Is there a command line two-factor authentication verification code generator?

Question

I manage a server with two-factor authentication. I have to use the Google Authenticator iPhone app to get the 6-digit verification code to enter after entering the normal server password. The setup is described here: http://www.mnxsolutions.com/security/two-factor-ssh-with-google-authenticator.html

I would like a way to get the verification code using just my laptop and not from my iphone. There must be a way to seed a command line app that generates these verification codes and gives you the code for the current 30-second window.

Is there a program that can do this?

Answer 1

Yes, oathtool can do this. You'll need to seed it with the shared secret from your server (i.e. save the shared secret and re-use it each time, in this example we'll assume they offered N3V3R G0nn4 G1v3 Y0u Up).

You can install it from the oath-toolkit package.

Example usage to generate same code as google authenticator and authy:

oathtool -b --totp 'N3V3R G0nn4 G1v3 Y0u Up'

Answer 2

There is also a go implementation on github at https://github.com/pcarrier/gauth

This one uses a config file ~/.config/gauth.csv to store the tokens in a the following format

[email protected]: abcd efg hijk lmno
aws-account: mygauthtoken

And the output is rather friendly too:

$ gauth
           prev   curr   next
AWS        315306 135387 483601
Airbnb     563728 339206 904549
Google     453564 477615 356846
Github     911264 548790 784099
[=======                      ]

Answer 3

There's many 3rd party Authenticator implementations. Check out the list on the wikipedia page. For instance, you may be able to use onetimepass (which is written in Python) for command line usage.

Answer 4

As far as I'm aware Google only releases the Authenticator application for phones (iOS, Android).
(This poses a problem for paranoid folks like me, who don't really trust Google's history of discontinuing services with little notice, and would prefer a token generator we can see inside of.)

You could consider other alternatives, like a one-time password pad system.

---

Honestly, getting the verification code from your laptop kind of defeats the two-factor authentication aspect (anyone who captures the laptop now has the code generator - that's part of what Authenticator is supposed to protect against).

Answer 5

You could try http://soundly.me/oathplus

This is a tool I developed on top of the venerable oathtool, that lets you read QR codes, and stash OTP account info for later use. You can think of it as Google Authenticator for the command-line, since it can download and read QR codes, and consume otpauth:// URIs. (OSX only atm.)

Answer 6

If you're using python there's packages available in pip with CLI frontends.

• https://pypi.org/project/authenticator/
• https://pypi.org/project/mfa/

Answer 7

Here is a hacky one: https://github.com/bjurga/DeOtp

It's a striped down GoogleAuthenticator with a nice "Windows integration" idea. The git project is very new and obviously requires cosmetics improvements but, it works fine so far.

Answer 8

A windows commandline gauth.exe is here https://github.com/moshahmed/gauth/
fork of https://github.com/pcarrier/gauth to compile on windows7.

$ cd ~/.ssh
$ cat gauth.mfa
    test,ABC

# Encrypt gauth.mfa to gauth.ssl
$ openssl enc -aes-128-cbc -md sha256 -in gauth.mfa -out gauth.ssl
    password=xxx
# Decrypt gauth.ssl and edit gauth.mfa
$ openssl enc -aes-128-cbc -md sha256 -d -in gauth.ssl -out gauth.mfa
    password=xxx

# Get the 2fa code
$ go run gauth.go [tes] [$HOME/.ssh/gauth.ssl]
|   pass:xxx
|   2FA    Name
|   129079 test
# Print qrcode.txt on console as scan able image
  $ pip install qrcode
  $ qr "otpauth://totp/Example:[email protected]?secret=XYZ&issuer=SOMEONE"
    [qrcode printed on Console]
# Convert text to png image, from https://github.com/miyako/console-qrencode
  $ waqrencode -t png -i mfa.txt -o mfa.png
# Convert qrcode.jpg image to string
  $ zbarimg qrcode.jpg