===== Using Skey One-Time Pass-phrases for Logging in at Insecure Terminals =====

----

Note: skey(1) is currently only enabled for ssh(1) sessions on SDF. It also appears to only work with MD4 hashes.

==== Concept: ====

By creating a set of one-time use pass-phrases, the **skey(1)** utility lets users securely login remotely at insecure terminals without exposing their real password.

==== Precautions: ====

Once logged in, its important for security reasons that the user NOT type his/her real password during the session.

==== Creating your skeys: ====

Your skeys are created via the 'skeyinit' command. There are some options available (see 'man skeyinit') but the defaults work just fine. Typing 'skeyinit' starts the process. You'll be prompted for your real password, so its important that you be securely logged in via ssh or similar. After you enter your password you're prompted for a skey-specific password (alphanumeric; 10+digits) which you'll need to enter twice. Things went correctly if you get something like this:

  member@sdf: {4} skeyinit
  Password:
  [Adding member]
  Reminder - Only use this method if you are directly connected
             or have an encrypted channel. If you are using telnet
             or rlogin, exit with no password and use skeyinit -s.

  Enter secret password:
  Again secret password:

  ID member skey is otp-md4 99 sdf65974
  Next login password: AGEE HOE HANK TAR MAY AID

  member@sdf: {5}

Aside from your secret skey password, the important bit of information here is the ID: in this example member's unique skey ID is sdf65974, there are 99 pass-phrases available (default), and they are encrypted using MD4.

As you can see, the first pass-phrase is provided. However, the default settings produce 99 pass-phrases, some or all(!) which you can display for printing purposes. To display the next six pass-phrases in the above example, we type 'skey -n 6 99 sdf65974' and reenter the secret password:

  member@sdf: {10} skey -n 6 99 sdf66315
  Reminder - Do not use this program while logged in via telnet or rlogin.
  Enter secret password:
   94: HURT PO WAS COLT TEET ALGA
   95: OBEY MONK BOP GELD ELY ALL
   96: DUCK AIM BEND TENT FORK OAT
   97: ANA ITCH TOOL THAN CAM GIN
   98: LEAR STAG BELT BABY FEW WAY
   99: TOW CUE WELL REP GRIT MINI

Incidentally, the pass-phrases get used starting at 99 and can be entered in upper or lower case (the spaces must be included however). To see what our next skey pass-phrase number is we type 'skeyinfo':

  member@sdf: {11} skeyinfo
  Your next otp-md4 98 sdf66315

This means I need to use pass-phrase #98 next time I want to login with an skey pass-phrase. To make obtaining the next pass-phrase easier, create an alias:

  (for ksh shell; other shells work differently)

  % alias skey-next='skey -n 1 $(skeyinfo | cut -d " " -f 4-)'
  % skey-next
  Reminder - Do not use this program while logged in via telnet or rlogin.
  Enter secret password:
  LEAR STAG BELT BABY FEW WAY

==== Deleting Skeys: ====

To delete your skeys type 'skeyinit -z' and enter your real password (do it via ssh session!). To verify deletion type 'skeyinfo':

  member@sdf: {2} skeyinit -z
  Password:
  member@sdf: {3} skeyinfo
  You have no s/key

==== Logging in: ====

To connect via ssh or sftp use your usual login name and you next skey pass-phrase (lowercase is fine; keep the spaces). Generally, the password prompt will provide some visual indication that you can enter an skey pass-phrase:

  % ssh member@sdf.org
  otp-md4 98 sdf66315
  S/Key Password:

On some systems and/or skey implementations you must first enter the login "skey", then your regular login name, then the skey pass-phrase.

==== References: ====

  * man pages for skey, skeyinit, and skeyinfo
  * Internet search phrase "using skeys"

\\ $Id: skey_tutorial.html,v 1.5 2012/06/03 15:10:45 jgw Exp $