| commit | 7fad18cdf8fa8b6a5d7d23d2b9f2edcd4a697f2d | [log] [tgz] |
|---|---|---|
| author | Greg Stein <gstein@gmail.com> | Fri Jun 19 12:53:03 2020 -0500 |
| committer | GitHub <noreply@github.com> | Fri Jun 19 12:53:03 2020 -0500 |
| tree | dbc4114149f098c4445f2ded513aceba680de892 | |
| parent | b865516930ae32ce87d3d29b095ba01cbc5c04eb [diff] |
remove unused imports
Command-line OTP calculator, with automatic password creation/storage.
The Apache Software Foundation (ASF) uses the Orthrus PAM module on its machines/VMs. Orthrus implements RFC 2289 to offer One Time Password (OTP) challenges, in order to sudo. That package emits MD5-based challenges (otp-md5), so this script only constructs MD5-based responses.
The challenge presented by Orthrus can be copy/pasted onto the command line, or (absent command line args) into the Challenge? prompt.
[remote]$ sudo bash otp-md5 440 someseed ext Password: [local]$ ./otp.py Challenge? otp-md5 440 someseed ext Response: MEAT SAD JERK STUN ARGO ITS NOTE: copied to clipboard
or [local]$ ./otp.py otp-md5 440 someseed ext
Note that you must copy/paste the challenge string from the remote host to the prompt on the local host. The response can then be pasted into the remote host's Password: prompt.
If the local host has the xclip or pbcopy program, then the reponse will be automatically copied to the clipboard. If that is not present, or does not exit with success, then the response string can be manually copied, then pasted to the remote.
The algorithm (“otp-md5”) is the default, and the only supported algorithm at the moment. On both the command line and the Challenge? prompt, that may be omitted. For example:
[local]$ ./otp.py Challenge? 440 someseed ext Response: MEAT SAD JERK STUN ARGO ITS NOTE: copied to clipboard
or
[local]$ ./otp.py 440 someseed ext Response: MEAT SAD JERK STUN ARGO ITS NOTE: copied to clipboard
Note that some Orthus implementations produce extra words (eg. ext). These will be ignored. The important parts are the algorithm (optional), the sequence, and the seed values.
The algorithm associated with a seed will be stored into the .otp file, and will override any future specification of an algorithm. Or, it shall provide the algorithm when it is not explicit on the command line or challenge prompt. In all cases, otp-md5 is the current default.
The script examines the program name used to invoke it (sys.argv[0]), and if that name matches a defined algorithm (otp-*), then it will use the command line arguments to select the sequence and seed.
For example:
[local]$ ln -s $somewhere/otp.py otp-md5 [local]$ otp-md5 440 someseed ext Response: MEAT SAD JERK STUN ARGO ITS NOTE: copied to clipboard
Note that the challenge string from [remote] is directly pasted to the shell prompt.
$ ./otp.py --test
This will run a few internal tests. Any problems will raise an AssertionError
If new seed is seen (ie. by running ortpasswd), then otp.py will construct a new password and store the seed and password into $HOME/.otp. The password will be used the next time the seed is seen.
.otpThe .otp file is a list of single lines, containing the algorithm, the seed, and the password for that seed. For example:
otp-md5 someseed password-goes-here
Since spaces are not allowed in the algorithm or seed, these lines are easily parsed. Note that spaces are allowed in the password, so the password consists of the rest of the line.
.otpIt is fine to append lines to .otp if you are carrying over seed/password values from another system (eg. SKeyCalc on older macOS machines). If you need to reset a password for a given seed, then remove the old line and go through the process to generate a new seed/password combination (and note that you'll also need to reset the Orthus state on the target machine).
The SKeyCalc application on macOS was a great tool for RFC 2289 challenges; however, it has not been updated for the latest macOS and is no longer usable. otp.py is a suitable replacement.
Instead of resetting your Orthus configuration on every machine, it is possible to copy the settings from SKeyCalc into your .otp file. This is a manual process using the Keychain Access application (it may be possible to use a keyboard macro utility to simplify this process).
skey; the listing should show all of your stored SKeyCalc passwords.otp file (remember to include otp-md5 at the beginning of each line).keyring python package to support keyrings instead of a plaintext fileLicensed under the Apache License, v2.0