
PAM module for Mobile OTP
--------------------------------

Mobile OTP is a solution for strong two factor authentication.
See http://motp.dyndns.org/ for more details.


PLATFORMS
~~~~~~~~~

The PAM module for Mobile OTP was developed and tested for
- Linux SuSE 7
- Solaris 8

There is a package for Nokia's IPSO.


INSTALLATION
~~~~~~~~~~~~

Supported module types are "auth" and "password".

For installation you must:

     1. Think about what you are going to do. Especially read the
	documentation about Mobile OTP. And you should know what PAM
	is and how it works ...

     2. Copy sample configuration file "motp.conf" into /etc/security.
	Set file permission to rw-------.
	Edit the configuration file; for creating secrets press #**# 
	on your mobile phone.

     3. Insert lines like
		auth  sufficient /lib/security/pam_mobile_otp.so not_set_pass
	and
		password required /lib/security/pam_mobile_otp.so debug
	into your pam config file, e. g. /etc/pam.d/login

     4. Copy pam_mobile_otp.so to /lib/security.

     5. Create the directory /var/cache/motp.

     6. Try to log in with Mobile OTP _before_ finishing your actual session.



CONFIGURATION
~~~~~~~~~~~~~

Recognized options are:

   auth:
   	users=<filename>
		for setting a different configuration file, default is 
		/etc/security/motp.conf

	cache=<dirname>
		for using a different cache directory, default is 
		/var/cache/motp

	maxdiff=<seconds>
		for setting the maximum time range in which a passcode
		is accepted. 
		Default is 360 (seconds). That means that clocks may
		differ 3 minutes.

	maxtries=<number>
		sets the number of unsuccesfull authentication tries
		before user is locked.
		Default ist 5.

	debug

	no_warn

	use_first_pass
		if set, the module does not ask for the passcode, but
		uses the password given earlier to an other module.

	try_first_pass
		if set, the module only asks for a passcode, if password
		was not set earlier to an other module.

	not_set_pass
		passcode will not be set as password, that can be used
		by other modules

   password:

	users=<filename>
		for setting a different configuration file as 
		/etc/security/motp.conf

	debug

	no_warn




KNOWN LIMITATIONS
~~~~~~~~~~~~~~~~~

- Functions are not thread safe i think

- User must not type in old PIN when calling passwd


Any comments, bug reports or questions (to the module only) to
<sebastian.korff@web.de>
