LOGIN_TOTP(8)

NAME
login_totp - provides authentication via OATH/TOTP one-time passwords

SYNOPSIS
login_totp [-s service] [-v arguments] user [class]

DESCRIPTION
The login_totp program attempts to authenticate the user via an OATH time-based one-time password (draft-mraihi-totp-timebased-07).

The user argument is the login name of the user to be authenticated.

The service argument specifies which protocol to use with the invoking program. The allowed protocols are login, challenge, and response.

The arguments following -v are the same as for login_passwd(8). Unknown arguments are ignored.

The user is prompted for a password, and secret keys are read as newline-separated hexadecimal strings in the file .totp-key in the user's home directory or a system directory. The file must be owned by the relevant user or by root, and must not be world or group readable/writable. A set of OTPs valid for the current permitted time window is generated from the secret key and compared against the supplied OTP. The invoking program is informed whether or not the authentication was successful. If the file contains multiple secret keys, each is tested in sequence, allowing more than one token to give access to a particular account.

LOGIN.CONF VARIABLES
The login_totp utility optionally uses the following login.conf(5) variables:

x-start-offset
    Number of seconds after the epoch when the initial time step occurs. Default is 0 seconds.

x-step-size
    Time window duration in seconds. Default is 30 seconds. Feitian OTP c200 tokens use a 60 second step size.

x-window
    Number of time windows. login_totp will accept tokens from this many time windows either side of the current system time. Allows for a limited amount of clock desynchronization. Default is 0, accepting only the current token.

x-oath-dir
    System directory containing username.totp-key files. These will be used instead of ~username/.totp-key.

SEE ALSO
login(1), login_totp-and-pwd(1), su(1), login.conf(5)