S/Key is a one-time password scheme based on a one-way hash function. FreeBSD uses the MD4 hash for compatibility but other systems have used MD5 and DES-MAC. S/Key has been part of the FreeBSD base system since version 1.1.5 and is also used on a growing number of other operating systems. S/Key is a registered trademark of Bell Communications Research, Inc.
From version 5.0 of FreeBSD, S/Key has been replaced with the functionally equivalent OPIE (One-time Passwords In Everything). OPIE uses the MD5 hash by default.
There are three different sorts of passwords which we will discuss
below. The first is your usual UNIX® style or
Kerberos password; we will call this a “UNIX® password”.
The second sort is the one-time password which is generated by the
S/Key key
program or the OPIE
opiekey(1) program and accepted by the
keyinit
or opiepasswd(1) programs
and the login prompt; we will
call this a “one-time password”. The final sort of
password is the secret password which you give to the
key
/opiekey
programs (and
sometimes the
keyinit
/opiepasswd
programs)
which it uses to generate
one-time passwords; we will call it a “secret password”
or just unqualified “password”.
The secret password does not have anything to do with your UNIX® password; they can be the same but this is not recommended. S/Key and OPIE secret passwords are not limited to 8 characters like old UNIX® passwords[11], they can be as long as you like. Passwords of six or seven word long phrases are fairly common. For the most part, the S/Key or OPIE system operates completely independently of the UNIX® password system.
Besides the password, there are two other pieces of data that are important to S/Key and OPIE. One is what is known as the “seed” or “key”, consisting of two letters and five digits. The other is what is called the “iteration count”, a number between 1 and 100. S/Key creates the one-time password by concatenating the seed and the secret password, then applying the MD4/MD5 hash as many times as specified by the iteration count and turning the result into six short English words. These six English words are your one-time password. The authentication system (primarily PAM) keeps track of the last one-time password used, and the user is authenticated if the hash of the user-provided password is equal to the previous password. Because a one-way hash is used it is impossible to generate future one-time passwords if a successfully used password is captured; the iteration count is decremented after each successful login to keep the user and the login program in sync. When the iteration count gets down to 1, S/Key and OPIE must be reinitialized.
There are three programs involved in each system
which we will discuss below. The key
and
opiekey
programs accept an iteration
count, a seed, and a secret password, and generate a one-time
password or a consecutive list of one-time passwords. The
keyinit
and opiepasswd
programs are used to initialize S/Key and OPIE respectively,
and to change passwords, iteration counts, or seeds; they
take either a secret passphrase, or an iteration count,
seed, and one-time password. The keyinfo
and opieinfo
programs examine the
relevant credentials files (/etc/skeykeys
or
/etc/opiekeys
) and print out the invoking user's
current iteration count and seed.
There are four different sorts of operations we will cover. The
first is using keyinit
or
opiepasswd
over a secure connection to set up
one-time-passwords for the first time, or to change your password
or seed. The second operation is using keyinit
or opiepasswd
over an insecure connection, in
conjunction with key
or opiekey
over a secure connection, to do the same. The third is using
key
/opiekey
to log in over
an insecure connection. The fourth is using key
or opiekey
to generate a number of keys which
can be written down or printed out to carry with you when going to
some location without secure connections to anywhere.
To initialize S/Key for the first time, change your password,
or change your seed while logged in over a secure connection
(e.g. on the console of a machine or via ssh), use the
keyinit
command without any parameters while
logged in as yourself:
%
keyinit
Adding unfurl:
Reminder - Only use this method if you are directly connected.
If you are using telnet or rlogin exit with no password and use keyinit -s.
Enter secret password:
Again secret password:
ID unfurl s/key is 99 to17757
DEFY CLUB PRO NASH LACE SOFTFor OPIE, opiepasswd
is used instead:
%
opiepasswd -c
[grimreaper] ~ $ opiepasswd -f -c
Adding unfurl:
Only use this method from the console; NEVER from remote. If you are using
telnet, xterm, or a dial-in, type ^C now or exit with no password.
Then run opiepasswd without the -c parameter.
Using MD5 to compute responses.
Enter new secret pass phrase:
Again new secret pass phrase:
ID unfurl OTP key is 499 to4268
MOS MALL GOAT ARM AVID COED
At the Enter new secret pass phrase:
or
Enter secret password:
prompts, you
should enter a password or phrase. Remember, this is not the
password that you will use to login with, this is used to generate
your one-time login keys. The “ID” line gives the
parameters of your particular instance: your login name, the
iteration count, and seed. When logging in the system
will remember these parameters and present them back to you so you
do not have to remember them. The last line gives the particular
one-time password which corresponds to those parameters and your
secret password; if you were to re-login immediately, this
one-time password is the one you would use.
To initialize or change your secret password over an
insecure connection, you will need to already have a secure
connection to some place where you can run key
or opiekey
; this might be in the form of a
desk accessory on a Macintosh®, or a shell prompt on a machine you
trust. You will also need to make up an iteration count (100 is
probably a good value), and you may make up your own seed or use a
randomly-generated one. Over on the insecure connection (to the
machine you are initializing), use the keyinit
-s
command:
%
keyinit -s
Updating unfurl:
Old key: to17758
Reminder you need the 6 English words from the key command.
Enter sequence count from 1 to 9999: 100
Enter new key [default to17759]:
s/key 100 to 17759
s/key access password:
s/key access password:CURE MIKE BANE HIM RACY GORE
For OPIE, you need to use opiepasswd
:
%
opiepasswd
Updating unfurl:
You need the response from an OTP generator.
Old secret pass phrase:
otp-md5 498 to4268 ext
Response: GAME GAG WELT OUT DOWN CHAT
New secret pass phrase:
otp-md5 499 to4269
Response: LINE PAP MILK NELL BUOY TROY
ID mark OTP key is 499 gr4269
LINE PAP MILK NELL BUOY TROY
To accept the default seed (which the
keyinit
program confusingly calls a
key
), press Return.
Then before entering an
access password, move over to your secure connection or S/Key desk
accessory, and give it the same parameters:
%
key 100 to17759
Reminder - Do not use this program while logged in via telnet or rlogin.
Enter secret password: <secret password>
CURE MIKE BANE HIM RACY GOREOr for OPIE:
%
opiekey 498 to4268
Using the MD5 algorithm to compute response.
Reminder: Don't use opiekey from telnet or dial-in sessions.
Enter secret pass phrase:
GAME GAG WELT OUT DOWN CHAT
Now switch back over to the insecure connection, and copy the one-time password generated over to the relevant program.
Once you have initialized S/Key or OPIE, when you login you will be presented with a prompt like this:
%
telnet example.com
Trying 10.0.0.1...
Connected to example.com
Escape character is '^]'.
FreeBSD/i386 (example.com) (ttypa)
login: <username>
s/key 97 fw13894
Password: Or for OPIE:
%
telnet example.com
Trying 10.0.0.1...
Connected to example.com
Escape character is '^]'.
FreeBSD/i386 (example.com) (ttypa)
login: <username>
otp-md5 498 gr4269 ext
Password: As a side note, the S/Key and OPIE prompts have a useful feature (not shown here): if you press Return at the password prompt, the prompter will turn echo on, so you can see what you are typing. This can be extremely useful if you are attempting to type in a password by hand, such as from a printout.
At this point you need to generate your one-time password to
answer this login prompt. This must be done on a trusted system
that you can run key
or
opiekey
on. (There are versions of these for DOS,
Windows® and Mac OS® as well.) They need both the iteration count and
the seed as command line options. You can cut-and-paste these
right from the login prompt on the machine that you are logging
in to.
On the trusted system:
%
key 97 fw13894
Reminder - Do not use this program while logged in via telnet or rlogin.
Enter secret password:
WELD LIP ACTS ENDS ME HAAGFor OPIE:
%
opiekey 498 to4268
Using the MD5 algorithm to compute response.
Reminder: Don't use opiekey from telnet or dial-in sessions.
Enter secret pass phrase:
GAME GAG WELT OUT DOWN CHATNow that you have your one-time password you can continue logging in:
<username>
s/key 97 fw13894
Password: <return to enable echo>
s/key 97 fw13894
Password [echo on]: WELD LIP ACTS ENDS ME HAAG
Last login: Tue Mar 21 11:56:41 from 10.0.0.2 ... Sometimes you have to go places where you do not have
access to a trusted machine or secure connection. In this case,
it is possible to use the key
and
opiekey
commands to
generate a number of one-time passwords beforehand to be printed
out and taken with you. For example:
%
key -n 5 30 zz99999
Reminder - Do not use this program while logged in via telnet or rlogin.
Enter secret password: <secret password>
26: SODA RUDE LEA LIND BUDD SILT
27: JILT SPY DUTY GLOW COWL ROT
28: THEM OW COLA RUNT BONG SCOT
29: COT MASH BARR BRIM NAN FLAG
30: CAN KNEE CAST NAME FOLK BILKOr for OPIE:
%
opiekey -n 5 30 zz99999
Using the MD5 algorithm to compute response.
Reminder: Don't use opiekey from telnet or dial-in sessions.
Enter secret pass phrase: <secret password>
26: JOAN BORE FOSS DES NAY QUIT
27: LATE BIAS SLAY FOLK MUCH TRIG
28: SALT TIN ANTI LOON NEAL USE
29: RIO ODIN GO BYE FURY TIC
30: GREW JIVE SAN GIRD BOIL PHIThe -n 5
requests five keys in sequence, the
30
specifies what the last iteration number
should be. Note that these are printed out in
reverse order of eventual use. If you are
really paranoid, you might want to write the results down by hand;
otherwise you can cut-and-paste into lpr
. Note
that each line shows both the iteration count and the one-time
password; you may still find it handy to scratch off passwords as
you use them.
S/Key can place restrictions on the use of UNIX® passwords based
on the host name, user name, terminal port, or IP address of a
login session. These restrictions can be found in the
configuration file /etc/skey.access
. The
skey.access(5) manual page has more information on the complete
format of the file and also details some security cautions to be
aware of before depending on this file for security.
If there is no /etc/skey.access
file
(this is the default on FreeBSD 4.X systems), then all users will
be allowed to use UNIX® passwords. If the file exists, however,
then all users will be required to use S/Key unless explicitly
permitted to do otherwise by configuration statements in the
skey.access
file. In all cases, UNIX®
passwords are permitted on the console.
Here is a sample skey.access
configuration
file which illustrates the three most common sorts of configuration
statements:
The first line (permit internet
) allows
users whose IP source address (which is vulnerable to spoofing)
matches the specified value and mask, to use UNIX® passwords. This
should not be considered a security mechanism, but rather, a means
to remind authorized users that they are using an insecure network
and need to use S/Key for authentication.
The second line (permit user
) allows the
specified username, in this case fnord
, to use
UNIX® passwords at any time. Generally speaking, this should only
be used for people who are either unable to use the
key
program, like those with dumb terminals, or
those who are ineducable.
The third line (permit port
) allows all
users logging in on the specified terminal line to use UNIX®
passwords; this would be used for dial-ups.
OPIE can restrict the use of UNIX® passwords based on the IP
address of a login session just like S/Key does. The relevant file
is /etc/opieaccess
, which is present by default
on FreeBSD 5.0 and newer systems. Please check opieaccess(5)
for more information on this file and which security considerations
you should be aware of when using it.
Here is a sample opieaccess
file:
This line allows users whose IP source address (which is vulnerable to spoofing) matches the specified value and mask, to use UNIX® passwords at any time.
If no rules in opieaccess
are matched,
the default is to deny non-OPIE logins.
本文及其他文件,可由此下載: ftp://ftp.FreeBSD.org/pub/FreeBSD/doc/。
若有 FreeBSD 方面疑問,請先閱讀
FreeBSD 相關文件,如不能解決的話,再洽詢
<questions@FreeBSD.org>。
關於本文件的問題,請洽詢
<doc@FreeBSD.org>。