PAMOTPW(8)

📦
version 1.5 · 2 versions
, in debian bookworm, debian trixie, ubuntu jammy, ubuntu noble, ubuntu questing, ubuntu resolute, ubuntu stonking

💖 PAM_OTPW — okay bestie, let's talk one-time passwords 💖

So this is pam_otpw, a system manager's manual page, section 8, and it's literally all about verifying one-time passwords. Think of it as the bouncer at the club door but the guest list changes every single time. 🎀

✨ SYNOPSIS ✨

pam_otpw [ arguments ]

🌸 DESCRIPTION 🌸

Okay so OTPW is a whole one-time password authentication system, and it's giving very "you only get one shot" energy. What it does is compare whatever password gets entered against hash values that are stored in the user's home directory, inside the file ~/.otpw. 🔥

And here's the iconic part: once a password has been entered correctly, its hash value in ~/.otpw gets overwritten with hyphens, which disables it from ever being used for authentication again. One and done. Periodt. 💅

There's also a lock file, ~/.otpw.lock, and its whole job is preventing the same password challenge from being issued across several concurrent authentication sessions. Why do we care? Because this helps stop an eavesdropper from copying a one-time password the instant it's entered and instantly shoving it into a second session, hoping to get access by sending that final newline character faster than the user could. Not on our watch bestie. 😤

This module serves up two functions, no cap:

  • The authentication management function — it asks for and verifies one-time passwords.
  • The session management function — it prints a message after login that reminds the user how many one-time passwords they still have left. 🦋

🎀 ARGUMENTS 🎀

  • debug — turn on debugging via syslog(3). Yep, that's the whole thing. 💀
  • nolock — disable locking. This one tells the authentication function of pam_otpw.so to ignore any existing ~/.otpw.lock lock file and to not generate any. Heads up though: with this option, pam_otpw.so will never ask for several passwords simultaneously. So like, know what you're signing up for. 🫶

👑 PSEUDO-USER INSTALLATION 👑

Okay this part is lowkey important. If a system pseudo user “otpw” exists in the user database — and by that we mean with UID < 1000 — then the password hash files will not be stored in the user's home directory. 🙈

So instead of looking for ~john/.otpw.lock, the file has to be located in the home directory of the pseudo user “otpw”, and it has to be named after the user, like “/var/lib/otpw/john”. It'll be accessed with the effective UID and GID of that pseudo user. Slay. ✨

💜 AUTHOR 💜

The OTPW package, which includes the otpw-gen program, has been developed by Markus Kuhn. The most recent version is available from <http://www.cl.cam.ac.uk/~mgk25/otpw.html>. Respect the icon who built the thing. 🌟

🌈 SEE ALSO 🌈

And that's a wrap, bestie! 🎀 This little gem is from the System Manager's Manual, dated 2014-08-07, section PAMOTPW(8). Go forth and one-time-password responsibly. 💅✨

📦 where this page comes from