NAME
otpw-gen - one-time password generator
SYNOPSIS
otpw-gen [ options ]
DESCRIPTION
OTPW is a one-time password authentication system. It can be plugged
into any application that needs to authenticate users interactively.
One-time password authentication is a valuable protection against
password eavesdropping, especially for logins from untrusted terminals.
Before you can use OTPW to log into your system, two preparation steps
are necessary. Firstly, your system administrator has to enable it.
(This is usually done by configuring your login software (e.g., sshd)
to use OTPW via the Pluggable Authentication Module (PAM) configuration
files in /etc/pam.d/.)
Secondly, you need to generate a list of one-time passwords and print
it out. This can be done by calling
otpw-gen | lpr
or something like
otpw-gen -h 70 -s 2 | a2ps -1B -L 70 --borders no
if more control over the layout is desired.
You will be asked for a prefix password, which you need to memorize. It
has to be entered immediately before the one-time password. The prefix
password reduces the risk that anyone who finds or steals your password
printout can use that alone to impersonate you.
Each one-time password will be printed behind a three digit password
number. Such a number will appear in the password prompt when OTPW has
been activated:
Password 026:
When you see this prompt, enter the memorized prefix password, followed
immediately by the one-time password identified by the number. Any
spaces within a password have only been inserted to improve legibility
and do not have to be copied. OTPW will ignore the difference between
the easily confused characters 0O and Il1 in passwords.
In some situations, for example if multiple logins occur simultaneously
for the same user, OTPW defends itself against the possibility of
various attacks by asking for three random passwords simultaneously.
Password 047/192/210:
You then have to enter the prefix password, followed immediately by the
three requested one-time passwords. This fall-back mode is activated by
the existence of the lock file ~/.otpw.lock. If it was left over by
some malfunction, it can safely be deleted manually.
Call otpw-gen again when you have used up about half of the printed
one-time passwords or when you have lost your password sheet. This will
disable all remaining passwords on the previous sheet.
OPTIONS
-h number Specify the total number of lines per page to be sent to
standard output. This number minus four header lines
determines the number of rows of passwords on each page.
The maximum number of passwords that can be printed is
1000. (Minimum: 5, default: 60)
-w number Specify the maximum width of lines to be sent to standard
output. This parameter determines together with the
password length the number of columns in the printed
password matrix. (Minimum: 64, default: 79)
-s number Specify the number of form-feed separated pages to be
sent to standard output. (Default: 1)
-e number Specify the minimum entropy of each one-time password in
bits. The length of each password will be chosen
automatically, such that there are at least two to the
power of the specified number possible passwords. A value
below 30 might make the passwords vulnerable to a brute-
force guessing attack. If the attacke might have read
access to the ~/.otpw file, the value should be at least
48. Paranoid users might prefer long high-security
passwords with at least 60 bits of entropy. (Default:
48)
-p0 Generate passwords by transforming a random bit string
into a sequence of letters and digits, using a form of
base-64 encoding (6 bits per character). (Default)
-p1 Generate passwords by transforming a random bit string
into a sequence of English four-letter words, each chosen
from a fixed list of 2048 words (2.75 bits per
character).
-f filename Specify a file to be used instead of ~/.otpw for storing
the hash values of the generated one-time passwords.
AUTHOR
The OTPW package, which includes the otpw-gen progam, has been
developed by Markus Kuhn. The most recent version is available from
<http://www.cl.cam.ac.uk/~mgk25/otpw.html>.
SEE ALSO
pam(8), pam_otpw(8)
2003-09-30