bla repository

OLD ENTRY:
There're few available like ppp-pam, otpw, sotp, most weren't in repos of my distribution and some were simply to strange to use (s/key). I've decided to take one which looked pretty nice (mostly because of sexy passcards), install it and then do some hacking. It works.

I've chosen ppp-pam, which looked as a quite abandoned project, wrote ebuild, installed and quite liked it. Still it was fun to add configuration options to module, patch one or two security (in my understanding) issues, some less important issues when the same one-time password could be used twice, add some functionality I use (latex output), write an exemplary /etc/pam.d/otp-login file, some README etc.

Security...
Passcodes in ppp-pam are simple, 4-character long words without similar characters like 0, O, 1 and l. Version 0.2.4 with "secure" option (or --dontSkip not used) handles "race-for-the-last-key" attack in my opinion better than OTPW, by simply not allowing it to happen. By the time the user is asked some passcode, its already considered "used", and locking should prevent race-condition here (unless I missed something). DoS relying on an attacker using up all passcodes we have printed can be prevented by requiring the basic unix password before prompting for passcode at all. In situation when my basic password is sniffed, attacker can still do it, but this is a thing I can accept (still he will have to use plenty of different IP, because sshguard will block him after few trials).

And, if I accidentally end up without passcodes, I can still visit one URL and request current passcode in SMS (or email). Cool, eh?

Download...
I've got no contact with author so far, so if you like my changes you'd have to use my git repos or source tarball ppp-pam-0.2.5.tar.bz2. Latest original release has version 0.2, so I'm marking this (kind of) fork with 0.2.x versions.

Gentoo ebuild, which might be added in future to sunrise overlay, also can be used.