blob: a68a3177fc93903b9ae85c033c88d3b3dacbbd94 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
|
# -*- text -*-
#
# $Id$
#
# Time-based One-Time Passwords (TOTP)
#
# Defined in RFC 6238, and used in Google Authenticator.
#
# This module can only be used in the "authenticate" section.
#
# The Base32-encoded secret should be placed into:
#
# &control:TOTP-Secret
#
# Any "bare" key should be placed into:
#
# &control:TOTP-Key
#
# If TOTP-Key exists, then it will be used instead of TOTP-Secret.
#
# The TOTP password entered by the user should be placed into:
#
# &request:TOTP-Password
#
# The module will return "ok" if the passwords match, and "fail"
# if the passwords do not match.
#
# Note that this module will NOT interact with Google. The module is
# intended to be used where the local administrator knows the TOTP
# secret key, and user has an authenticator app on their phone.
#
# Note also that while you can use the Google "chart" APIs to
# generate a QR code, doing this will give the secret to Google!
#
# Administrators should instead install a tool such as "qrcode"
#
# https://linux.die.net/man/1/qrencode
#
# and then run that locally to get an image.
#
#
# Some tokens get severely out of sync with local time. It is
# possible to offset the definition of "now" for one token by setting:
#
# &control:TOTP-Time-Offset := 120
#
# This is a signed integer, with allowed values between -600 to +600.
# The offset is added to to the current time, to get the tokens idea
# of "now".
#
totp {
#
# Default time step between time changes
#
time_step = 30
#
# Length of the one-time password.
#
# Must be 6 or 8
#
otp_length = 6
#
# How many steps backward in time we look for a matching OTP
#
lookback_steps = 1
#
# How many steps forward in time we look for a matching OTP
#
lookforward_steps = 0
#
# Time delta between steps.
#
# Cannot be larger than time_step
#
lookback_interval = 30
}
|
