Localhost Only ToTP

Software & Operating Systems Linux
1

Ello all,
I’d like to setup a localhost only ToTP setup for local only accounts on my servers. I don’t want any external connection required. It has to support PAM. Does anybody know of anything that fits the requirements?

2

I believe the google Authenticator Pam module would do the job?

https://www.redhat.com/sysadmin/mfa-linux

I believe it’s all local

3

That’s actually cool but does it phone home at all?

4

I looked at that. Some of the auth diagrams made believe it was not all local.

I’m looking for a solution that can work in a degraded network situation, no networking (other than localhost).

5

I don’t see why it wouldn’t be local? The diagrams may have appeared that way of it was explaining the use of the Authenticator device or a setup only for accessing outside the local network.

It’s supports both TOTP and HOTP so it seems like an ideal and easy solution.

6

TOTP has no reason to make any external connections. It’s a secret value in a file on your server, and on your smart phone or a hardware token device.

Here’s a guide for pam_oath:
https://wiki.archlinux.org/index.php/Pam_oath

The FreeOTP app works well on Android phones. TOTP Authenticator works well on iPhone.

7

Thanks, I’ll take a look at pam_oath. It looks pretty promising.

8

Unfortunately, pam_oath doesn’t support fall-though if a user isn’t configured. Looks like google_authenticator does. Pam_oath has had an issue opened for this feature for two years but there isn’t any traction on it. Doesn’t look like the feature isn’t going anywhere soon.