FreeBSD Manual Pages
OCRA_TOOL(8) System Manager's Manual OCRA_TOOL(8) NAME ocra_tool -- create and view OCRA credential files SYNOPSIS ocra_tool info -f credential_file ocra_tool init -f credential_file -s suite_string -k key [-c counter] [-p pin | -P pin_hash] [-q kill_pin | -Q kill_pin_hash] [-w counter_window] [-t timestamp_offset] ocra_tool sync -f credential_file -c challenge -r response -v second_response DESCRIPTION The ocra_tool utility is used to initialize and view OCRA credential files used by the pam_ocra(8)authentication service module for PAM. info Show content of OCRA credential file. -f credential_file the OCRA credential file. init Initialize OCRA credential file. -f credential_file the OCRA credential file. -s suite_string OCRA suite string. -k key specified as hexadecimal string. -c counter If the suite_string requires a counter parameter, counter is the initial counter value. If counter begins with '0x' it will be interpreted as hexadecimal number. -p pin | -P pin_hash If the suite_string requires a pin-hash parameter, it is ei- ther set as hexadecimal string pin_hash or calculated from pin using the pin-hash algorithm in suite_string. -q kill_pin | -Q kill_pin_hash If the suite_string requires a pin-hash parameter, it is op- tional to provide a kill pin. If this pin is used, the the au- thentication fails, all future authentications also fail. The kill pin is set as hexadecimal string kill_pin_hash or calcu- lated from kill_pin using the pin-hash algorithm in suite_string. -w counter_window If the suite_string requires a counter parameter, counter_window specifies the maximum number of verify attempts pam_ocra(8) will make (while incrementing the counter value). This parameter is optional. -t timestamp_offset If the suite_string requires a timestamp parameter, timestamp_offset specifies the number of timestamp steps pam_ocra(8) will make while verifying a response. The verify process will start at (current_timestamp - timestamp_offset) and end at (current_timestamp + timestamp_offset). This para- meter is optional. sync Synchronize the counter with two responses from the OTP device. Based on a user selectable challenge and two subsequent responses it is possible to brute force the counter in the OTP device. When the counter is found, the database is updated. The counter is searched from 0 to UINT_MAX. -f credential_file the OCRA credential file. -c challenge Challenge entered in the OTP device. -r response First response for the given challenge. -v second response Second response for the given challenge. EXAMPLE $ ocra_tool init -f ~/.ocra -s OCRA-1:HOTP-SHA1-6:C-QN08-PSHA1 \ -k 00112233445566778899aabbccddeeff00112233 \ -c 10 -p 1234 -w 50 $ ocra_tool info -f ~/.ocra suite: OCRA-1:HOTP-SHA1-6:C-QN08-PSHA1 key: 0x00112233445566778899aabbccddeeff00112233 counter: 0x000000000000000a counter_window: 50 pin_hash: 0x7110eda4d09e062aa5e4a390b0a572ac0d2c0220 kill_pin_hash: NOT SET kill pin used: false FILES ~/.ocra OCRA credential file SEE ALSO pam_ocra(8) AUTHOR ocra_tool and this manual page were developed by Stefan Grundmann. FreeBSD ports 15.quarterly March 25, 2018 OCRA_TOOL(8)
NAME | SYNOPSIS | DESCRIPTION | EXAMPLE | FILES | SEE ALSO | AUTHOR
Want to link to this manual page? Use this URL:
<https://man.freebsd.org/cgi/man.cgi?query=ocra_tool&sektion=8&manpath=FreeBSD+Ports+15.1.quarterly>