Re: [gentoo-user] One Time Passwords

[Helmut Jarausch]

On 06/24/2015 02:04:57 AM, Rich Freeman wrote:
> On Tue, Jun 23, 2015 at 8:49 AM, Helmut Jarausch <jarausch@××××××.be>
> wrote:
> > Hi,
> >
> > I'd like to log into my Gentoo system from my smartphone.
> > But I don't trust Google (Android's parents).
> > Therefore I need a OTP solution for loggin into my Gentoo system.
> >
> > Can anybody recommend a solution?
> >
>
> You'll laugh at the irony, but my /etc/pam.d/sshd:
> auth       include      system-remote-login
> auth required pam_google_authenticator.so
> account    include      system-remote-login
> password   include      system-remote-login
> session    include      system-remote-login
>
> The Google Authenticator PAM module comes from
> sys-auth/google-authenticator, and accepts OTPs from the Google
> Authenticator app, or any other app that uses the same algorithm
> (which is fairly standard I believe).  It is FOSS, and doesn't give
> Google access to anything.
>
> That one line is all it takes to block anybody not using an OTP from
> logging in.  To actually set the key for an account there is a utility
> that will generate a key and give you the seed for your OTP generator.
> It stores a file in your home directory with the seed, which the PAM
> module reads.
>
> It is very simple to set up, and very effective.  Note that public key
> authentication with sshd normally bypasses PAM and doesn't require the
> code - I don't know offhand if you can have both.
>

Many thanks, Rich.

I wouldn't like to use an OTP generator on my smartphone because Big Brother might
watching me when I use this.
I feel like the German parliament which has been hacked by a foreign secrete service.
Parliamentarians have to resort to "classic" types of communication now.

I'd prefer a solution where I carry the OTPs with me in printed form.
Is this possble with the google-authenticator, as well?