search

google / google-authenticator-libpam

Apache License 2.0
1.76k stars 281 forks source link

grace_period timestamp not updated in secret file, with no error message #193

Closed roeme closed 3 years ago

roeme commented 3 years ago

I'm not sure wether I'm doing something wrong, but according to the sources and documentation my setup should work. Except, it only does so partially: A (manually added) LAST%d <IP> <time_t>-Line to my secret file is read and honoured correctly.

If the timestamp is outside the grace_period, the user is prompted for a TOTP code as expected. However, upon sucessfully entering the code, aforementioned line is not updated, and hence prompts appear at every subsequent login attempt.

Testing done under mainly done raspbian (armv7) and a bit on debian (x86). Not sure if the arch has any bearing, and a quick glance at the debian sources leads me to believe that there is no further patching done by these distributions.

Debug output for a successful attempt:

Feb  2 23:06:26 rosie sshd(pam_google_authenticator)[26498]: debug: start of google_authenticator for "<USER_REDACTED>"
Feb  2 23:06:26 rosie sshd(pam_google_authenticator)[26498]: debug: Secret file permissions are 0600. Allowed permissions are 0600
Feb  2 23:06:26 rosie sshd(pam_google_authenticator)[26498]: debug: "/home/<USER_REDACTED>/.google_authenticator" read
Feb  2 23:06:26 rosie sshd(pam_google_authenticator)[26498]: debug: shared secret in "/home/<USER_REDACTED>/.google_authenticator" processed
Feb  2 23:06:26 rosie sshd(pam_google_authenticator)[26498]: debug: google_authenticator for host "<IP_REDACTED>"
Feb  2 23:06:26 rosie sshd(pam_google_authenticator)[26498]: within grace period: "<USER_REDACTED>"
Feb  2 23:06:26 rosie sshd(pam_google_authenticator)[26498]: debug: end of google_authenticator for "<USER_REDACTED>". Result: Success

An attempt which should update the grace_period:

Feb  2 23:09:20 rosie sshd(pam_google_authenticator)[27101]: debug: start of google_authenticator for "<USER_REDACTED>"
Feb  2 23:09:20 rosie sshd(pam_google_authenticator)[27101]: debug: Secret file permissions are 0600. Allowed permissions are 0600
Feb  2 23:09:20 rosie sshd(pam_google_authenticator)[27101]: debug: "/home/<USER_REDACTED>/.google_authenticator" read
Feb  2 23:09:20 rosie sshd(pam_google_authenticator)[27101]: debug: shared secret in "/home/<USER_REDACTED>/.google_authenticator" processed
Feb  2 23:09:20 rosie sshd(pam_google_authenticator)[27101]: debug: google_authenticator for host "<IP_REDACTED>"
Feb  2 23:09:27 rosie sshd(pam_google_authenticator)[27101]: debug: no scratch code used from "/home/<USER_REDACTED>/.google_authenticator"
Feb  2 23:09:27 rosie sshd(pam_google_authenticator)[27101]: Accepted google_authenticator for <USER_REDACTED>
Feb  2 23:09:27 rosie sshd(pam_google_authenticator)[27101]: debug: google_authenticator for host "<IP_REDACTED>"
Feb  2 23:09:27 rosie sshd(pam_google_authenticator)[27101]: debug: end of google_authenticator for "<USER_REDACTED>". Result: Success

I can't find any obvious logic errors in the code, but tbh, C really ain't my language.

Thanks in advance for any help!

ThomasHabets commented 3 years ago

Could you provide more info about your configuration, such as the exact line you use in PAM config.

roeme commented 3 years ago

Sure, including all preceding lines:

auth [success=1 default=ignore]  pam_exec.so /usr/sbin/mypamcheck.sh
auth [success=ok default=ignore] pam_unix.so nullok_secure
auth  required  pam_google_authenticator.so debug grace_period=28800

mypamcheck verifies wether sshd has sucessfully authenticated the user by public key and if so, lets pam skip password authentication and go to google-authenticator.

ThomasHabets commented 3 years ago

Sorry for the delay on this. As always everyone is super busy. :-)

I think I know what the probleh is. Could you add updated = 1; betwen lines 2093 and 2094 in src/pam_google_authenticator.c, recompile, and try again?

roeme commented 3 years ago

Sorry for the delay on this. As always everyone is super busy. :-)

No, worries, I'm getting free support after all, and it's not critical for me.

I think I know what the probleh is. Could you add updated = 1; betwen lines 2093 and 2094 in src/pam_google_authenticator.c, recompile, and try again?

This did the trick! The file gets updated, and I don't get a verification prompt anymore. Upon manually (for testing) backdating the timestamp outside the grace_period window, I get prompted anew, as expected, and the file is refreshed.

Thanks a bunch for your help! Not sure if you'd like a PR for such a small change?

ThomasHabets commented 3 years ago

Thanks for confirming all of the pass/fail scenarios!