adulau/ootp
1
0
Fork 0
mirror of https://github.com/adulau/ootp.git synced 2024-12-04 16:07:12 +00:00
Code Issues Projects Releases Packages Wiki Activity
ootp/doc/QUICKSTART

803 lines
27 KiB
Text
Raw Permalink Normal View History

ootp-release-1.02 imported
2017-01-03 11:10:10 +00:00
#
ootp-snap-05-15-2011-r184 imported
2017-01-03 11:16:53 +00:00
# $Id: QUICKSTART 114 2010-02-25 18:23:44Z maf $
ootp-release-1.02 imported
2017-01-03 11:10:10 +00:00
#
OpenOTP is an implementation of the HOTP protocol using a ZeitControl
Cardsystems ZC3.9 BasicCard and standalone balance reader, standalone Spyrus
PAR2 (Personal Access Reader), or PCSC-Lite supported Smart Card reader.
Included is a C library implementation of the HOTP protocol and
associated user database management, HOTP PAM library, OpenVPN plug-in module,
micro RADIUS server with HOTP support, and utilties for managing the Smart
Card, Spyrus reader, and host side HOTP user database. The PCSC-Lite
ootp-release-1.03 imported
2017-01-03 11:14:13 +00:00
API provides reader support for Smart Card management.
ootp-release-1.02 imported
2017-01-03 11:10:10 +00:00
The card management, firmware loaders, C API, and authentication methods
have been developed & tested for FreeBSD and Linux.
The PARII HOTP firmware is provided as a pre-compiled binary with source
for the HOTP implementation. The Spyrus development toolkit and
Hi-Tech/Microchip C compiler are required for modification. Run-time
customization of strings is supported via an EEProm loader without need
for the development toolkit & PIC16 compiler. A Unix tool is included for
downloading firmware to the reader with a Spyrus downloader cable.
Source and Binary for the BasicCard firmware is supplied. Modification
requires the Windows BasicCard development software available as
a free download from ZeitControl. A Unix version of bcload implemented
ootp-release-1.03 imported
2017-01-03 11:14:13 +00:00
with the PCSC-Lite interface and embedded ACR30S driver is included.
The Smart Card based token generator is standards based and may be
used with other RFC compliant HOTP implementations. Other HOTP
token generators may be used with the Unix side HOTP library
and authentication modules.
ootp-release-1.02 imported
2017-01-03 11:10:10 +00:00
Distribution:
otp-control - OTP database manager
otp-pam - OTP PAM module
otp-sca - Smart Card Admin Utility
otp-sct - Smart Card Terminal
otp-openvpn - OpenVPN OTP plug-in
urd - Micro RADIUS server with HOTP integration
htsoft-downloader - PIC bootloader downloader utility for Spyrus firmware
bcload - BasicCard firmware loader
basiccard - BasicCard (Smart Card) firmware & source code
spyrus-par2 - Spyrus PAR2 firmware & source code
common - otplib API and other common code
doc - Documentation & Man pages in Unix and HTML format.
scripts - shell scripts to setup list of users with HOTP
Unix and SC databases.
Required:
o ZC3.9 BasicCard Smart cards. 1 Per user. These run about $3.00 (US)
in quantity 10, or about $5.00 in quantity 1.
http://www.basiccard.com
o Smart Card Reader. Recommend a CCID compatible reader as this
driver is well supported under PCSC-Lite. An embedded driver
for the ACR30S (which does not work well with PCSC-Lite) is
also included but it requires a RS232 Serial port and PC keyboard
port for power which is typically not available on newer laptops.
The OMNIKEY CardMan 1021 USB works well on Linux and FreeBSD
and can be found on ebay for ~ $17.00 (US).
o Balance Reader from Zeitcontrol. (Optional). Using a balance reader
to generate HOTP tokens limits the SC to one token and no PIN.
o Spyrus PAR II reader and download cable (Optional). The PAR II
with a ZC3.9 SC will support about 85 keys. These run about $60
in single quantities. One cable for setup, 1 reader per user.
http://www.spyrus.com
Software is available at http://www.splintered.net/sw/otp
#
# Quickstart install for ootp on Mac, FreeBSD, and Linux.
#
#
# PART 1 - Unix side (FreeBSD/Linux)
#
# o Install pcsc-lite & driver packages (optional / recommended).
# o Install developer packages openssl and PAM (if not available).
# o compile and install ootp.
# o create a user with otp-control.
# o configure PAM to use pam_otp.so with sshd.
# o test above configuration using software generated token.
#
# PART 2 hardware token generation
#
# o download OTP firmware to Spyrus PAR II reader with htsoft-downloader
# The Spyrus reader is not required. Tokens can be generated with
# only the SC and PC connected reader.
# o download OTP firmware to BasicCard SC with bcload.
# o copy hosts (hostname & key) to SC with otp-sca.
# o generate token with otp-sct.
# o generate token with Spyrus PAR II.
#
# PART 3 personalize Spyrus PAR II EEPROM
#
# o download Spyrus personalization firmware to BasicCard SC with bcload.
# o create EEPROM image.
# o copy EEPROM image to SC with otp-sca.
# o load EEPROM image into Spyrus reader via SC.
#
#
#
# otp-sct and otp-sca will use pcsc-lite if it installed. pcsc-lite provides
# drivers for many Smart Card readers. A built in driver is included for
# ACR30S based Smart Card readers which only requires a serial port. The
# PL2303 USB to Serial adapter is known to work.
#
#
# Installing pcsc-lite from source for Linux. If using YUM see below for
# the required packages. Your distribution may # have some or all of
# these packages previously installed, make sure to check the versions of
# installed software. The ACR38 driver is only available in source form.
# The CCID driver package for pcsc-lite supports many Smart Card readers
# conforming to the Chip/Smart Card Interface Devices USB standard.
#
wget --no-check-certificate https://alioth.debian.org/frs/download.php/3080/ccid-1.3.11.tar.bz2
wget --no-check-certificate https://alioth.debian.org/frs/download.php/3082/pcsc-lite-1.5.5.tar.bz2
wget 'http://www.acs.com.hk/drivers/eng/ACR38U_driver_Lnx_1710_P.tar.gz'
pcsc-lite:
tar -xf pcsc-lite-1.5.5.tar.bz2
cd pcsc-lite-1.5.5
./configure
make
make install
ccid
tar -xf ccid-1.3.11.tar.bz2
cd ccid-1.3.11/
./configure
examples/scardcontrol.c:
remove FEATURE_IFD_PIN_PROPERTIES code -- did not compile
make
make install
acr38u
tar -xf ACR38U_driver_Lnx_1710_P.tar.gz
cd ACR38_LINUX_100710_P
./configure
make
make install
mkdir -p /usr/local/pcsc
cd /usr/local/pcsc
ln -s /usr/lib/pcsc/drivers .
# run in the foreground
/usr/local/sbin/pcscd -d -f
#
# Using yum on a vanilla Fedore 11 install
#
yum install gcc.i586
yum install openssl
yum install openssl-devel
yum install pcsc-lite
yum install pcsc-lite-devel
yum install ccid
yum install pam-devel
#
# Mac OSX 10.5 has pcsc-lite and the CCID drivers installed by default.
#
install ACR38U MacOSX installer from acs.com.hk
#
##### installing pcsc-lite from source for FreeBSD
#
fetch -o libusb-0.1.12.tar.gz 'http://sourceforge.net/projects/libusb/files/libusb-0.1%20%28LEGACY%29/0.1.12/libusb-0.1.12.tar.gz/download'
patch < /usr/ports/devel/libusb/files/patch-bsd.c
./configure
make > make.out 2>&1
make install > install.out 2>&1
fetch https://alioth.debian.org/frs/download.php/3080/ccid-1.3.11.tar.bz2
fetch https://alioth.debian.org/frs/download.php/3082/pcsc-lite-1.5.5.tar.bz2
*** PCSCD
./configure --enable-libusb --prefix=/usr/local/pcsc LDFLAGS="-lpthread"\
--enable-ipcdir=/var/tmp/ --enable-confdir=/etc\
--enable-usbdropdir=/usr/local/pcsc/lib/drivers/ --disable-libhal
make > make.out 2>&1
make install > install.out 2>&1
ldconfig -m /usr/local/pcsc/lib
*** CCID
./configure --enable-usbdropdir=/usr/local/pcsc/lib/drivers\
--enable-ccidtwindir=/usr/local/pcsc/lib/drivers/serial\
--enable-udev PCSC_CFLAGS="-I/usr/local/pcsc/include/PCSC"\
PCSC_LIBS="-L/usr/local/pcsc/lib/ -lpcsclite"
make > make.out 2>&1
make install > install.out 2>&1
### start PCSCD in debug mode if not running.
# run in the foreground
/usr/local/sbin/pcscd -d -f
#
# The ACR38U drivers must be installed separately. See
# http://www.acs.com.hk/drivers/eng/. Linux is works, FreeBSD driver hangs
# in libusb. Mac driver works
#
##### OTP build
# ootp install dir
mkdir -p /usr/local/ootp/bin
mkdir -p /usr/local/ootp/man/man1
mkdir -p /usr/local/ootp/man/man7
mkdir -p /usr/local/ootp/firmware
mkdir -p /usr/local/ootp/doc
mkdir -p /usr/local/ootp/lib
chmod -R 755 /usr/local/ootp
chown -R root:wheel /usr/local/ootp
OOTP="/usr/local/ootp"
PATH=$PATH:$OOTP/bin
# build Intel Linux, pcsc-lite installed from source
cd otp
cd common; make clean; make i386-linux; cd ..
cd bcload; make clean; make i386-linux; make install cd ..
cd htsoft-downloader; make clean; make i386-linux; make install; cd ..
cd otp-control; make clean; make i386-linux; make install; cd ..
cd otp-pam; make clean; make i386-linux; make install; cd ..
cd otp-sca; make clean; make i386-linux; make install; cd ..
cd otp-sct; make clean; make i386-linux; make install; cd ..
cd otp-openvpn; make clean; make i386-linux; make install; cd ..
cd urd; make clean; make i386-linux; make install; cd ..
cd basiccard; make install; cd ..
cd spyrus-par2; make install; cd ..
cd scripts; make install; cd ..
cd doc; make install; cd ..
# build Intel Linux, pcsc-lite installed with yum
cd otp
cd common; make clean; make i386-yum-linux; cd ..
cd bcload; make clean; make i386-yum-linux; make install; cd ..
cd htsoft-downloader; make clean; make i386-linux; make install; cd ..
cd otp-control; make clean; make i386-linux; make install; cd ..
cd otp-pam; make clean; make i386-linux; make install; cd ..
cd otp-sca; make clean; make i386-yum-linux; make install; cd ..
cd otp-sct; make clean; make i386-yum-linux; make install; cd ..
cd otp-openvpn; make clean; make i386-linux; make install; cd ..
cd urd; make clean; make i386-linux; make install; cd ..
cd basiccard; make install; cd ..
cd spyrus-par2; make install; cd ..
cd scripts; make install; cd ..
cd doc; make install; cd ..
# build Intel FreeBSD
cd otp
cd common; make clean; make i386-fbsd; cd ..
cd bcload; make clean; make i386-fbsd; make install; cd ..
cd htsoft-downloader; make clean; make i386-fbsd; make install; cd ..
cd otp-control; make clean; make i386-fbsd; make install; cd ..
cd otp-pam; make clean; make i386-fbsd; make install; cd ..
cd otp-sca; make clean; make i386-fbsd; make install; cd ..
cd otp-sct; make clean; make i386-fbsd; make install; cd ..
cd otp-openvpn; make clean; make i386-fbsd; make install; cd ..
cd urd; make clean; make i386-fbsd; make install; cd ..
cd basiccard; make install; cd ..
cd spyrus-par2; make install; cd ..
cd scripts; make install; cd ..
cd doc; make install; cd ..
# build Intel MacOSX
cd otp
cd common; make clean; make i386-macosx; cd ..
cd bcload; make clean; make i386-macosx; make install; cd ..
cd otp-control; make clean; make i386-macosx; make install; cd ..
cd otp-pam; make clean; make i386-macosx; make install; cd ..
cd otp-sca; make clean; make i386-macosx; make install; cd ..
cd otp-sct; make clean; make i386-macosx; make install; cd ..
cd otp-openvpn; make clean; make i386-macosx; make install; cd ..
cd urd; make clean; make i386-macosx; make install; cd ..
cd htsoft-downloader; make clean; make i386-macosx; make install; cd ..
cd basiccard; make install; cd ..
cd spyrus-par2; make install; cd ..
cd scripts; make install; cd ..
cd doc; make install; cd ..
# where the OTP database files live by default
mkdir /etc/otpdb
chown root:wheel /etc/otpdb
chmod 700 /etc/otpdb
# install the pam_otp module
# linux
cp $OOTP/lib/pam_otp.so /lib/security
chown root:wheel /lib/security/pam_otp.so
chmod 755 /lib/security/pam_otp.so
# freebsd
cp $OOTP/lib/pam_otp.so /usr/lib
chown root:wheel /usr/lin/pam_otp.so
chmod 755 /usr/lib/pam_otp.so
# if running SELinux:
# http://docs.fedoraproject.org//selinux-faq-fc5/#faq-div-understanding-selinux
#
chcon -t textrel_shlib_t /lib/security/pam_otp.so
semanage fcontext -a -t textrel_shlib_t /lib/security/pam_otp.so
# sshd would also need priviliges to write to /etc/otpdb
#
# to temporarily disable SELinux for testing use
# setenforce 0
ootp-release-1.03 imported
2017-01-03 11:14:13 +00:00
# create the OTP database with one inactive user (joe)
ootp-release-1.02 imported
2017-01-03 11:10:10 +00:00
otp-control -n -u joe -m add
ootp-snap-05-15-2011-r184 imported
2017-01-03 11:16:53 +00:00
otp-control -u joe -m set-status -s inactive
ootp-release-1.02 imported
2017-01-03 11:10:10 +00:00
otp-control -u joe -m list
>Username.......joe
>Key............784F37E95A8410400700DF1E52466AB1704F487B
>Count..........0 (0x0)
>Count Ceiling..18446744073709551615 (0xFFFFFFFFFFFFFFFF)
>Version........1
>Status.........inactive (2)
>Format.........hex40 (1)
>Type...........HOTP (1)
# configure PAM sshd to use new OTP module
/etc/pam.d/sshd:
# change auth lines:
auth requisite pam_unix.so nullok try_first_pass
auth required pam_otp.so expose_account display_count allow_inactive debug
# expose_account enabled verbose logging via syslog:
# OTP username=joe response=0E3F8E7C47
# display_count enables the HOTP count in the challenge prompt
# HOTP Challenge (1843):
# ^^^^ this is the count
# allow_inactive will configure the module to allow a user in the OTP
# database set to status inactive to pass authentication without an OTP.
/etc/ssh/sshd_config:
# PasswordAuthentication must be turned off (default is on)
# (note this is not true for all versions of sshd, see example
# below.
# SSH-2.0-OpenSSH_5.2 - PasswordAuthentication yes
# SSH-2.0-OpenSSH_4.5p1 - PasswordAuthentication no
PasswordAuthentication no
# usePAM to yes (default)
UsePAM yes
# ChallengeResponseAuthentication is required for the pam OTP module
# to interact with sshd
ChallengeResponseAuthentication yes
# Public Key Authentication must also be turned off
RSAAuthentication no
PubkeyAuthentication no
# restart sshd (linux)
/etc/init.d/sshd restart
# restart sshd (FreeBSD)
/etc/rc.d/sshd restart
# example of incorrectly configured system, note after 3 attempts with
# PAM, sshd reverts to internal authentication code allowing the OTP PAM
# module to be bypassed.
#
# with later versions of sshd this is no longer true, ie
# SSH-2.0-OpenSSH_5.2 is okay. The second password prompt will
# also call pam_otp
#
bastion.eng:~% ssh 10.1.0.25 -l 'joe'
Password:
Password:
Password:
joe@10.1.0.25's password:
# generate OTP
otp-control -u joe -m generate
count=5 crsp=48B0D8D8E1
# verify sshd is still working properly
bastion.eng:~% ssh 10.1.0.25
Password:
Last login: Tue Sep 1 23:21:20 2009 from 10.1.0.26
# activate user
ootp-release-1.03 imported
2017-01-03 11:14:13 +00:00
otp-control -u joe -m set-status -s active
ootp-release-1.02 imported
2017-01-03 11:10:10 +00:00
# login with OTP generated earlier
bastion.eng:~% ssh 10.1.0.25
Password:
HOTP Challenge (5): 48B0D8D8E1
Last login: Wed Sep 2 00:22:03 2009 from 10.1.0.26
[joe@localhost ~]$
#### Downloading firmware to the Spyrus reader
ootp-snap-05-15-2011-r184 imported
2017-01-03 11:16:53 +00:00
The Spyrus PAR II will be programmed with the spyrus1.4.hex application
ootp-release-1.02 imported
2017-01-03 11:10:10 +00:00
included in the OTP distribution. This will be done once per new reader,
or when new application software is required. An proprietary RS232 serial
programming cable available from Spyrus is needed.
Connect the programming cable to the Spyrus reader and a serial port on the
computer with htsoft-downloader compiled. A USB Serial adapter based on the
Prolific PL2303 chip has been used during development on Linux and FreeBSD
with the htsoft-downloader. YMMV with other adapters.
Press Calc/Off to turn on the reader. If it does not power up, remove the
paper insulator from the battery or replace the batteries. Press the down
arrow until the "DownloadApp" menu item is present.
Start the htsoft-downloader utility using serial port at /dev/cuaU0 :
# FreeBSD USB Serial Adapter
ootp-snap-05-15-2011-r184 imported
2017-01-03 11:16:53 +00:00
htsoft-downloader -v1 -i -f /dev/cuaU0 < $OOTP/firmware/spyrus1.4.hex
ootp-release-1.02 imported
2017-01-03 11:10:10 +00:00
# Linux USB Serial Adapter
ootp-snap-05-15-2011-r184 imported
2017-01-03 11:16:53 +00:00
htsoft-downloader -v1 -i -f /dev/ttyS0 < $OOTP/firmware/spyrus1.4.hex
ootp-release-1.02 imported
2017-01-03 11:10:10 +00:00
Press Enter on the spyrus reader to start the download application:
Waiting for bootloader......
ootp-release-1.03 imported
2017-01-03 11:14:13 +00:00
DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDwTwF
PIC reset sent, ignored last WOK timeout.
ootp-release-1.02 imported
2017-01-03 11:10:10 +00:00
ootp-release-1.03 imported
2017-01-03 11:14:13 +00:00
Increase the verbosity level for more debugging information if necessary.
The -i option is required for the bootloader provided with the Spyrus reader.
ootp-release-1.02 imported
2017-01-03 11:10:10 +00:00
A Windows PIC downloader which will work with the Spyrus reader is available
at http://www.ehl.cz/pic/pic_e.htm. It will also note an error when trying
to reset the PIC.
Press Card/On. The LCD should display:
OARnet
PIN:
Press Calc/Off to preserve the battery.
##### Downloading firmware to the ZC3.9 BasicCard
The HOTP BasicCard firmware is programmed into the blank ZC3.9 card.
This is typically done only once, the keys and other user information
are configured using otp-sct.
bcload -v -f $OOTP/firmware/HOTPC.IMG
Card/State: ZC3.9 test
EEChunkSize=2000
BCSetState: load
SC: Reset
EEStart=8020,EELen=1fa0
imgAddr=8020,imgLen=1fa0
Clear: addr=8020,len=1fa0
BCClearEEProm: success
SC: Reset
EEWRITE: nWrites=121,addr=8020,len=1e
EEWRITE: nWrites=120,addr=8038,len=10
EEWRITE: nWrites=119,addr=8170,len=38
EEWRITE: nWrites=118,addr=81a0,len=48
...
EEWRITE: nWrites=1,addr=9f40,len=48
EEWRITE: nWrites=0,addr=9f80,len=48
EECRC: nWrites=1,addr=8020,len=1fa0,imgCRC=7a3f
EECRC: SCCRC=7a3f
EECRC: nWrites=0,addr=8020,len=00,imgCRC=00
EECRC: SCCRC=0
BCSetState: test
SC: Reset
##### Downloading firmware to the ZC3.9 BasicCard (Windows Alternative)
Install the Windows BasicCard development toolkit from
http://www.basiccard.com/. This toolkit is a free download and required
for modifying the BasicCard HOTP implementation.
Tools / Download to Real Card
(card debugger starts)
Card / Download to Real Card
Select the COM port - anything other than the reader included with the
development kit will require installing the vendor PC/SC Smart Card
driver first.
Select the HOTPC.IMG file included in OTP distribution.
Click Download to start the card download.
#### Managing the Smart Card with otp-sca
Working from the otp-control example above, user joe has been setup on host
bastion. The Smart Card must have the firmware loaded on it with the above
procedure before otp-sca can be used with it.
List available SC readers. Examples will assume the default compiled in
reader is PCSC: which will select the first available PCSC reader. The default
reader is a compile time option and may be set to the embedded acr30s driver
if PCSC support is not enabled. When using the acr30s driver the serial port
can be configured by appending it to the reader name with a :, ie
embedded:acr30s:/dev/cuaU0
otp-sca -l
embedded:acr30s
PCSC:OmniKey CardMan 1021 00 00
First change the admin key from the default. The admin key is used to enable
administrator mode on the Smart Card to access the GetHost and SetHost
functions. When in admin mode a PIN is not required. Admin mode should be
disabled after initial setup.
Enable admin mode with default key:
echo "3030303030303030303030303030303030303030" > default.key
otp-sca -m admin-enable -a default.key
Create a new admin key with openssl and set the Smart Card to use it:
openssl rand 160 | openssl sha1 > secret.key
otp-sca -a secret.key -m adminkey-set
Dump user joe in an otp-sca friendly format with index 00. Store record
in SC.
otp-control -u joe -m list-sc -Hcrypto | tail -1 | otp-sca -m host-set
Dump the Smart Card to verify programming:
otp-sca -m host-get
#index:count:hostname:key
00:00000000:63727970746F000000000000:784F37E95A8410400700DF1E52466AB1704F487B
The hostname is encoded in HEX. The key matches the one programmed above
into the otpdb used with PAM. Initial count is set to 0.
Dump the available hosts in a friendlier format. The card is still in admin
mode so the PIN does not matter:
otp-sca -m hostname-get
Enter PIN: 99999
00,crypto
Disable admin mode:
otp-sca -m admin-disable -a secret.key
Set PIN for card. The default 28165 PIN can not be used to generate a HOTP:
otp-sca -m pin-set
Enter PIN: 28165
New PIN: 12345
New PIN (again): 12345
SetPIN Good.
Generate a HOTP for user. The initial count is 0. The count above
is 5 (want 6 next). To set the count on the Smart Card dump it to ASCII,
change the count then load it from ASCII. Alternately use the form of GetHOTP
which passes the count in. Note the other GetHOTP commands may be
conditionally compiled out, by default only GetHOTPHostCount32 is enabled
which also returns the hostname.
otp-sca -m hotp-gen -Mch -c5
Enter PIN: 12345
HOTP: 48B0D8D8E1 -- crypto
The HOTP generated here matches the one above for count 5. The count
on the Smart Card will automatically be incremented by one which can be
verified by dumping the card contents:
otp-sca -m admin-enable -a secret.key
AdminMode: enabled.
otp-sca -m host-get
#index:count:hostname:key
00:00000006:63727970746F000000000000:784F37E95A8410400700DF1E52466AB1704F487B
otp-sca -m admin-disable -a secret.key
AdminMode: disabled.
As a precaution admin mode is automatically disabled when a GetHOTP* command is
received.
#### Using a Smart Card with otp-sct
otp-sct duplicates the functionality of the Spyrus PAR II reader with a Smart
Card reader connected to the computer. This significantly reduces the security
of using one time passwords if the computer with the Smart Card inserted is
compromised and the attacker has the SC PIN. The 5 digit PIN is protected
from brute force attacks by the Smart Card disabling the card when more than
10 incorrect PIN's are tried in succession. A middle ground may be available
with newer readers which allow the PIN to be input on the reader.
If your local security policy requires the use of the Spyrus reader, the
reader will provide a 40 bit key to the SC which otp-sct will not. Host
entries on the SC can set the READERKEY flag to prevent HOTP generation
without this shared key between the Spyrus reader and SC.
otp-sct
Enter PIN: 12345
HOTP: crypto 6C960E4B21
#### Using a Smart Card with Spyrus Reader
Insert the SC into the Spyrus Reader.
Press Card/ON. Enter PIN. Default PIN is 28165
Press * to change PIN. The default PIN can not be used to generate a token.
Enter to generate a HOTP for the first system (index 00).
Down arrow to enter the menu. The menu will allow viewing of all hostnames
programmed in the Smart Card with the up/down arrows. Press Enter once the
host is selected.
Enter 2 digit index to bypass the menu.
# before generating a HOTP will prompt for a Count input. This can be used to
synch a card or for Challenge/Response mode with shared keys.
#### Spyrus PAR II Personalization
Strings in the PAR II such as the text "OARnet" or the reader key are
loaded from the onboard PIC16F877 256KByte EEPROM at runtime. The EEPROM
can can be reprogrammed with a SC loaded with SPYRUSP.IMG.
First create a Smart Card with the SPYRUSP.IMG firmware. This will need
to be a different SC from the HOTPC.IMG loaded earlier.
bcload -v -f $OOTP/firmware/SPYRUSP.IMG
Card/State: ZC3.9 test
EEChunkSize=2000
BCSetState: load
SC: Reset
EEStart=8020,EELen=1fa0
imgAddr=8020,imgLen=1fa0
Clear: addr=8020,len=1fa0
BCClearEEProm: success
SC: Reset
EEWRITE: nWrites=10,addr=8020,len=1e
EEWRITE: nWrites=9,addr=8038,len=10
EEWRITE: nWrites=8,addr=8170,len=38
EEWRITE: nWrites=7,addr=81a0,len=48
EEWRITE: nWrites=6,addr=81e0,len=48
EEWRITE: nWrites=5,addr=8220,len=48
EEWRITE: nWrites=4,addr=8260,len=48
EEWRITE: nWrites=3,addr=82a0,len=48
EEWRITE: nWrites=2,addr=82e0,len=48
EEWRITE: nWrites=1,addr=8320,len=11
EEWRITE: nWrites=0,addr=9fbd,len=a
EECRC: nWrites=1,addr=8020,len=1fa0,imgCRC=6ef1
EECRC: SCCRC=6ef1
EECRC: nWrites=0,addr=8020,len=00,imgCRC=00
EECRC: SCCRC=0
BCSetState: test
SC: Reset
# create a copy of the default (OARnet) EEPROM ASCII string file
cd $OOTP/firmware
cp oar.str my.str
vi my.str
Edit the my.str file with a text editor. The character strings
in the second column can be changed. Do not change the number of
characters between the : delimiters or ordering of the symbols as the
memory map is fixed in the Spyrus firmware.
EE_L1MAIN : OARnet :
EE_L2MAIN : Verified :
can be changed to
EE_L1MAIN :Company Name:
EE_L2MAIN : Verified :
but not (extended length of string)
EE_L1MAIN :My Company Name:
EE_L2MAIN : Verified :
or (truncated length of string)
EE_L1MAIN :Company:
EE_L2MAIN : Verified :
Convert the str file to something otp-sca will parse with the str2ee
utility. The format is index:<16 hex bytes>. The high bit of the index
can be set to indicate the last block. The Spyrus reader will stop
after reading an index with the high bit set.
str2ee < my.str > my.ee
# my.hex will look something like:
00:6D616630303030304F41526E65743A32
01:303039202020204F41526E6574202020
02:50494E3A20202020202020202020204F
03:41526E65742020202020566572696669
04:656420204368616C6C656E67653A2020
05:3130204661696C757265732043617264
06:204C6F636B6564202020204163636573
07:7320202020202044656E696564202020
08:20204E6F20486F737473202053657420
09:4E65772050494E204E657750494E3A20
0A:20202020416761696E3A202020202020
0B:50494E204368616E676564204E6F2043
0C:61726420202020205472792048617264
8D:65722020000000000000000000000000
# use otp-sca to program the SC with the above hex file
otp-sca -m spyrus-ee-set < my.ee
SetSpyrusEEBlock (0): Done
SetSpyrusEEBlock (1): Done
SetSpyrusEEBlock (2): Done
SetSpyrusEEBlock (3): Done
SetSpyrusEEBlock (4): Done
SetSpyrusEEBlock (5): Done
SetSpyrusEEBlock (6): Done
SetSpyrusEEBlock (7): Done
SetSpyrusEEBlock (8): Done
SetSpyrusEEBlock (9): Done
SetSpyrusEEBlock (10): Done
SetSpyrusEEBlock (11): Done
SetSpyrusEEBlock (12): Done
SetSpyrusEEBlock (13): Done
# insert the SC into the Spyrus reader. Use the magic PIN sequence 3#
# to reprogram the EEPROM.
#
# READERKEY
#
The Spyrus PAR II reader will send a 40 bit key to the SC when executing
the GetHOTP* functions. This key defaults to "00000". Use the otp-sca
reader-key-set command to change it in a SC. The key is stored on the
Spyrus PAR II EEPROM and can be changed using the personalization
steps above. This check is off by default in the SC. To enable it, set
the high bit of the 2nd character in the hostname.
See also:
ootp-release-1.03 imported
2017-01-03 11:14:13 +00:00
This site http://www.splintered.net/sw/otp
HOTP ID http://www.ietf.org/internet-drafts/draft-mraihi-oath-hmac-otp-02.txt
IETF slides http://www3.ietf.org/proceedings/05mar/slides/saag-2/sld1.htm
SHA-1 http://www.itl.nist.gov/fipspubs/fip180-1.htm
HMAC http://www.faqs.org/rfcs/rfc2104.html
BasicCard http://www.basiccard.com/
Linux PAM http://www.kernel.org/pub/linux/libs/pam/
PAM S-Key http://kreator.esa.fer.hr/projects/tarballs/pam_skey-1.1.3.tar.gz
ootp-release-1.02 imported
2017-01-03 11:10:10 +00:00
(used as a reference PAM module)
ootp-release-1.03 imported
2017-01-03 11:14:13 +00:00
Spyrus http://www.spyrus.com
PCSC-LITE http://pcsclite.alioth.debian.org/
Smart Cards http://www.smartcardfocus.com/
BalanceReader http://www.basiccard.com/chip/balanceR.pdf
ootp-release-1.02 imported
2017-01-03 11:10:10 +00:00
#
# The HOTP database is not encrypted. For added security use an encrypted
# disk partition to store the HOTP database and SC files
#
#
# FreeBSD encrypted USB drive install
#
USB drive is on da0
# create a key file used as part of the key to unlock the disk
dd if=/dev/random of=/root/OarEng1.key bs=64 count=1
# create a eli context for da0, passphrase is the rest of the key
geli init -s 4096 -K /root/OarEng1.key /dev/da0
<passph1rase>
# attach providing a plaintext device da0.eli
geli attach -k /root/OarEng1.key /dev/da0
# erase what was there
dd if=/dev/zero of=/dev/da0.eli bs=4k
# add a disk label
bsdlabel -w /dev/da0.eli
# make a partition whole disk
disklabel -e /dev/da0.eli
# create filesystem
newfs /dev/da0.elia
# create mountpoint
mkdir /priv
# mount it
mount /dev/da0.elia /priv
Reference in a new issue Copy permalink