search

LinOTP / linotp-auth-pam

LinOTP PAM module
GNU General Public License v2.0
19 stars 17 forks source link

OTP input is echoed in the clear #10

Open throw1008a opened 4 years ago

throw1008a commented 4 years ago

Currently, after enter the SSH password (which is not displayed on the screen), the OTP Token Code prompt is output, and then as one types in the six digits they are printed on the display.

I know that theoretically this should not matter, because that's the entire point of 2FA, but sometimes auditors do not care about "theory".

I would like an option added to the PAM module to control echoing; the default can remain the same if that's easier. So the proposal is to add an "echo" option that takes one of the following parameters:

cron2 commented 4 years ago

what you are looking for is called "hide_otp_input" (option to pam_linotp.so in the pam config). If set, it will instruct OpenSSH to not echo password prompts.

(The echoing is not done by the PAM module itself but by OpenSSH, depending on PAM flags passed "up the stack")

throw1008a commented 4 years ago

Thanks.

This options is "documented" in the comments of src/pam_linotp.c: perhaps mentioning it in the README or something would be more helpful.

cron2 commented 4 years ago

I agree. Having the PAM options documented in a more easy-to-find way would be good.

(I am not one of the authors and do not have write access to the repo... I just contributed before, waiting for PR#6 to be merged, since about two years. Seems this project is fairly dead... someone should fork and revive it)