Tika.Arnholm.nu Tika.Arnholm.NU
S/Key

Detta dokument är ett utdrag ur OpenBSD FAQ om hur man använder S/Key vilket är ett ``one-time password´´ system. Det will säga att ett lösen ord bara kan användas en gång. Detta gör att det inte är farligt om lösenordet uppfattas på vägen över ett oskyddat nät. (T.ex. Internet). På tika är detta främst tänkt att användas för att logga in med ftp. Telnet tjänsen är inte på slagen utan du skall använda ssh i stället. Tyvärr känner jag ännu inte till någon fri ssh för Amiga OS, men till windows maskiner kan TTssh rekomenderas.

För att använda S/Key i praktiken kan man skapa en lista över de nästa lösenorden och ha med sig denna. På listan kan man stryka de lösen ord man matat in och på så sätt hålla listan uppdaterad.

OpenBSD's Faq om S/Key

S/Key is a ``one-time password'' scheme. This allows for one-time passwords for use on un-secured channels. This can come very handy for those who don't have the ability to use ssh or any other encrypted channels. OpenBSD's S/Key implementation can use a variety of algorithms as the one-way hash. Here is the list of algorithms available:

Setting up S/Key - The first steps

To start off the file /etc/skeykeys must exist. If this file is not in existence, have the super-user create it. This can be done simply by doing:

Once that file is in existence, you can initalize your S/Key. To do this you will have to use skeyinit(1). With skeyinit(1), you will first be prompted for your password to the system. This is the same password that you used to log into the system. Running skeyinit(1) over an insecure channel is completely not recommended, so this should be done over a secure channel (such as ssh) or the console. Once you have authorized yourself with your system password you will be asked for yet another password. This password is the secret password, and is NOT your system password. The secret password is not limited to 8 characters like system passwords, actually it must be at least 10 characters. A few word phrases are suggested. Here is an example user being added.

One line of particular importance in here is ID ericj skey is otp-md5 99 oshi45820. This gives a lot of information to the user. Here is a breakdown of the sections and their importance.

But of more immediate importance is your password. Your password consists of 6 small words, combined together this is your password, spaces and all.

Actually using S/Key to login.

By now your skey has been initialized, and you have your password. You're ready to login. Here is an example session using s/key to login.

Some of you might have noticed that my sequence number has changed. otp-md5 96 oshi45820. This is because by now I have used s/key to login several times. But how do you get your password after you've logged in once? Well to do this, you'll need to know what sequence number you're using and your key. As you're probably thinking, how can you remember which sequence number you're on? Well this is simple, use skeyinfo(1), and it will tell you what to use. For example here, I need to generate another password for a login that I might have to make in the future. (remember I'm doing this from a secure channel).

From this I can create the password for my next login. To do so, I'll use skey(1). I can use exactly that output from above to create my password.

I'm sure many of you won't always have a secure connect to create these passwords, and creating them over an insecure connection isn't feasible, so how can you create multiple passwords at one time? Well you can supply skey(1) with a number of how many passwords you want created. This can then be printed out and taken with you wherever you go.

Notice here though, that the bottom password should be the first used, because we are counting down from 100.

Using S/Key with telnet(1) and rlogin(1)

Using S/Key with telnet(1) and rlogin(1) is done in pretty much the same fashion as with ftp, only your first password must be "s/key". Example:

Controlling S/Key

For more control over S/Key there is the /etc/skey.access file. (This does not exist by default, so it must be created.) This file can restrict S/Key in three primary ways.

If I wanted to allow one single user ( ericj ), from a certain IP ( 10.1.1.5 ), I would create a file like so.