LOGIN_TOTP-AND-PWD(8)

NAME
login_totp-and-pwd - provide TOTP and password authentication type

SYNOPSIS
login_totp-and-pwd [-s service] [-v arguments] user [class]

DESCRIPTION
The login_totp-and-pwd program attempts to authenticate the user via a combination of password authentication and an OATH time-based one-time password (draft-mraihi-totp-timebased-07).

The user argument is the login name of the user to be authenticated.

The service argument specifies which protocol to use with the invoking program. The allowed protocols are login, challenge, and response.

The arguments following -v are the same as for login_totp(8) and login_passwd(8). Unknown arguments are ignored.

The user is prompted for a password, and a secret key is read as a hexadecimal string in the file .totp-key in the user's home directory or a system directory. The file must be owned by the relevant user or by root, and must not be world or group readable/writable. The user's password must be entered in the format ‘OTP/password’, for example:

    login: charlie
    Password: 816721/axlotl

The password is split at the ‘/’ boundary into the OTP and the conventional password. The conventional password is validated as per login_passwd(8). A set of OTPs valid for the current permitted time window is generated and compared against the supplied OTP. The invoking program is informed whether or not the authentication was successful.

LOGIN.CONF VARIABLES
The login_totp-and-pwd utility optionally uses the following login.conf(5) variables:

x-start-offset
    Number of seconds after the epoch when the initial time step occurs. Default is 0 seconds.

x-step-size
    Time window duration in seconds. Default is 30 seconds. Feitian OTP c200 tokens use a 60 second step size.

x-window
    Number of time windows. login_totp-and-pwd will accept tokens from this many time windows either side of the current system time. Allows for a limited amount of clock desynchronization. Default is 0, accepting only the current token.

x-oath-dir
    System directory containing username.totp-key files. These will be used instead of ~username/.totp-key.

SEE ALSO
login(1), login_totp(1), su(1), login.conf(5)