeBSD */ @@ -44,8 +36,6 @@ #include "pam_macros.h" - - #include "print.h" #include "num.h" #include "ppp.h" diff --git a/pam/pam_otpasswd.c b/pam/pam_otpasswd.c index 4657da2..096cece 100644 --- a/pam/pam_otpasswd.c +++ b/pam/pam_otpasswd.c @@ -61,7 +61,7 @@ PAM_EXTERN int pam_sm_authenticate( /* Retry = 0 - do not retry, 1 - with changing passcodes */ int tries; - for (tries = 0; tries < (cfg->retry == 0 ? 1 : 3); tries++) { + for (tries = 0; tries < (cfg->retry == 0 ? 1 : cfg->retries_count); tries++) { if (tries == 0 || cfg->retry == 1) { /* First time or we are retrying while changing the password */ retval = ph_increment(pamh, cfg, s); @@ -113,15 +113,19 @@ PAM_EXTERN int pam_sm_authenticate( /* Correctly authenticated */ retval = PAM_SUCCESS; - print(PRINT_NOTICE, "Authentication succeded\n"); + print(PRINT_WARN, + "Accepted otp authentication for user %s\n", + ppp_get_username(s)); goto cleanup; } /* Error during authentication */ retval = PAM_AUTH_ERR; - } - print(PRINT_NOTICE, "Authentication failed\n"); + print(PRINT_WARN, + "Authentication failure; user=%s; try=%d/%d\n", + ppp_get_username(s), tries+1, cfg->retries_count); + } cleanup: ph_fini(s);