1d1d1d1d1d1d:ae5ae5ae5ae5ae5ae5ae5ae5ae5aeetc

0

AllowUsers root@192.168.0.37 john
PermitRootLogin yes
MaxAuthTries 3   
UseDNS no

Match User john # ...or Match Group ykusers
   X11Forwarding no
   AllowTcpForwarding no
   ForceCommand /etc/ssh/yubikey.sh

#!/bin/sh

# MIND: further on this script uses OTP's of 44 chars;
# but this could be different in your customized OTP's
# Some OS's `read` command have delimiter options - for example 44 chars :)

trap disconnect INT
disconnect() {
  kill -9 $PPID
  exit 1
  }

# stty -echo # uncomment this (and below) if you prefer to hide the public ID
read -p "OTP: " -t 15 OTP_INPUT
# stty echo  # sometimes `read` has -s (silent)
echo; echo   # cosmetics

OTP=$(echo "$OTP_INPUT" | tr -c -d a-z)
if [ $? == 0 ] && [ ${#OTP} == 44 ]; then
  CNT=`cat .ssh/yubikey_count`
  NEW=`perl -T -- /etc/ssh/yubikey.pl $OTP $CNT`
  if [ $? == 0 ]; then
    echo $NEW > .ssh/yubikey_count
  # clear
    login -f $USER
    disconnect
  fi
fi

echo "invalid OTP" > /dev/stderr
disconnect

use strict;
use Auth::Yubikey_Decrypter;

# get values
open (FILE, "<", ".ssh/yubikey") or die "Could not open yubikey file.\n";
my @line = <FILE>;
chomp $line[0];
my @ykdata = split ":" , $line[0];
close FILE or die $!;

# decrypt:
my ($publicID,$secretid_hex,$counter_dec,$timestamp_dec,$session_use_dec,$random_dec,$crc_dec,$crc_ok) =
    Auth::Yubikey_Decrypter::yubikey_decrypt($ARGV[0],$ykdata[1]);

# prepare to check replay attacks
my $ctr32 = (($counter_dec & 0x7fff) << 8) + $session_use_dec;

# validate:
if ( $ykdata[0] eq $secretid_hex && $crc_ok == 1 && $ctr32 > $ARGV[1] ) {
  print $ctr32;
  exit 0;
  }

exit 1;