15.5. One-time Passwords
Prev | Chapter 15. Security | Next

## 15.5. One-time Passwords

By default, FreeBSD includes support for One-time Passwords In Everything (OPIE), which uses the MD5 hash by default.

There are three different types of passwords. The first is the usual UNIX® style or Kerberos password. The second is the one-time password which is generated by opiekey(1) and accepted by opiepasswd(1) and the login prompt. The final type of password is the “secret password” used by opiekey(1), and sometimes opiepasswd(1), to generate one-time passwords.

The secret password has nothing to do with the UNIX® password. They can be the same, but this is not recommended. OPIE secret passwords are not limited to 8 characters like old UNIX® passwords[5]. Passwords of six or seven word long phrases are fairly common. For the most part, the OPIE system operates completely independently of the UNIX® password system.

Besides the password, there are two other pieces of data that are important to OPIE. One is the “seed” or “key”, consisting of two letters and five digits. The other is the “iteration count”, a number between 1 and 100. OPIE creates the one-time password by concatenating the seed and the secret password, applying the MD5 hash as many times as specified by the iteration count, and turning the result into six short English words. These six English words are the one-time password. The authentication system (primarily PAM) keeps track of the last one-time password used, and the user is authenticated if the hash of the user-provided password is equal to the previous password. Because a one-way hash is used, it is impossible to generate future one-time passwords if a successfully used password is captured. The iteration count is decremented after each successful login to keep the user and the login program in sync. When the iteration count gets down to 1, OPIE must be reinitialized.

There are a few programs involved in this process. opiekey(1) accepts an iteration count, a seed, and a secret password, and generates a one-time password or a consecutive list of one-time passwords. In addition to initializing OPIE, opiepasswd(1) is used to change passwords, iteration counts, or seeds. It takes either a secret passphrase, or an iteration count, seed, and a one-time password. The relevant credential files in `/etc/opiekeys` are examined by opieinfo(1) which prints out the invoking user's current iteration count and seed.

There are four different sorts of operations. The first is to use opiepasswd(1) over a secure connection to set up one-time-passwords for the first time, or to change the password or seed. The second operation is to use opiepasswd(1) over an insecure connection, in conjunction with opiekey(1) over a secure connection, to do the same. The third is to use opiekey(1) to log in over an insecure connection. The fourth is to use opiekey(1) to generate a number of keys which can be written down or printed out to carry to insecure locations in order to make a connection to anywhere.

### 15.5.1. Secure Connection Initialization

To initialize OPIE for the first time, execute opiepasswd(1):

`%` `opiepasswd -c` [grimreaper] ~ $ opiepasswd -f -c Adding unfurl: Only use this method from the console; NEVER from remote. If you are using telnet, xterm, or a dial-in, type ^C now or exit with no password. Then run opiepasswd without the -c parameter. Using MD5 to compute responses. Enter new secret pass phrase: Again new secret pass phrase: ID unfurl OTP key is 499 to4268 MOS MALL GOAT ARM AVID COED

At the `Enter new secret pass phrase:` or `Enter secret password:` prompt, enter a password or phrase. This is not the login password as this password is used to generate the one-time login keys. The “ID” line gives the parameters of the instance: the login name, iteration count, and seed. When logging in, the system will remember these parameters and display them, meaning that they do not have to be memorized. The last line gives the particular one-time password which corresponds to those parameters and the secret password. At the next login, this one-time password is the one to use.

### 15.5.2. Insecure Connection Initialization

To initialize or change the secret password over an insecure connection, a secure connection is needed to some place where opiekey(1) can be run. This might be a shell prompt on a trusted machine. An iteration count is needed, where 100 is probably a good value, and the seed can either be specified or the randomly-generated one used. On the insecure connection, the machine being initialized, use opiepasswd(1):

`%` `opiepasswd` Updating unfurl: You need the response from an OTP generator. Old secret pass phrase: otp-md5 498 to4268 ext Response: GAME GAG WELT OUT DOWN CHAT New secret pass phrase: otp-md5 499 to4269 Response: LINE PAP MILK NELL BUOY TROY ID mark OTP key is 499 gr4269 LINE PAP MILK NELL BUOY TROY

To accept the default seed, press Return. Before entering an access password, move over to the secure connection and give it the same parameters:

`%` `opiekey 498 to4268` Using the MD5 algorithm to compute response. Reminder: Do not use opiekey from telnet or dial-in sessions. Enter secret pass phrase: GAME GAG WELT OUT DOWN CHAT

Switch back over to the insecure connection, and copy the generated one-time password over to the relevant program.

### 15.5.3. Generating a Single One-time Password

After initializing OPIE and logging in, a prompt like this will be displayed:

`%` `telnet example.com` Trying 10.0.0.1... Connected to example.com Escape character is '^]'. FreeBSD/i386 (example.com) (ttypa) login: `<username>` otp-md5 498 gr4269 ext Password:

The OPIE prompts provides a useful feature. If Return is pressed at the password prompt, the prompt will turn echo on and display what is typed. This can be useful when attempting to type in a password by hand from a printout.

At this point, generate the one-time password to answer this login prompt. This must be done on a trusted system where it is safe to run opiekey(1). There are versions of this command for Windows®, Mac OS® and FreeBSD. This command needs the iteration count and the seed as command line options. Use cut-and-paste from the login prompt on the machine being logged in to.

On the trusted system:

`%` `opiekey 498 to4268` Using the MD5 algorithm to compute response. Reminder: Do not use opiekey from telnet or dial-in sessions. Enter secret pass phrase: GAME GAG WELT OUT DOWN CHAT

Once the one-time password is generated, continue to log in.

### 15.5.4. Generating Multiple One-time Passwords

Sometimes there is no access to a trusted machine or secure connection. In this case, it is possible to use opiekey(1) to generate a number of one-time passwords beforehand. For example:

`%` `opiekey -n 5 30 zz99999` Using the MD5 algorithm to compute response. Reminder: Do not use opiekey from telnet or dial-in sessions. Enter secret pass phrase: `<secret password>` 26: JOAN BORE FOSS DES NAY QUIT 27: LATE BIAS SLAY FOLK MUCH TRIG 28: SALT TIN ANTI LOON NEAL USE 29: RIO ODIN GO BYE FURY TIC 30: GREW JIVE SAN GIRD BOIL PHI

The `-n 5` requests five keys in sequence, and `30` specifies what the last iteration number should be. Note that these are printed out in reverse order of use. The really paranoid might want to write the results down by hand; otherwise, print the list. Each line shows both the iteration count and the one-time password. Scratch off the passwords as they are used.

### 15.5.5. Restricting Use of UNIX® Passwords

OPIE can restrict the use of UNIX® passwords based on the IP address of a login session. The relevant file is `/etc/opieaccess`, which is present by default. Refer to opieaccess(5) for more information on this file and which security considerations to be aware of when using it.

Here is a sample `opieaccess`:

permit 192.168.0.0 255.255.0.0

This line allows users whose IP source address (which is vulnerable to spoofing) matches the specified value and mask, to use UNIX® passwords at any time.

If no rules in `opieaccess` are matched, the default is to deny non-OPIE logins.

[5] Under FreeBSD the standard login password may be up to 128 characters in length.

Prev | Up | Next
15.4. DES, Blowfish, MD5, SHA256, SHA512, and Crypt | Home | 15.6. TCP Wrappers

This, and other documents, can be downloaded from http://ftp.FreeBSD.org/pub/FreeBSD/doc/

For questions about FreeBSD, read the documentation before contacting <questions@FreeBSD.org>.
For questions about this documentation, e-mail <doc@FreeBSD.org>.