Allan Saddi's projects blog

I just discovered a rather fatal bug introduced in 1.0.3 which leads to high CPU utilization when the web server closes transport connections. I only just discovered the issue tonight, when all of my ajp-wsgi instances went full bore and brought my server's load average to over 15. (Apparently, Apache decided it was a good time to reap stale AJP connections.)

Anyway, I'm kicking myself, since this problem was also seen in flup but was patched some time ago. Shows me not to make post-midnight releases, especially after such short testing cycles. Oh wait...

Tarball

I've been wanting to install some sort of two-factor authentication scheme on my server for a while now. There's Google Authenticator, but unfortunately, it appears to be written for Linux-PAM and is rife with Linuxisms. But all was not lost, however, as it lead me to OATH and its related specs, HOTP and TOTP authentication.

It turns out that HOTP/TOTP is relatively simple — solely based on HMAC-SHA1. Great, I thought. I just needed an HMAC implementation... and I also needed to learn how to write a PAM module (specifically, an OpenPAM module, which is what FreeBSD uses). And yes, I know that "PAM module" is technically redundant, no one needs to point that out.

So I studied RFC 4226, RFC 2104 and this useful article about OpenPAM. I've been doing that in my spare time for a few weeks now. It wasn't until this morning that I decided to start writing some code.

And in a few hours, I had HMAC-SHA1 (built on top of my SHA1 implementation... I wanted to avoid libcrypto to keep things lightweight), HOTP, and finally a working pam_totp. I went with TOTP-only for now as that's what I wanted and I didn't really fancy keeping state for each user (aside from their keys). (But as an aside, it looks like I'll need to keep state anyway if I want to avoid replay attacks and have some clock drift tracking.)

Anyway, what I have is in an extreme alpha state, but needless to say, I've already installed it into my sshd PAM auth chain. As for a token generator, I use a nice, free iOS app called OATH Token.

I won't bother releasing anything, as the intended audience is rather small (FreeBSD admins who want TOTP auth). Maybe I'll work on it more someday, add event-based HOTP support, develop it into a true pam_oath (which I couldn't find anywhere, strangely). But at least that itch has been scratched...

New version of ajp-wsgi released, with the following change:

• Handle socket reads more sanely, so things don't break with non-local connections. (ajp.c update)

ChangeLog
Tarball
HG repository (also here for ajp)