HardenedBSD/usr.bin/key

One of the nice things of S/Key is that it still leaves you the option
to use regular UNIX passwords. In fact, the presence of S/Key support
is completely invisible for a user until she has set up a password with
the keyinit command. You can permit regular UNIX passwords for local
logins, while at the same time insisting on S/Key passwords for logins
from outside.

ORIGIN

These files are modified versions of the s/key files found on
thumper.bellcore.com at 21 oct 1993. They have been fixed to
run on top of SunOS 4.1.3 and Solaris 2.3.

Installation is described at the end of this file.

USAGE

Use the keyinit command to set up a new series of s/key passwords.

    wzv_6% keyinit
    Updating wietse:
    Old key: wz173500
    Reminder - Only use this method if you are direct connected.
    If you are using telnet or dial-in exit with no password and use keyinit -s.
    Enter secret password: 
    Again secret password: 

    ID wietse s/key is 99 wz173501
    BLAH BLA BLAH BLAH BLAH BLA

Be sure to make your secret password sufficiently long. Try using a
full sentence instead of just one single word.

You will have to do a "keyinit" on every system that you want to login
on using one-time passwords.

Whenever you log into an s/key protected system you will see
something like:

    login: wietse
    s/key 98 wz173501
    Password:

In this case you can either enter your regular UNIX password or
your one-time s/key password. For example, I open a local window 
to compute the password:

    local% key 98 wz173501
    Reminder - Do not use key while logged in via telnet or rlogin.
    Enter secret password: 
    BLAH BLA BLAH BLAH BLAH BLA

The "BLAH BLA BLAH BLAH BLAH BLA" is the one-time s/key password.

If you have to type the one-time password in by hand, it is convenient
to have echo turned on so that you can correct typing errors. Just type
a newline at the "Password:" prompt:

    login: wietse
    s/key 98 wz173501
    Password: (turning echo on)
    Password:BLAH BLA BLAH BLAH BLAH BLA

The 98 in the challenge will be 97 the next time, and so on. You'll get
a warning when you are about to run out of s/key passwords, so that you
will have to run the keyinit command again.

Sometimes it is more practical to carry a piece of paper with a small
series of one-time passwords. You can generate the list with:

    % key -n 10 98 wz173501
    98: BLAH BLA BLAH BLAH BLAH BLA
    97: ... 
    96: ...

Be careful when printing material like this!

INSTALLATION

To install, do: make sunos4 (or whatever), then: make install.  

The UNIX password is always permitted with non-network logins.  By
default, UNIX passwords are always permitted (the Bellcore code by
default disallows UNIX passwords but I think that is too painful).  In
order to permit UNIX passwords only with logins from specific networks,
create a file /etc/skey.access. For example,

    # First word says if UNIX passwords are to be permitted or denied.
    # remainder of the rule is a networknumber and mask. A rule matches a
    # host if any of its addresses satisfies:
    # 
    #	network = (address & mask)
    # 
    #what	network		mask
    permit	131.155.210.0	255.255.255.0
    deny	0.0.0.0		0.0.0.0

This particular example will permit UNIX passwords with logins from any
host on network 131.155.210, but will insist on one-time passwords in
all other cases.