forked from multiOTP/multiotp
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathreadme_5.1.0.3.txt
1990 lines (1687 loc) · 104 KB
/
readme_5.1.0.3.txt
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
multiOTP open source
====================
multiOTP open source is a GNU LGPL implementation of a strong two-factor authentication PHP class
multiOTP open source is OATH certified for HOTP/TOTP
(c) 2010-2018 SysCo systemes de communication sa
http://www.multiOTP.net/
Current build: 5.1.0.3 (2018-02-19)
Binary download: https://download.multiotp.net/
[](https://www.paypal.com/cgi-bin/webscr?cmd=_donations¤cy_code=USD&[email protected]&item_name=Donation%20for%20multiOTP%20project)
*Please consider supporting this project by making a donation via [PayPal](https://www.paypal.com/cgi-bin/webscr?cmd=_donations¤cy_code=USD&[email protected]&item_name=Donation%20for%20multiOTP%20project)*
Visit http://forum.multiotp.net/ for additional support.
The multiOTP package is the lightest package available that provides so many
strong authentication functionalities and goodies, and best of all, for anyone
that is interested about security issues, it's a fully open source solution!
This package is the result of a *bunch* of work. If you are happy using this
package, [Donation] are always welcome to support this project.
Please check http://www.multiOTP.net/ and you will find the magic button ;-)
If you need some specific features in the open source edition of multiOTP,
please contact us in order to discuss about a sponsorship in order to
prioritize your needs.
You can also have a look on on http://www.multiotp.com for multiOTP Pro and
multiOTP Enterprise, which are commercial editions of ready to use virtual
appliances including more features like:
- Full Web GUI interface
- Automated provisioning of new account (based on Active Directory)
- High Availability master-slave support (Enterprise Edition)
- Web API support (Enterprise Edition)
- free virtual appliances available, including a free lifetime one user licence
- online demo of the full Web GUI interface
- ...
The multiOTP class supports currently the following algorithms and RFC's:
- RFC1994 CHAP (Challenge Handshake Authentication Protocol)
- RFC2433 MS-CHAP (Microsoft PPP CHAP Extensions)
- RFC2487 SMTP Service Extension for Secure SMTP over TLS
- RFC2759 MS-CHAPv2 (Microsoft PPP CHAP Extensions, Version 2)
- RFC2821 SMTP (Simple Mail Transfer Protocol)
- RFC4226 OATH/HOTP (HOTP: An HMAC-Based One-Time Password Algorithm)
- RFC5424 Syslog Protocol (client)
- RFC6030 PSKC (Additional Portable Symmetric Key Container Algorithm Profiles)
- RFC6238 OATH/TOTP (TOTP: Time-Based One-Time Password Algorithm)
- Yubico OTP (http://yubico.com/yubikey)
- mOTP (http://motp.sourceforge.net)
- OATH/HOTP or OATH/TOTP, base32/hex/raw seed, QRcode provisioning
(FreeOTP, Google Authenticator, ...)
- SMS tokens (using aspsms, clickatell, intellisms, or even your own script)
- TAN (emergency scratch passwords)
This package was initially published here : http://syscoal.users.phpclasses.org/package/6373.html
For more PHP classes, have a look on [PHPclasses.org](http://syscoal.users.phpclasses.org/browse/), where a lot of authors are sharing their classes for free.
TABLE OF CONTENTS
=================
* Donations and sponsoring
* Wishlist for future releases
* How can I upgrade from a previous version ?
* What's new in the releases
* Change Log of released version
* Content of the package
* How can I create myself the different versions ?
* When and how can I use this package ?
* What is the prefix PIN option ?
* How the lockout of an account is working ?
* How to debug ?
* How to install the multiOTP web service under Windows ?
* How to install the multiOTP radius server under Windows ?
* Configuring multiOTP with TekRADIUS or TekRADIUS LT under Windows
* How to install the multiOTP web service under Linux ?
* Configuring multiOTP with FreeRADIUS 2.x under Linux
* Configuring multiOTP with FreeRADIUS 3.x under Linux
* How to configure multiOTP to synchronized the users from an Active Directory ?
* How to configure multiOTP to synchronized the users from a standard LDAP ?
* How to configure multiOTP to use the client/server feature ?
* How to build a Raspberry Pi strong authentication server ?
* How to install a local only strong authentication on a Windows machine ?
* How to install a centralized strong authentication server
for strong authentication on Windows desktops or RDP ?
* Compatible clients applications and devices
* External packages used
* multiOTP PHP class documentation
* multiOTP command line tool
DONATIONS AND SPONSORING
========================
You can support our multiOTP open source project with donations and sponsoring.
Sponsorships are crucial for ongoing and future development of the project!
If you'd like to support our work, then consider making a donation, any support
is always welcome even if it's as low as $1!
You can also sponsor the development of a specific feature. Please contact
us in order to discuss the detail of the implementation.
Thanks to our main donators and sponsors:
CSG De Lage Waard (NL)
Donator AB (SE)
Henk van der Helm (NL)
Hermann Wegener GmbH & Co. KG (DE)
SerNet GmbH (DE)
SKB Kontur (RU)
WISHLIST FOR FUTURE RELEASES
============================
- RADIUS challenge/response support
- Multiple hardware tokens support for one account
- Generic web based SMS provider support
- Radius gateway support
- YubiCloud support
- FIDO support (SOAP service)
- Bootstrap/VueJS frontend
- SMS-revolution SMS provider support
- Doxygen documentation format
- Users CSV import
(username;pin;prefix_pin_needed;email;sms;serial_number;manufacturer;algorithm;seed;digits;interval_or_event)
- PostgreSQL support
HOW CAN I UPGRADE FROM A PREVIOUS VERSION ?
===========================================
!!! Be careful when you upgrade your multiOTP open source Virtual Appliance !!!
The multiOTP open source Virtual Appliance is using the files in
raspberry/boot-part/multiotp-tree/usr/local/bin/multiotp, with
config and backend folders defined to be located in /etc/multiotp/
If you are currently using the multiOTP open source Virtual Appliance, you can upgrade
the multiOTP version by copying the extracted content of the folder and subfolders from
raspberry/boot-part/multiotp-tree/usr/local/bin/multiotp to /usr/local/bin/multiotp
An update through the web interface should be available in the future
If you are currently using the multiOTP open source linux files, you can
upgrade your installation by copying the extracted content of the folder and
subfolders from linux to your current multiOTP folder
!!! since 5.0.4.6 under Linux, the config, devices, groups, tokens and users folders are now
always located in /etc/multiotp/. Please be sure to make the move when you are upgrading !!!
If you are currently using the multiOTP open source windows files, you can
upgrade your installation by copying the extracted content of the folder and
subfolders from windows to your current multiOTP folder
WHAT'S NEW IN THE RELEASES
==========================
# What's new in 5.0 releases
- Expired AD/LDAP password support (5.0.6.2)
- multiOTP Credential Provider (for Windows) improvements
([email protected] UPN support, default domain name supported and displayed, SMS request link)
- Better FreeRADIUS 3.x documentation
- New QRCode provisioning format for mOTP (compatible with OTP Authenticator) (5.0.5.2)
- Important, under Linux, the config, devices, groups, tokens and users folders are now always
located in /etc/multiotp/. Please be sure to make the move when you are upgrading (5.0.4.6)
- PostgreSQL support, based on source code provided by Frank van der Aa (5.0.4.5)
- Restore configuration added in Web GUI (5.0.4.5)
- New GetDelayedUsersList() method (5.0.3.6)
- SetUserTokenSeed() and SetTokenSeed() methods accept now also base32 and raw binary (5.0.3.6)
- Multiple groups per user is now supported (not all devices support multiple groups) (5.0.3.4)
- Using AD/LDAP password instead of PIN code can be overwritten or not for all synchronized users
- New windows executable build process, using PHP 7.x (5.0.3.4)
- It's now possible to do several commands at once with the CLI edition (5.0.3.4)
- The default TOTP/HOTP generator for Android/iOS is now FreeOTP Authenticator
- EXE files are now signed in SHA256 (5.0.3.4)
- New LDAP cache management to support huge AD/LDAP, with cache on disk (5.0.3.4)
- New PurgeLockFolder() and PurgeLdapCacheFolder() methods (5.0.3.4)
- If the user dialin IP address is defined, Framed-IP-Address and Framed-IP-Mask
are delivered in the RADIUS answer (5.0.3.0)
- The user dialin IP address is synchronized from the Active Directory msRADIUSFramedIPAddress
attribute (5.0.3.0)
- The first matching group defined in AD/LDAP group(s) filtering is now defined for the user
(this group is returned as the Filter-Id (11) option in a successful RADIUS answer) (5.0.1.0)
- SOAP service available (compatible with OpenOTP SOAP service)
- It's now possible to select a specific LDAP/AD attribute used as the synchronised account name
SetLdapSyncedUserAttribute(), GetLdapSyncedUserAttribute()
- Cached requests supported (cached during a specific amount of time, useful for WebDAV,
device option cache_result_enabled)
- A try on the previous password is rejected, but the error counter is not incremented
- ForceNoDisplayLog() method added, in order to be able to disable log on display in server mode
- YubicoOTP private id check is now implemented
- SSL AD/LDAP also supported with Windows 2012 server
- SyncLdapUsers is now using a semaphore file in order to avoid concurrent process for large AD/LDAP sync
(tested with 1'000 groups, 100'000 users, 1'000 users in the LDAP sync group)
- AD/LDAP additional log information
- Special chars support enhanced in LDAP class (as described in RFC4515)
- The default ldap_group_cn_identifier is now cn instead of sAMAccountName
- Enhanced SMS support for Clickatell, SSL is now also working
- Bug fix concerning QRcode generation for mOTP
- Weekly anonymized stats added (can be disabled)
# What's new in 4.3 releases
- Virtual Appliances are now available (VMware, Hyper-V, generic OVA) (4.3.2.5)
- Raspberry Pi edition has now a special proxy to speed up the command line (4.3.1)
- Generic LDAP support (in addition to Microsoft Active Directory support) (4.3.1)
- New AD/LDAP faster sync algorithm to support larger AD (4.3.0)
- If users are synced using AD/LDAP, it's now possible to use
the AD/LDAP password instead of the PIN code (4.3.0)
- Yubico OTP support, including keys import using the log file in Traditional format (4.3.0)
- Resync during authentication (autoresync) is now better handled in the class directly
- QRCode generation for mOTP (compatible with Token2 App for iOS, Android and Windows Phone)
# What's new in 4.2 releases
- A new option -user-info is now available (4.2.4.1)
- Tokens CSV import (4.2.4.1)
- NT_KEY can be displayed for further handling by FreeRADIUS (4.2.4.1)
- Lot of new QA tests, more than 60 different tests (4.2.4.0)
- Better MySQL support with mysqli library support (4.2.4.0)
- If activated, prefix PIN is now also requested for SMS authentication (4.2.2.0)
- Web GUI is complete for a simple usage (4.2.2.0)
- Some values can now go back to TekRADIUS (4.2.2.0)
- AD/LDAP is now fully supported (4.2.1.0)
- MS-CHAP and MS-CHAPv2 authentication support
# What's new in 4.1 releases
- Syslog support
- Token resync only (without login) doesn't need prefix PIN anymore
- Specific parameters order in QRCode for Microsoft Authenticator support
- The open source edition of multiOTP is also OATH certified for HOTP and TOTP,
which includes encrypted PSKC import support
- Instructions and files to build your own strong authentication server device
on a Raspberry Pi nano-computer
- Self-registration of unattributed hardware tokens
- Automatic resync/unlock during authentication
- Default Linux file mode is now set by default to 0666 to avoid access problem
- Basic web GUI
# What's new in 4.0 releases
- Full client/server support with local cache
- CHAP authentication support
- Emergency scratch passwords list
(providing a list of 10 emergency one-time-usage passwords)
- SMS code sending (with clickatell, aspsms, intellisms and custom exec support)
- integrated Google Authenticator support with integrated base 32 seed handling
- Conversion from hardware HOTP/TOTP tokens to software tokens
- QRcode generation for HOTP/TOTP automatic provisioning
- Integrated QRcode generator library (from Y. Swetake)
- Group attribute per user (sent back through the Radius attribute Filter-Id)
- A lot of new options, also available in command line
- Options are stored in an external configuration file (or in the database)
- Full MySQL support, including tables creation
- Fully automatic build chain (invisible for you, but very nice for me)
- (Parts of the) comments have been reformatted and enhanced,
but still some work to do.
# What's new in 3.9 releases
- Support for account with multiple users
- Some bug fixes
# What's new in 3.2 releases
- Google Authenticator support. Special information to handle the base 32 seed.
- Better MySQL backend integration. Now it is possible to store all
information in a MySQL backend instead of flat files.
CHANGE LOG OF RELEASED VERSIONS
===============================
```
2018-02-19 5.1.0.3 SysCo/al Expired AD/LDAP password support
multiOTP Credential Provider (for Windows) improvements
([email protected] UPN support, default domain name supported and displayed, SMS request link)
"force_no_prefix_pin" option for devices (for example if the device is a
computer with multiOTP credential Provider and AD/LDAP synced password)
Better unicode handling, multibyte fonctions used when needed (mb_strtolower(), ...)
2017-11-04 5.0.5.6 SysCo/al Better FreeRADIUS 3.x documentation
New radius tag prefix configuration option
New multiple groups device option
Some notice corrections (if the array element doesn't exist)
A user cannot be created with a leading backslash (fixed in FastCreateUser and CreateUserFromToken)
2017-09-29 5.0.5.2 SysCo/al The proposed mOTP generator for Android/iOS is now OTP Authenticator
New QRCode provisioning format for mOTP (compatible with OTP Authenticator)
2017-09-08 5.0.5.0 SysCo/al NirSoft nircmd.exe tool removed from the distribution (false virus detection)
Multiple URLs separator for client/server config is still ";", but [space] and "," are accepted
New developer mode for some specific detailed logs during development process only
2017-07-07 5.0.4.9 SysCo/al New methods: SetLdapTlsReqcert, GetLdapTlsReqcert, SetLdapTlsCipherSuite, GetLdapTlsCipherSuite
to change config parameters, instead of hard coded parameters (for SSL/TLS LDAP connection)
Fixed too much detailed information in the log when trying
to detect a token serial number for self-registration
2017-06-06 5.0.4.8 SysCo/al Fixed SSL/TLS LDAP failed connection for PHP 7.x (GnuTLS TLS1.2 restriction removed for PHP 7.x)
2017-06-02 5.0.4.6 SysCo/al Fixed a typo in the ReadCacheData method for PostgreSQL support (thanks Frank for the feedback)
Fixed default folder detection for the multiotp.exe file
Important, under Linux, the config, devices, groups, tokens and users folders are now always
located in /etc/multiotp/. Please be sure to make the move when you are upgrading
Cleaned some ugly PHP warnings when the backend is not initialized
2017-05-29 5.0.4.5 SysCo/al Restore configuration added in Web GUI
Fixed configuration file directory under Windows in Web GUI
Fixed path with spaces handling for the command line edition (thanks Scott for the feedback)
PostgreSQL support, based on source code provided by Frank van der Aa
2017-05-16 5.0.4.4 SysCo/al GetList() is now sorted with files backend
A replay during a defined delay (default 60 seconds) of the previous refused password is rejected,
but the error counter is not incremented (SetLastFailedWhiteDelay and GetLastFailedWhiteDelay)
A user cannot be created with a leading backslash
2017-02-23 5.0.3.7 SysCo/al Group names are now always trimed to avoid blank spaces
SetLinuxFolderMode() and GetLinuxFolderMode() methods added
2017-02-21 5.0.3.6 SysCo/al GetDelayedUsersList() method added
GetList() return now a sorted list
RestoreConfiguration() method updated, system configuration data can be ignored
SetUserTokenSeed() and SetTokenSeed() methods accept now also base32 and raw binary
The full windows package has been fixed and cleaned
2017-02-03 5.0.3.5 SysCo/al GetUserInfo method added
ImportTokensFromCsv fixed when the file is not readable
Fix possible endless loop when opening a file that exists but without the right to read it
2017-01-26 5.0.3.4 SysCo/al It's now possible to do several commands at once with the CLI edition
New overwrite_request_ldap_pwd option (enabled by default).
If overwrite is enabled, default_request_ldap_pwd value is forced during synchronization
Multiple groups per user is now supported (not all devices support multiple groups).
(radius reply attributor has been changed to += by default)
multiotp -delete-token command has been added in the CLI
-lock and -unlock command return now 19 (instead of 99) in the CLI
Better support of DialinIp functions in command line usage
New LDAP cache management to support huge AD/LDAP, with cache on disk (system temporary folder)
New PurgeLockFolder() and PurgeLdapCacheFolder() method
The default proposed TOTP/HOTP generator for Android/iOS is now FreeOTP Authenticator
Better Eastern European languages support
Multiple purpose tokens provisioning format PSKCV10,
like Gemalto e3050cL and t1050 tokens, is now supported.
Various bug fixes and enhancements when using the proxy mode.
2016-11-14 5.0.3.0 SysCo/al Log messages are better categorized
The user dialin IP address is synchronized from the
Active Directory msRADIUSFramedIPAddress attribute
New IP dialin methods : SetUserDialinIpAddress(), SetUserDialinIpMask(),
SetDefaultDialinIpMask(), GetUserDialinIpAddress(), GetUserDialinIpMask(),
GetDefaultDialinIpMask()
If the user dialin IP address is defined, Framed-IP-Address
and Framed-IP-Mask are delivered in the RADIUS answer
Enhanced token importation process (to support binary encryption key
in hexadecimal 0xAABBCC format)
2016-11-04 5.0.2.6 SysCo/al Better log message for automatically or manually created objects
External packages update
New GetUserLastLogin() and SetUserLastLogin() methods
Backup configuration file can now be restored in commercial
version without any changes
2016-10-16 5.0.2.5 SysCo/al Better SSL support using context if available (for PHP >= 5.3)
New methods SetTouchFolder(), GetTouchFolder(), TouchFolder(),
FolderTouched() to offer asynchronous implementation capabilities
New methods added for SOAP service
Weekly anonymized stats added (can be disabled).
Anonymized stats include the following information:
backend type, AD/LDAP used or not, OS version, PHP version,
library version, number of accounts defined, number of tokens defined.
They are sent on the stats.multiotp.net FQDN which is hosted in Switzerland.
It's possible to select a specific LDAP/AD attribute used as the synchronised
account name: SetLdapSyncedUserAttribute(), GetLdapSyncedUserAttribute()
An account can be tested from the dashboard
Unified configuration backup and restore format (BackupConfiguration)
Better support of MS-CHAPv2 in the provided appliances
Cached requests supported (cached during a specific amount of time,
useful for WebDAV authentication) (device option cache_result_enabled)
A try on the previous password is rejected,
but the error counter is not incremented
ForceNoDisplayLog() method added to disable log on display in server mode
XML parsing error are more verbose
XmlServer is now sending XML response with the specific Content-type: text/xml
YubicoOTP private id check is now implemented
SSL AD/LDAP also supported with Windows 2012 server
SyncLdapUsers is now using a semaphore file to avoid
concurrent process for large AD/LDAP sync
(tested with 1'000 groups, 100'000 users, 1'000 users in the LDAP sync group)
AD/LDAP additional log information
New GetNetworkInfo and SetNetworkInfo methods
Special chars support enhanced in LDAP class (as described in RFC4515)
The default ldap_group_cn_identifier is now cn instead of sAMAccountName
The first matching group defined in AD/LDAP group(s) filtering is now
defined for the user (this group is returned as the Filter-Id (11) option
in a successful RADIUS answer)
Enhanced SMS support for Clickatell, SSL is now also working
Bug fix concerning QRcode generation for mOTP
Code fixes
New AssignTokenToUser() and RemoveTokenFromUser() methods
2015-07-18 4.3.2.6 SysCo/al New ResetTempUserArray method (as we want to move away from global array in the near future)
For _user_data, default values are now extracted from the definition array
QRcode generation for mOTP (motp://[SITENAME]:[USERNAME]?secret=[SECRET-KEY])
2015-07-15 4.3.2.5 SysCo/al Calling multiotp CLI without parameter returns now error code 30 (instead of 19)
2015-06-24 4.3.2.4 SysCo/al multi_account automatic support
Scratch password generation (UTF)
2015-06-10 4.3.2.3 SysCo/al Enhancements for the Dev(Talks): demo
2015-06-09 4.3.2.2 SysCo/al Empty users are refused
TOTP time interval of imported tokens is set by default to 30s
More accuracy in the logged information
Refactoring backend methods, sharing code
Refactoring some ugly parts (!)
Documentation update concerning lockout functions and prefix PIN prefix
Special token entry 'Sms' is now also accepted, like 'SMS' or 'sms', to send an SMS token
The minus (-) in the prefix password is now supported (it was filtered to fix some rare user issues)
The autoresync option is now enabled by default
Resync during authentication (autoresync) is now better handled in the class directly
The server_cache_level is now set to 1 by default (instead of 0)
If the token length is not correct, it's now written in the log
Some LDAP messages are now only logged in debug mode
2014-12-15 4.3.1.1 SysCo/al Better generic LDAP support
- description sync done in the following order: description, gecos, displayName
- memberOf is not always implemented, alternative method to sync users based on group names.
- disabled account synchronization using shadowExpire or sambaAcctFlags
Better Active Directory support
- accountExpires is now supported for synchronization
- ms-DS-User-Account-Control-Computed (to handle locked out accounts, available since Windows 2003)
2014-12-09 4.3.1.0 SysCo/al MULTIOTP_PATH environment variable support
CLI proxy added to speed up the command line
Scratch password need also the prefix PIN if it's activated
OTP with integrated serial numbers better supported (in PAP)
Generic LDAP support (instead of Microsoft AD support only)
Raspberry Pi edition has now a special proxy to speed up the command line
2014-11-04 4.3.0.0 SysCo/al It's now possible to use the AD/LDAP password instead of the PIN code
Yubico OTP support, including keys import using the log file in Traditional format
qrcode() stub enhanced to check if the required folders are available
SyncLdapUsers completely redesigned
- no more complete array in memory
- MultiotpAdLdap class also enhanced accordingly
- cached group_cn requests
- cached recursive_groups requests
- new "by element" functions
Demo mode support
Bug fix concerning the NT_KEY generation with enabled prefix PIN (thanks Adam)
ResyncToken() method added (instead of using CheckToken() method for synchronization)
2014-06-12 4.2.4.3 SysCo/al Bug fix concerning aspsms provider
2014-04-13 4.2.4.2 SysCo/al XML parsing consolidation, one library for the whole project
Fixed bug concerning tokens CSV import
2014-04-06 4.2.4.1 SysCo/al Fixed bug concerning LDAP handling
NT_KEY support added (for FreeRADIUS further handling)
Tokens CSV import (serial_number;manufacturer;algorithm;seed;digits;interval_or_event)
When a user is deleted, the token(s) attributed to this user is/are unassigned
New option -user-info added
2014-03-30 4.2.4 SysCo/al Fixed bug concerning MySQL handling and mysqli support added
Enhanced SetAttributesToEncrypt function
New implementation fo some external classes
Generated QRcode are better
LOT of new QA tests, more than 60 different tests (including PHP class and command line versions)
Enhanced documentation
2014-03-13 4.2.3 SysCo/al Fixed bug for clear text password going back to TekRADIUS (PIN was always prefixed for mOTP)
Fixed bug when client/server mode is activated, but not working well
2014-03-03 4.2.2 SysCo/al Better AD/LDAP integration
Web GUI is now complete for a simple usage, including hardware tokens import
Better template for provisioning information
Some values can now go back to TekRADIUS
If activated, prefix PIN is now also requested for SMS authentication
More information in the logs
Better list of the external packages used
2014-02-14 4.2.1 SysCo/al AD/LDAP is now fully supported in order to create users based on AD/LDAP content
(with groups filtering)
2014-02-07 4.2.0 SysCo/al MS-CHAP and MS-CHAPv2 are now supported
(md4 implementation added for PHP backward compatibility)
Enhanced LDAP configuration structure
Fixed bug during token attribution to users
(a "no name" token appeared sometimes)
2014-01-20 4.1.1 SysCo/al md5.js was missing in the public distribution
Alternate json_encode function is defined if the JSON extension is not loaded
Fixed possible image functions incompatibilities with some PHP versions
during QRcode generation
As suggested by Sylvain, token resync doesn't need prefix PIN anymore
(but still accepted)
More verbosity in the logs in debug mode
Specific parameters order in QRCode for Microsoft Authenticator support
(thanks to Erik Nylund)
2013-12-23 4.1.0 SysCo/al The open source edition of multiOTP is OATH certified ;-)
(that means full compatibility with any OATH tokens and encrypted PSKC import support)
Raspberry Pi nanocomputer is now fully supported
Basic web interface
Self-registration of hardware tokens is now possible
PAP mode: if self-registration is enabled, a user can register a non-attributed token by typing
[serial number][OTP] instead of [OTP]. If user has a prefix PIN, type [serial number][PIN][OTP])
PAP/CHAP mode: if self-registration is enabled, a user can register a non-attributed token by typing
[username:serialnumber] as the username and the [OTP] in the password field.
If user has a prefix PIN, [PIN][OTP] must be typed in the password field
Automatic resync/unlock option during authentication (PAP only). When the autoresync option
is enabled, any user can resync his token by typing [OTP1] [OTP2] in the password field.
If user has a prefix PIN, he must type [PIN][OTP1] [PIN][OTP2].
Tokens with less than 3 characters are not accepted anymore in CheckToken()
Default Linux file mode is now set by default (0666 for created and changed files)
Error 28 is returned if the file is not writable, even after a successful login
Added GetUsersCount() function
Added GenerateSmsToken() function
Added Groups management functions
Added Tokens assignation functions
Added SetUserActivated(1|0) and GetUserActivated() function
Added SetUserSynchronized(1|0) and GetUserSynchronized() function
scratch_passwords is now a text field in the database
The third parameter of the Decrypt method is now mandatory
Some modifications in order to correctly handle the class methods
2013-09-22 4.0.9 SysCo/al Fixed a bug in GetUserScratchPasswordsArray. If a user had no scratch password
and the implementation accepted blank password, it was accepted
Fixed a bug where scratch passwords generation used odd numbers of characters for hex2bin()
2013-08-30 4.0.7 SysCo/al GetScriptFolder() was still buggy sometimes, thanks Frank for the feedback
File mode of the created QRcode file is also changed based on GetLinuxFileMode()
'sms' as the password to request an SMS token can now be sent in lower or uppercase
Added a description attribute for the tokens
2013-08-25 4.0.6 SysCo/al base32_encode() is now RFC compliant with uppercases
GetUserTokenQrCode() and GetTokenQrCode() where buggy
GetScriptFolder() use now __FILE__ if the full path is included
When doing a check in the CLI header, @... is automatically removed from the
username if the user doesn't exist, and the check is done on the clean name
Added a lot of tests to enhance release quality
2013-08-21 4.0.5 SysCo/al Fixed the check of the cache lifetime
Added a temporary server blacklist during the same instances
Default server timeout is now set to 1 second
2013-08-20 4.0.4 SysCo/al Added an optional group attribute for the user
(which will be send with the Radius Filter-Id option)
Added scratch passwords generation (if the token is lost)
Automatic database schema upgrade using method UpgradeSchemaIfNeeded()
Added client/server support with local cache
Added CHAP authentication support (PAP is of course still supported)
The encryption key is now a parameter of the class constructor
The method SetEncryptionKey('MyPersonalEncryptionKey') is DEPRECATED
The method DefineMySqlConnection is DEPRECATED
Full MySQL support, including tables creation (see example and SetSqlXXXX methods)
Added email, sms and seed_password to users attributes
Added sms support (aspsms, clickatell, intellisms, exec)
Added prefix support for debug mode (in order to send Reply-Message := to Radius)
Added a lot of new methods to handle easier the users and the tokens
General speedup by using available native functions for hash_hmac and others
Default max_time_window has been lowered to 600 seconds (thanks Stefan for suggestion)
Integrated Google Authenticator support with integrated base 32 seed handling
Integrated QRcode generator library (from Y. Swetake)
General options in an external configuration file
Comments have been reformatted and enhanced for automatic documentation
Development process enhanced, source code reorganized, external contributions are
added automatically at the end of the library after an internal build release
2011-10-25 3.9.2 SysCo/al Some quick fixes after intensive check
Improved get_script_dir() in CLI for Linux/Windows compatibility
2011-09-15 3.9.1 SysCo/al Some quick fixes concerning multiple users
2011-09-13 3.9.0 SysCo/al Added support for account with multiple users
2011-07-06 3.2.0 SysCo/al Encryption hash handling with additional error message 33
(if the key has changed)
Added more examples
Added generic user with multiple account
(Real account name is combined: "user" and "account password")
Added log options, now default doesn't log token value anymore
Debugging MySQL backend support for the token handling
Fixed automatic detection of \ or / for script path detection
2010-12-19 3.1.1 SysCo/al Better MySQL backend support, including in CLI version
2010-09-15 3.1.0 SysCo/al Removed bad extra spaces in the multiotp.php file for Linux
MySQL backend support
2010-09-02 3.0.0 SysCo/al Added tokens handling support
including importing XML tokens definition file
(http://tools.ietf.org/html/draft-hoyer-keyprov-pskc-algorithm-profiles-00)
Enhanced flat database file format (multiotp is still compatible with old versions)
Internal method SetDataReadFlag renamed to SetUserDataReadFlag
Internal method GetDataReadFlag renamed to GetUserDataReadFlag
2010-08-21 2.0.4 SysCo/al Enhancement in order to use an alternate php "compiler" for Windows command line
Documentation enhancement
2010-08-18 2.0.3 SysCo/al Minor notice fix
2010-07-21 2.0.2 SysCo/al Fix to create correctly the folders "users" and "log" if needed
2010-07-19 2.0.1 SysCo/al Foreach was not working well in PHP4, replaced at some places
2010-07-19 2.0.0 SysCo/al New design using a class, mOTP support, cleaning of the code
2010-06-15 1.1.5 SysCo/al Added OATH/TOTP support
2010-06-15 1.1.4 SysCo/al Project renamed to multiotp to avoid overlapping
2010-06-08 1.1.3 SysCo/al Typo in script folder detection
2010-06-08 1.1.2 SysCo/al Typo in variable name
2010-06-08 1.1.1 SysCo/al Status bar during resynchronization
2010-06-08 1.1.0 SysCo/al Fix in the example, distribution not compressed
2010-06-07 1.0.0 SysCo/al Initial implementation
```
CONTENT OF THE PACKAGE
======================
In the credential-provider:
- the installer of multiOTP Credential Provider for Windows 7/8/8.1/10/2012(R2)
In the linux folder:
- multiotp.php : command line tool (merge of the header and the class, external files also included)
- multiotp.class.php : the main file, it is the class itself, external files are already included
- multiotp.server.php : the web service file (the class is already merged in the file, external files also included)
- check.multiotp.class.php : PHP script to validate some multiOTP functionalities
- md5.js : encryption JS library used by multiotp.server.php
- test-tokens.csv : provisioning file of test tokens
+ oath subfolder : contains provisioning files for oath test tokens
+ qrcode subfolder : all necessary files to be able to generate QRcode
+ templates folder : all templates files needed to generate the provisioning pages from the web GUI
```
*******************************************************************************
*** FOR THESE PHP FILES, THE BACKEND IS FILE BASED AND THE CONFIG AND ***
*** BACKEND FOLDERS ARE RELATIVE AND JUST BELOW THE MAIN MULTIOTP FOLDER ***
*******************************************************************************
```
In the raspberry folder:
- all necessary files to be able to create your own strong authentication device using a Raspberry Pi
```
*******************************************************************************
*** FOR THESE PHP FILES, THE BACKEND IS SET BY DEFAULT AS FILE BASED AND ***
*** THE CONFIG AND BACKEND FOLDERS DEFINED TO BE LOCATED IN /etc/multiotp/ ***
*** FURTHERMORE, THIS VERSION USES THE ADVANCED WEB PROXY IMPLEMENTATION ***
*******************************************************************************
*** !!! Be careful when you update your open source virtual appliance !!! ***
*** The multiOTP open source Virtual Appliance is also using the ***
*** files in raspberry/boot-part/multiotp-tree/usr/local/bin/multiotp, ***
*** with config and backend folders defined to be located in /etc/multiotp/ ***
*******************************************************************************
```
In the sources folder:
- multiotp.class.php : the main file, it is the class itself, which requires external files
- multiotp.cli.header.php : header file to be merged with the class for a single file command line tool
- multiotp.server.php : the web service file, which requires the class as external file
- check.multiotp.class.php : PHP script to validate some multiOTP functionalities
+ contrib subfolder : contains all external files required by the multiotp.class.php file
```
*******************************************************************************
*** FOR THESE PHP FILES, THE BACKEND IS FILE BASED AND THE CONFIG AND ***
*** BACKEND FOLDERS ARE RELATIVE AND JUST BELOW THE MAIN MULTIOTP FOLDER ***
*******************************************************************************
```
In the windows folder:
- multiotp.exe : command line tool for Windows (digitally signed) with embedded PHP 7.x
- multiotp.class.php : the main file, it is the class itself, external files are already included
- multiotp.server.php : the web service file (the class is already merged in the file, external files also included)
- check.multiotp.class.php : PHP script to validate some multiOTP functionalities
- md5.js : encryption JS library used by multiotp.server.php
- checkmultiotp.cmd : Windows script to validate some multiOTP functionalities
- radius_debug.cmd : Windows script to run the multiOTP radius web server in debug mode
- radius_install.cmd : Windows script to install and start the multiOTP radius web server
- radius_uninstall.cmd : Windows script to stop and uninstall the multiOTP radius web server
- webservice_install.cmd : Windows script to install and start the multiOTP web service
- webservice_uninstall.cmd : Windows script to stop and uninstall the multiOTP web service
- test-tokens.csv : provisioning file of test tokens
+ legacy subfolder : contains a windows command line version with all needed files
(not embedded in a mini VM). This version is used by the multiOTP web service.
+ oath subfolder : contains provisioning files for oath test tokens
+ qrcode subfolder : all necessary files to be able to generate QRcode
+ radius subfolder : all necessary files to be able to install a Windows radius server already
configured with multiOTP support (using FreeRADIUS implementation for Windows)
+ templates subfolder : all templates files needed to generate the provisioning pages from the web GUI
+ tools subfolder : command line tools needed by some cmd scripts
+ webservice subfolder : all necessary files to be able to install a Windows multiOTP web service
(using Nginx as the light web server on port 8112,
or as a secured SSL connection (https) on port 8113)
```
*******************************************************************************
*** FOR THESE PHP FILES, THE BACKEND IS FILE BASED AND THE CONFIG AND ***
*** BACKEND FOLDERS ARE RELATIVE AND JUST BELOW THE MAIN MULTIOTP FOLDER ***
*******************************************************************************
```
HOW CAN I CREATE MYSELF THE DIFFERENT VERSIONS ?
================================================
The multiotp.php file is a copy of the multiotp.cli.header.php including
the copy of all files that are included in the PHP code, which are
multiotp.class.php and the whole contrib subfolder content.
For the Raspberry Pi edition, the multiotp.php file is the copy of the
multiotp.cli.proxy.php file.
(the proxy version calls the multiotp.proxy.php using the web server,
and the web server has a PHP cache to improve the speed of the whole process).
Furthermore, the following line in the multiotp.class.php:
```
$multiotp = new Multiotp('DefaultCliEncryptionKey', $initialize_backend, $folder_path);
```
is replaced by:
```
$multiotp = new Multiotp('DefaultCliEncryptionKey', $initialize_backend, $folder_path);
if (false !== strpos(getcwd(), '/')) {
$multiotp->SetConfigFolder('/etc/multiotp/config/');
$multiotp->SetCacheFolder('/tmp/cache/');
$multiotp->SetDevicesFolder('/etc/multiotp/devices/');
$multiotp->SetGroupsFolder('/etc/multiotp/groups/');
$multiotp->SetTokensFolder('/etc/multiotp/tokens/');
$multiotp->SetUsersFolder('/etc/multiotp/users/');
$multiotp->SetLogFolder('/var/log/multiotp/');
$multiotp->ReadConfigData();
}
$multiotp->SetLinuxFileMode('0666');
```
For the Raspberry Pi edition, the multiotp.proxy.php file is a copy of the
multiotp.cli.header.php including the copy of all files that are included in
the PHP code, which are multiotp.class.php and the whole contrib subfolder content.
Furthermore, the following line in the multiotp.class.php:
```
$multiotp = new Multiotp('DefaultCliEncryptionKey', $initialize_backend, $folder_path);
```
is replaced by:
```
$multiotp = new Multiotp('DefaultCliEncryptionKey', $initialize_backend, $folder_path);
if (false !== strpos(getcwd(), '/')) {
$multiotp->SetConfigFolder('/etc/multiotp/config/');
$multiotp->SetCacheFolder('/tmp/cache/');
$multiotp->SetDevicesFolder('/etc/multiotp/devices/');
$multiotp->SetGroupsFolder('/etc/multiotp/groups/');
$multiotp->SetTokensFolder('/etc/multiotp/tokens/');
$multiotp->SetUsersFolder('/etc/multiotp/users/');
$multiotp->SetLogFolder('/var/log/multiotp/');
$multiotp->ReadConfigData();
}
$multiotp->SetLinuxFileMode('0666');
```
The multiotp.exe is created using the free Enigma Virtual Box 8.00.
It includes a whole PHP distribution and all the necessary multiOTP files.
Enigma Virtual Box download : http://enigmaprotector.com/en/downloads.html
PHP download : http://php.net/downloads.php
The source files of the Credential provider are available on GitHub and needs
the free Visual Studio Community to be compiled.
Source files : https://github.com/multiOTP/multiOTPCredentialProvider
Visual Studio Community : https://www.visualstudio.com/vs/community/
WHEN AND HOW CAN I USE THIS PACKAGE ?
=====================================
If you decide to have strong two factor authentication inside your company,
this is definitely the package you need! You will be able to have strong
authentication for your VPN accesses, your SSL gateway, your private websites
and even your Windows login for desktops AND laptops!
The multiOTP class can be used alone (for example to have strong
authentication for your PHP based web application), as a command line tool
(to handle users and have strong authentication using command line), as a web
service (to provide centralized authentication for a client/server installation)
or finally coupled with a radius server like TekRADIUS or FreeRADIUS to be able
to have a strong two factor authentication through the RADIUS protocol for
external devices like for example firewalls or captive portals.
The default backend storage is done in flat files, but you can also defined a
MySQL server as the backend server. To use MySQL, you will only have to provide
the server, the username, the password and the database name. Tables will be
created/updated automatically by multiOTP. The schema is also upgraded
automatically if you install a new release of multiOTP.
Starting with version 4.x, you can also install a multiOTP web service
on a server, and this way some other multiOTP slave clients (like laptops)
can connect to the web service and caching the tokens information (if allowed).
Inside a company, you will probably use multiOTP with a radius server or as
a web service (see below on how to install these services).
If you are running under Windows, TekRADIUS or TekRADIUS LT will do the job
(http:/www.tekradius.com/).
The difference is that TekRADIUS needs an MS-SQL SERVER (or MS-SQL Express)
and TekRADIUS LT uses only an embedded SQLite database.
multiOTP is working fine under Windows with WinRADIUS, a port of FreeRADIUS
(http://winradius.eu/)
multiOTP is also working fine with another port of FreeRADIUS
for Windows (http://sourceforge.net/projects/freeradius/)
If you are running under Linux, FreeRADIUS will do the job.
(http://freeradius.org/)
Now, you can register your different devices like firewalls, SSL, etc.
in the radius server and provide the IP address(es) of the device(s)
(often called NAS) and their shared Secret.
If you want to have strong authentication on Windows logon, have a look at the
open source multiOTPCredentialProvider which is based on MultiotpCPV2RDP from
arcadejust and MultiOneTimePassword Credential Provider from Last Squirrel IT.
It works with Windows 7/8/8.1/10/2012(R2) in both 32 and 64 bits.
The Credential Provider does not need any RADIUS connection! It uses instead a
local version of multiOTP which can be configured as a client of a
centralized server (with caching support).
(http://download.multiotp.net/credential-provider/)
LSE Experts provides a commercial Radius Credential Provider which can talk
directly with a radius server.
(http://www.lsexperts.de)
When the backend is set, it's time to create/define the tokens. You will have
to select hardware or software token generators for your users. Currently, the
library supports mOTP, TOTP, HOTP, SMS or scratch passwords (printed on paper).
mOTP is a free implementation of strong tokens that asks a PIN to generate a
code. This code depends of the time and the PIN typed by the user.
The easiest tokens to use are TOTP, they are time based and well supported by
a lot of implementations like Google Authenticator.
Provisioning will be done simply by flashing a QRcode.
# Software tokens with mOTP (Mobile-OTP) support
- Swiss SafeLab OTP authenticator (iOS and Android)
- iPhone: iOTP from PDTS (type iOTP in the Apple AppStore)
- Android: Mobile-OTP (http://motp.sf.net/Mobile-OTP.apk)
- PalmOS: Mobile-OTP (http://motp.sf.net/mobileotp_palm.zip)
- Java J2ME (Nokia and other Java capable phones): MobileOTP
(http://motp.sf.net/MobileOTP.jad)
- WinPhone: Token2 (https://token2.com/?content=mobileapp)
# Software tokens with OATH compliant HOTP or TOTP support
Check the various markets of your devices, for examples:
- FreeOTP (open source): https://freeotp.github.io/
- oathtoken for iPhone/iPad: https://github.com/archiecobbs/oathtoken
- androidtoken for Android: https://github.com/markmcavoy/androidtoken
- Google Authenticator (Android/iPhone/iPad/BlackBerry)
# Hardware tokens
- Any tokens that are OATH certified
- Feitian provides OATH compliant HOTP and TOTP tokens
(seed is provided in a standardized token definition PSKC xml file)
- OTP c100: OATH/HOTP, 6 digits
- OTP c200: OATH/TOTP, 6 digits, 60 seconds time interval
(seed is provided in a standardized token definition PSKC xml file)
- Gemalto provides OATH compliant HOTP and TOTP tokens
- Gemalto Ezio Token
- Seamoon provides OATH compliant TOTP tokens
- Seamoon KingKey: OATH/TOTP, 6 digits, 60 seconds time interval
(seed is provided in a specific smd file)
- ZyXEL OTP provides HOTP OATH compliant tokens (v2 and old v1 tokens)
- ZyWALL OTPv2 (rebranded SafeNet/Aladdin eToken PASS) : OATH/HOTP, 6 digits
(seed is extracted from the importAlpine.dat downloaded file,
the seed is the sccKey attribute)
- ZyWALL OTPv1 (rebranded Authenex A-Key 3600): OATH/HOTP, 6 digits
(seed is extracted from the OTP_data01_upgrade.sql SQL file,
SEED field at the end of the file)
- YubiKeys from Yubico (both in Yubico OTP or in OATH-HOTP format)
- YubiKey standard
- YubiKey Nano
- YubiKey Neo
- YubiKey Neo-N
If you want to use software tokens with Apps like Google Authenticator, you can
create a QRcode provisioning in two EASY steps with the command line tool:
- create the token for the user (without prefix PIN request):
multiotp -fastcreatenopin my_user
- generate the provisioning QRcode: multiotp -qrcode my_user my_qrcode.png
You can also create a user quickly with the prefix PIN request option based on
the default option set in your configuration: multiotp -fastcreate my_user
And of course, you can also force to create a user quickly with a requested
prefix PIN: multiotp -fastcreatewithpin my_user
WHAT IS THE PREFIX PIN OPTION ?
===============================
The prefix PIN option is activated by default. Users will have to type their
PIN + the displayed token. The prefix PIN option has no effect for mOTP tokens,
and the users MUST NOT type their prefix PIN before the displayed token for
mOTP tokens, as the prefix PIN is already used by the algorithm in order to
generate the token.
Starting with version 4.3, it's now possible to use the synchronized AD/LDAP
password as a prefix instead of the static PIN. Please note that even with the
AD/LDAP password as a prefix activated, the PIN used for mOTP tokens is still
the static PIN.
To create a user quickly with the prefix PIN request option based on
the default option set in your configuration: multiotp -fastcreate my_user
To create a user quickly without a prefix PIN request:
multiotp -fastcreatenopin my_user
To create a user quickly with a requested prefix PIN:
multiotp -fastcreatewithpin my_user
HOW THE LOCKOUT OF AN ACCOUNT IS WORKING ?
==========================================
To prevent brute-force attack, an account is temporary locked for 300 seconds
after 3 unsuccessful trials.
After 6 unsuccessful trials, the account is definitely locked.
A user is unlocked by typing the following command line:
multiotp -unlock user
A user can also unlock his account by typing two consecutive codes,
separated by a space (don't forget the prefix PIN/password if enabled).
If prefix PIN is enabled, your PIN is 1234 and the two consecutive tokens are
984501 and 348202, you will have to type "1234984501 1234348202" as the
password in order to unlock the account during authentication.
The lockout parameters can be modified using these command lines:
multiotp -config failure-delayed-time=60
multiotp -config max-block-failures=12
multiotp -config max-delayed-failures=10
HOW TO DEBUG ?
==============
In order to have debug information, you can use the -debug option. With this
option, the debug information are saved in the file log/multiotp.log.
If you want to see directly the debug information on screen, add the
-display-log and an output of the debug information will be done on screen too.
In order to enable the debug mode permanently without using the option, you can
do that like this: multiotp -config debug=1
The same thing can be done for a permanent display of the debug information on
the screen without using the option: multiotp -config display-log=1
HOW TO INSTALL THE MULTIOTP WEB SERVICE UNDER WINDOWS ?
=======================================================
Installing the multiOTP web service is VERY easy. Simply run the
webservice_install script. Nginx configuration file will be created,
firewall rules will be adapted and the service will be installed and started.
The service is called multiOTPservice and is listening on port 8112 (http)
and on port 8113 (https).
HOW TO INSTALL THE MULTIOTP RADIUS SERVER UNDER WINDOWS ?
=========================================================
Installing the multiOTP radius service is VERY easy too. Simply run the
radius_install script. The etc/raddb/modules/multiotp file will be created,
firewall rules will be adapted and the service will be installed and started.
The service is called multiOTPradius and the secret is multiotpsecret for any
client including 127.0.0.1.
CONFIGURING MULTIOTP WITH TEKRADIUS OR TEKRADIUS LT UNDER WINDOWS
=================================================================
TekRADIUS supports a Default Username to be used when a matching user
profile cannot be found for an incoming RADIUS authentication request.
So a quick and easy way is to create in the TekRADIUS Manager a User
named 'Default' that belongs to the existing 'Default' Group.
Then add to this Default user the following attribute :
Check External-Executable C:\multitop\multiotp.exe %ietf|1% %ietf|2% -chap-challenge=%ietf|60% -chap-password=%ietf|3% -ms-chap-challenge=%msoft|11% -ms-chap-response=%msoft|1% -ms-chap2-response=%msoft|25%
Some values can go back to TekRADIUS:
a) Set the right format options for TekRADIUS:
multiotp -config radius-reply-attributor="=" radius-reply-separator="crlf"
b) Set multiOTP to send back to TekRADIUS the clear (non encrypted) authentication:
multiotp -config clear-otp-attribute="ietf|2"
c) Set multiOTP to send back to TekRADIUS the group of the authenticated user:
multiotp -config group-attribute="ietf|11"
HOW TO INSTALL THE MULTIOTP WEB SERVICE UNDER LINUX ?
=====================================================
The multiOTP web service is a simple web site. If you are under Linux and you
are reading this document, you have for sure the necessary skill to configure
your favorite web server in order to have an URL that will launch the page
multiotp.server.php which is in the main folder of the multiOTP distribution.
Please check carefully the rights of the folders, as the multiOTP web service
has to write in the various subfolders.
CONFIGURING MULTIOTP WITH FREERADIUS 2.X UNDER LINUX
====================================================
Using the -request-nt-key option, NT_KEY: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX can
now be displayed (like with the same option used with ntlm_auth).
1) Create a new module file called "multiotp" in etc/raddb/modules/ containing:
```
# Exec module instance for multiOTP (http://www.multiotp.net/).
# for Linux : replace '/path/to/multiotp' with the actual path to the multiotp.php file, including the full file name.
# for Windows: replace '/path/to' with the actual path to the multiotp.exe file (also with /), including the fulle file name.
exec multiotp {
wait = yes
input_pairs = request
output_pairs = reply
program = "/path/to/multiotp '%{User-Name}' '%{User-Password}' -request-nt-key -src=%{Packet-Src-IP-Address} -chap-challenge=%{CHAP-Challenge} -chap-password=%{CHAP-Password} -ms-chap-challenge=%{MS-CHAP-Challenge} -ms-chap-response=%{MS-CHAP-Response} -ms-chap2-response=%{MS-CHAP2-Response}"
shell_escape = yes
}
```
2) In the configuration file called "default" in etc/raddb/sites-enabled/
a) Add the multiOTP handling
```
#
# Handle multiOTP (http://www.multiotp.net/) authentication.
# This must be added BEFORE the first "pap" entry found in the file.
multiotp
```
b) Add the multiOTP authentication handling
```
#
# Handle multiOTP (http://www.multiotp.net/) authentication.
# This must be added BEFORE the first "Auth-Type PAP" entry found in the file.
Auth-Type multiotp {
multiotp
}
```
c) Comment the first line containing only "chap"
```
#chap is now handled by multiOTP
```
d) Comment the first line containing only "mschap"
```
#mschap is now handled by multiOTP
```
3) In the configuration file called "inner-tunnel" in etc/raddb/sites-enabled/
a) Add the multiOTP handling
```
#
# Handle multiOTP (http://www.multiotp.net/) authentication.
# This must be added BEFORE the first "pap" entry found in the file.
multiotp
```
b) Add the multiOTP authentication handling
```
#
# Handle multiOTP (http://www.multiotp.net/) authentication.
# This must be added BEFORE the first "Auth-Type PAP" entry found in the file.
Auth-Type multiotp {