Configuring One-Time Password Authentication with OTPW
Password authentication contains a lot of assumptions about security and trust. Encrypted SSH tunnels and public key verification are two common ways to ensure that your password is not compromised in transit. But, what if it's the computer you're currently typing on that can't be trusted?
This isn't just a tinfoil-hat scenario for paranoid penguinistas. There are many everyday situations and common locations where you probably should not use your system password, even over a secure tunnel. Examples include:
A public computer in a hotel, library or Internet café.
A coworker's virus-infested computer.
A shared workstation while pair-programming.
Any place someone could watch you type in your password.
What do all these examples have in common? Essentially, that you're trying to connect to a trusted destination from an untrusted source. This is a complete reversal of what most authentication systems were designed to address.
Take public key authentication. SSH public key authentication certainly bypasses the password prompt on the remote host, but it still requires you to trust the local machine with your private key password. In addition, once the key is decrypted with your password, the local system has full access to the sensitive key material inside.
Uh-oh—luckily, there's already a solution for this frequently overlooked problem: one-time passwords.
The combination of SSH and one-time passwords is powerful:
The SSH protocol provides encryption of the login sequence across the network.
A good SSH client allows you to inspect the remote host's public key fingerprint before entering your credentials. This prevents a rogue host from collecting your one-time passwords.
The one-time password system ensures that a password can't be reused. So, even if the password is captured in transit, it's worthless to an attacker once you've logged in with it.
A number of one-time password solutions are available for UNIX-like systems. The two most well-known are S/KEY and OPIE (One-Time Passwords in Everything).
With the recent removal of OPIE from the Debian and Ubuntu repositories, the OTPW one-time password system created by Markus Kuhn provides a viable alternative. Although not a drop-in replacement for OPIE, OTPW offers comparable functionality while providing some interesting features not found in either S/KEY or OPIE.
OPIE Removal from Debian and Ubuntu Repositories
Debian began removing OPIE-related packages in early 2011, following some discussions about the security of the binaries, licensing issues and lack of upstream activity.
If you're interested in the details, the following Debian bug reports are relevant:
While the OPIE packages remain in the current Debian stable release at the time of this writing (code-named "Squeeze"), and some unofficial platform ports can be found in the debports repository, OPIE is not available in testing or unstable, and it appears unlikely to be included in the next stable release.
Todd A. Jacobs is a veteran IT consultant with a passion for all things Linux. He spends entirely too much time making systems do things they were never designed to do.
|Alice, the Turtle of the Modern Age||Mar 07, 2014|
|Using Django and MongoDB to Build a Blog||Mar 05, 2014|
|What virtualization solution do you use/manage at work?||Mar 04, 2014|
|Our Assignment||Mar 04, 2014|
|March 2014 Issue of Linux Journal: 20 Years of Linux Journal||Mar 03, 2014|
|Have Resume - Will Travel||Feb 28, 2014|
- You have to be careful there
1 week 4 days ago
- Wonder when LJ is going to
1 week 5 days ago
- Puerto Rico Free Software
1 week 6 days ago
2 weeks 7 hours ago
- I hate voice commands
2 weeks 21 hours ago
- usabilty --- AGAIN with this nonsense
2 weeks 22 hours ago
- Don't make excuses
2 weeks 1 day ago
- Sorry to let you know, but
2 weeks 1 day ago
- Ridiculous statement. Not a
2 weeks 2 days ago
2 weeks 2 days ago