OpentOTP & SSH

[Cristina Bulfon]

Hello,

I've configured OpenOTP 1.1.0-1, libopenotp-1.0.7 and pam_openotp-1.0 and WebADM.
Create both Linux and LDAP account with the same UID and GID.
For the LDAP account I've also registered a token to work with my Android Token

/etc/pam.d/sshd

#### test OpenOTP
auth       sufficient pam_openotp.so server_url="http://xxxxxxxxx:8080/openotp/" client_id="SSH" password_mode=1
#
auth       required    pam_sepermit.so
auth       required    pam_env.so
auth       include      password-auth
account    required     pam_nologin.so
account    include      password-auth
password   include      password-auth
# pam_selinux.so close should be the first session rule
session    required     pam_selinux.so close
session    required     pam_loginuid.so
# pam_selinux.so open should only be followed by sessions to be executed in the user context
session    required     pam_selinux.so open env_params
session    optional     pam_keyinit.so force revoke
session    include      password-auth

/etc/ssh/sshd_config
ChallengeResponseAuthentication yes
UsePAM yes
PasswordAuthentication yes

If I try to connect on machine with ssh I got
LDAP password
Enter your TOKEN one-time password:

For the TOKEN one-time password  I put the TOKEN that my phone gave me and I got into the machine but on the soapd.log file I see the following messages

Fri Mar 29 15:27:17 2013] [x.x.x.x] [OpenOTP_EE045FB2] Found challenge session started 2013-03-29 15:26:44
[Fri Mar 29 15:27:17 2013] [x.x.x.x.] [OpenOTP_EE045FB2] Started transaction lock for user
[Fri Mar 29 15:27:17 2013] [x.x.x.x] [OpenOTP_EE045FB2] Wrong MOTP password
[Fri Mar 29 15:27:19 2013] [x.x.x.x] [OpenOTP_EE045FB2] Sent failure response

So I tried another test,  for the TOKEN one-time password  I put whatever digit and I got into the machine since my LDAP password was correct.
Seems to me that the TOKEN is not important but it is not the behavior that I was expecting

Any help is appreciate.

thanks

cristina