Mobile

A few days ago my GPS melted...

Well... Yesterday evening I got my new GPS! Ahum... I'll be honest, I ditched my old E61i and got myself an E71 with an internal GPS and I LIKE IT !!!!111!!

Teh E71:

*clickable*

If you are a subscriber to my blog you probably know I'm not an iPhone fan, and if you didn't know this, you can still read it here.

While reading my rss feeds this morning I 'stumbled upon' a blog post from Tarek Esber, a guy who recently bought an iPhone but wants to go back to S60, and he gives us 9 reasons to do so...

Pretty funny that 2 of his reasons where in my post. Can't say I didn't warn you :-)

As I was reading my rss feeds I discovered one time password logins via ssh. I read it in a post on Philip's Blog. I found it interesting so decided to try this on a virtual machine as a test. Although it wasn't as simple as Philip's post, it was rather simple. But to help out you guys trying to configure and use it here are my findings:

As this is a rather long post I'm going to use a break for this one time (sorry rssfeed readers! I forgot but I noticed my feed feeds entire blog posts, and not just the part before the break. Good!).

First, I installed opie-server, this is as simple as:

# apt-get install opie-server

Then, to make sure when you login through SSH, the pam_opie module is used, I had to edit /etc/pam.d/sshd as follows:

[...]

# Standard Un*x authentication.
#@include common-auth
auth    sufficient      pam_opie.so
auth    sufficient      pam_unix.so nullok_secure
auth    require         pam_deny.so

[...]

If you do it this way you will still be able to login with your normal password when te OTP(One Time Password) login fails. This may be handy when you have no possibility of calculating the appropriate response to the OTP challenge. If you do not like this behaviour and you want you or your users to be able to authenticate with OTP only you can comment out the pam_unix.so line:

[...]

#auth    sufficient      pam_unix.so nullok_secure

[...]

As after this it was still not working I looked into the /etc/ssh/sshd_config file and found that there was one option that needed to be enabled to make sure that the ssh server knows you will be using challenge response authentication. Edit /etc/ssh/sshd_config:

[...]

ChallengeResponseAuthentication yes

[...]

As a final step restart your ssh server:

/etc/init.d/ssh restart

As of here we can follow the simple step that Philip gave us in his blog post

:

$ opiepasswd -c
Adding bert:
Only use this method from the console; NEVER from remote. If you are using
telnet, xterm, or a dial-in, type ^C now or exit with no password.
Then run opiepasswd without the -c parameter.
Using MD5 to compute responses.
Enter new secret pass phrase:
Again new secret pass phrase:

ID bert OTP key is 499 mi7400
RIDE LUSH VIE YE BARD LOSE

When issuing opiepasswd -c you will be asked to enter a secret pass phrase, you will have to be able to remember this, but it should be very secret(not like your birthday or something like that).

When we look at the following output:

ID bert OTP key is 499 mi7400
RIDE LUSH VIE YE BARD LOSE

• 'bert' is your unix username, and your OTP ID
• '499' is the sequence (this will count downwards every time a password has been used
  An already used password will be discarded and not usable anymore, hence OTP(One TIme Password) :-)
• 'mi7400' is the challenge string
• 'RIDE LUSH VIE YE BARD LOSE' is the password for this sequence (499) !! spaces included

Now, when ssh'ing to the system, and you have no private key file (because this will still work) you will be prompted the following:

$ ssh bert@minerva
otp-md5 498 mi7400 ext, Response:

On a system where opie-client is installed you can calculate the appropriate response:

$ opiekey 498 mi7400
Using the MD5 algorithm to compute response.
Reminder: Don't use opiekey from telnet or dial-in sessions.
Sorry, but you don't seem to be on the console or a secure terminal.
Warning: Continuing could disclose your secret pass phrase to an attacker!
Enter secret pass phrase:
WACK WAIT ALMA HERO WAR KIN

And use this password 'WACK WAIT ALMA HERO WAR KIN' to log in.

Now offcourse the thing about this is that when you got your favorite machine with you (e.g. laptop) you do have your private keys. So there's no need for OTP. And when you need it (e.g. a public computer) you are not always (read: seldom) privileged to install an opie-client to calculate your response. Offcourse you can find online calculators but do you trust them with your passphrase?

Luckely there's a nice solution for this problem:

http://code.google.com/p/j2me-otp/

Thanks to "Marcin Gryszkalis" who posted this comment on Philip's blog post.

This is a java application, so it should work on almost any modern cellphone. I tried this on my Nokia E61i and it works like a charm. (And offcourse, you do always have your cellphone with you!).

A screenshot of the calculator in action:

The only thing I could say about this application is that they chose to call the passphrase "Password" which might be a bit confusing.

So, if you are a bit paranoid, or you just require a very secure authentication mechanism, this works like a charm, is not too difficult to setup and provides you with a handy mobile solution!

Watch out for July 11!

Prices:

• 8GB model 525€
• 16GB model 615€

Great! Remember the iphone 3g, stay away post?

Well having to pay 525€/615€ for a phone that sucks that much? Wicked...

This probably won't keep the fanboys from buying it :-) but seriously: come on samsung/android/htc/... give this new microsoft some competition!!

I just couldn't resist.

Have a look at the following ZDNET post:

http://www.zdnet.com.au/news/software/soa/Photos-iPhone-running-Windows-XP/0,130061733,339289801,00.htm?omnRef=1337

Ok, I must say, it is newsworthy. It's more or less a "breakthrough". I realise we have had mobile remote desktop solutions before (VNCsea for iPhone, and others). But this Citrix client is more then just a "remote desktop client". Because it doesn't just connect to a server running a certain OS. No, it connects to a server running more than 1 virtual instance of (perhaps multiple) operating system(s). So it is quite nice what Citrix achieved.

But, I must say: ZDNET: get your facts straight and do not try to deceive the reader in thinking that there was actually a windows XP running on the iPhone, because it was not! It was running as a virtual instance on a remote server. So at all time, to be able to use(not run) windows XP on your iPhone, you should have a wifi connection available. (I'm guessing that it would be just a bit to slow over a 3G connection...)

Or: Are them ZDNET editors just not capable of thinking straight?

Just my 2 cents ...