google / google/google-authenticator-libpam
Window Size Bug and Rate Limit Formatting Bug
- Dominant language
- C
- Stars
- 2k
- Forks
- 305
- PR merge metrics
- No merged PRs in 30d
Description
_From @ThomasHabets on October 10, 2014 8:7_
Original [issue 332](https://code.google.com/p/google-authenticator/issues/detail?id=332) created by SordidArchetype on 2013-10-08T19:00:28.000Z:
What is the problem?
1) Setting the -W flag on the google-authenticator utility should set the Window Size to it's minimum size. The value it actually sets is -1, which the pam module rejects.
2) Using the rate limiting switches at the command line of the google-authenticator utility will cause the .google_athenticator secret file to display the RATE_LIMIT directive without a space. (Setting this option interactively will show the space.)
What version of the product are you using? On what operating system?
Latest release on Debian 6 and Debian 7
Please provide any additional information below.
I have created a patch for both issue. The details are as follows...
When running google-authenticator interactively, it asks for the window size to be changed from 1 minute 30 seconds to 4 minutes.
If 4 minutes is chosen, an entry will be added to .google_authenticator secrets file.
If 1 minute 30 seconds is chosen, it stays at this minimum value and does not add an entry to the secrets file.
I have therefore patched the google-authenticator.c source to only add the window size to the secrets file if it has a value greater than -1. This should allow the -W flag to be used with the same effect as selecting 'N' (1 minute and 30 seconds) in interactive mode.
The -w (lowercase) flag can still be used to manually set a larger value.
I have also patched the same source to properly output a space in the RATE_LIMIT directive so that the interactive and non-interactive modes match in behaviour.
My patch is attached to this ticket.
_Copied from original issue: google/google-authenticator#331_
Contributor guide
Assessment
This issue has not been assessed yet.