the2nd/otpme
OTPme: A flexible One-Time-Password system. Contribute to the2nd/otpme development by creating an account on GitHub.
2 stars · 0 forks · Python Topics: otp, u2f, ldap-server, two-factor-authentication, pam-module, oidc-provider, fido2
README
Installation instructions
Warning: OTPme is alpha software. Do not use it in production. Expect breaking changes, incomplete features and bugs.
Full documentation is available at https://otpme.readthedocs.io. Manpages can be installed with: otpme-install-manpages Install debian dependencies apt-get install python3.11-venv gobjc++ python3-pybind11 python3-dev build-essential cmake gcc dbus-x11 freeradius freeradius-python3 libacl1-dev libnss-cache liboath0 liboath-dev libpcsclite1 libpq-dev libre2-9 libre2-dev libsystemd-dev pkg-config postgresql postgresql-server-dev-all pwgen pyflakes3 redis redis-server redis-tools libpcsclite-dev ykcs11 fuse3 libpam-python Disable installed services systemctl stop redis systemctl disable redis systemctl stop postgresql systemctl disable postgresql systemctl stop freeradius systemctl disable freeradius Install otpme Add otpme system user useradd -r -U -d /var/lib/otpme otpme Enable nsswitch nsscache module Edit /etc/nsswitch.conf and append 'cache' to the lines passwd, shadow and group. Create python venv python3 -m venv /opt/otpme . /opt/otpme/bin/activate Install otpme and dependencies pip3 install cython Pick the install variant matching what this machine should do:
Command Role
pip3 install otpme host — client + otpme-agent + PAM + nsscache + offline login. Default.
pip3 install 'otpme[backuphost]' backup host — backup server for nodes, shares and hosts.
pip3 install 'otpme[ssohost]' SSO portal host — front-end for the SSO/OIDC web portal. Holds no backend secrets, so it can be deployed into the DMZ.
pip3 install 'otpme[node]' node — full server install, all features.
pip3 install 'otpme[node,dev]' full server + dev tools (pytest, coverage, ruff).
The backuphost and ssohost roles are activated by setting BACKUP_SERVER resp. SSO_SERVER to True in /etc/otpme/otpme.conf. Copy configuration files cp -a /opt/otpme/lib/python3.11/site-packages/etc/otpme /etc/ cp -a /etc/otpme/otpme.conf.dist /etc/otpme/otpme.conf Edit /etc/otpme/otpme.conf POSTGRES_PG_CTL_BIN="/usr/lib/postgresql/15/bin/pg_ctl" Create PYTHONPATH file with path to venv (e.g. /opt/otpme/lib/python3.11/site-packages/) /etc/otpme/PYTHONPATH Init your otpme realm otpme-realm --api -ddee --color-logs -f init --ca-key-len 2048 --site-key-len 2048 --node-key-len 2048 --dicts english,en-top10000,common-passwords,us-female,us-male,us-surnames,abbreviations-it --id-ranges "uidNumber:s:100000-200000,gidNumber:s:100000-200000" yourrealm.tld yoursite localhost 127.0.0.1 Note: Scan the generated QRCode with the "Google Autenticator App" and note the PIN of the admin token. Start OTPme daemons otpme-controld start Login with admin token You need to input pin+otp. otpme-tool login Add optional U2F/fido2 attestation certificates from https://developers.yubico.com/FIDO/yubico-fido-ca-certs.txt. wget https://developers.yubico.com/FIDO/yubico-fido-ca-1.pem wget https://developers.yubico.com/FIDO/yubico-fido-ca-2.pem otpme-site add_fido2_ca_cert yoursite yubico-fido-ca-1.pem otpme-site add_fido2_ca_cert yoursite yubico-fido-ca-2.pem otpme-site config yoursite check_fido2_attestation_cert True Disable gpg-agent (systemd) to use yubikey/GPG card with the PAM module. systemctl --global mask --now gpg-agent.service gpg-agent.socket gpg-agent-ssh.socket gpg-agent-extra.socket gpg-agent-browser.socket