TFA with OATH Hardware Token

[Matthias Mayr]

Hello Proxmox Community,

I tried using TFA with andOTP and it works just fine.

But I want to use a hardware token. So I ordered one with the matching OATH specifications. running oathtool in the shell of my pve-host works just fine:

oathtool --totp --digits 6 -s 30 -w 2 -b 'DVA??????????????????????????TP3'
886667
677723
940529

The questionmarks are not really questionmarks but are used to protect my seed

The numbers that are generated are working perfectly fine and DO match the numbers shown on the token.

Here comes the Problem:
The Input field in the TFA GUI is to short. If I try to enter my seed, I allways get a message, that the regex does not match an I cannot submit the form.
Trieing to manipulate /etc/pve/user.cfg (PAM user) does not work either.
I could not test with the pve-auth provider as I could not figure out how to inject the seed for such a user.

Is there a possibility to get my seed correctly into PVE?
Preferably via GUI, but if neccessarry I also can do it via bash.

Thank you very much in advance
Matthias

 

[t.lamprecht]

Hmm, it seems that the secret value the API accepts is really to strict in general.. So it's a bug, can you please open a report
at https://bugzilla.proxmox.com/ ? Short summary and linking to this thread would be enough, thanks!

 

[Matthias Mayr]

Thank you for your quick response. I just did as you proposed and hope there will be a Fix and/or a Workaround soon

 

[Matthias Mayr]

Just wanted to provide Feedback in case anyone else want's to try this.

Works fine now, with the current PVE 6 Version, thanks for the quick fix

In case anyone want's to do a similar setup, the token I used is a Feitan OTP c200 with SHA1 Hash, 30 Second timeout and, of course 6 digit number.