[Python学习笔记-003] 使用PyOTP获取基于OTOP算法的动态口令

[Python学习笔记-003] 使用PyOTP获取基于OTOP算法的动态口令

建立安全的VPN连接，不仅需要输入用户名和密码，还需要输入动态口令(token)。

作为一个懒人，我更喜欢什么手工输入都不需要，既不需要输入password，也不需要输入token。

也就是说，只需一个命令就能径直连接上VPN，那自然是极好滴。

那么，懒人的愿望能实现吗？答案是肯定的！本文将基于FreeOTP 支持的TOTP(Time-based One-Time Password)算法，介绍如何利用Python代码自动获取动态口令(token)，进而利用Expect实现一个自动连接VPN的Bash脚本。

PyOTP是一套开源的函数库，可用来计算基于TOTP算法的Token。

有关TOTP算法的细节，本文不做介绍，如有兴趣请参考这里。

1. 下载PyOTP

huanli@ThinkPadT460:tmp$ git clone https://github.com/pyotp/pyotp.git

Cloning into 'pyotp'...

remote: Counting objects: , done.

remote: Total  (delta ), reused  (delta ), pack-reused

Receiving objects: % (/), 165.02 KiB | 207.00 KiB/s, done.

Resolving deltas: % (/), done.

huanli@ThinkPadT460:tmp$

huanli@ThinkPadT460:tmp$ tree /tmp/pyotp/src

/tmp/pyotp/src

└── pyotp

    ├── compat.py

    ├── hotp.py

    ├── __init__.py

    ├── otp.py

    ├── totp.py

    └── utils.py

 directory,  files

huanli@ThinkPadT460:tmp$ 

2. 使用PyOTP

huanli@ThinkPadT460:tmp$ export PYTHONPATH=/tmp/pyotp/src:$PYTHONPATH

huanli@ThinkPadT460:tmp$ python

...<snip>...

>>> import base64

>>> import pyotp

>>> s = 'Hello World'

>>> secret = base64.b32encode(s)

>>> totp = pyotp.TOTP(secret)

>>> token = totp.now()

>>> print token

338462

>>>

由此可见，通过pyotp.TOTP()获取token非常容易。

我们将调用到的核心代码实现如下：

# https://github.com/pyotp/pyotp/blob/master/src/pyotp/otp.py

    ..

    10  class TOTP(OTP):

    11      """

    12      Handler for time-based OTP counters.

    13      """

    14      def __init__(self, *args, **kwargs):

    15          """

    16          :param interval: the time interval in seconds

    17              for OTP. This defaults to 30.

    18          :type interval: int

    19          """

    20          self.interval = kwargs.pop('interval', 30)

    21          super(TOTP, self).__init__(*args, **kwargs)

    ..

    37      def now(self):

    38          """

    39          Generate the current time OTP

    40

    41          :returns: OTP value

    42          :rtype: str

    43          """

    44          return self.generate_otp(self.timecode(datetime.datetime.now()))

    ..

# https://github.com/pyotp/pyotp/blob/master/src/pyotp/otp.py

    ..

     8  class OTP(object):

     9      """

    10      Base class for OTP handlers.

    11      """

    12      def __init__(self, s, digits=6, digest=hashlib.sha1):

    13          """

    14          :param s: secret in base32 format

    15          :type s: str

    16          :param digits: number of integers in the OTP. Some apps expect this to be 6 digits, others support more.

    17          :type digits: int

    18          :param digest: digest function to use in the HMAC (expected to be sha1)

    19          :type digest: callable

    20          """

    21          self.digits = digits

    22          self.digest = digest

    23          self.secret = s

    24

    25      def generate_otp(self, input):

    26          """

    27          :param input: the HMAC counter value to use as the OTP input.

    28              Usually either the counter, or the computed integer based on the Unix timestamp

    29          :type input: int

    30          """

    31          if input < 0:

    32              raise ValueError('input must be positive integer')

    33          hasher = hmac.new(self.byte_secret(), self.int_to_bytestring(input), self.digest)

    34          hmac_hash = bytearray(hasher.digest())

    35          offset = hmac_hash[-1] & 0xf

    36          code = ((hmac_hash[offset] & 0x7f) << 24 |

    37                  (hmac_hash[offset + 1] & 0xff) << 16 |

    38                  (hmac_hash[offset + 2] & 0xff) << 8 |

    39                  (hmac_hash[offset + 3] & 0xff))

    40          str_code = str(code % 10 ** self.digits)

    41          while len(str_code) < self.digits:

    42              str_code = '' + str_code

    43

    44          return str_code

    ..

下面给出完整的Python脚本：

• vpn_token.py

 #!/usr/bin/python

 import sys

 import datetime

 import time

 def main(argc, argv):

     if argc != 3:

         sys.stderr.write("Usage: %s <token secret> <pyotp path>\n" % argv[0])

         return 1

     token_secret = argv[1]

     pyotp_path = argv[2]

     sys.path.append(pyotp_path)

     import pyotp

     totp = pyotp.TOTP(token_secret)

     #

     # The token is expected to be valid in 5 seconds,

     # else sleep 5s and retry

     #

     while True:

         tw = datetime.datetime.now() + datetime.timedelta(seconds=5)

         token = totp.now()

         if totp.verify(token, tw):

             print "%s" % token

             return 0

         time.sleep(5)

     return 1

 if __name__ == '__main__':

     sys.exit(main(len(sys.argv), sys.argv))

• 来自Terminal的Token:

• 来自手机的Token:

由此可见，跟PyOTP计算出的Token码完全一致。

于是，我们就可以利用Expect实现完全自动的VPN连接。

例如： （注： 这里使用sexpect）

• autovpn.sh （完整的代码请戳这里）

 #!/bin/bash

 function get_vpn_user

 {

         typeset user=${VPN_USER:-"$(id -un)"}

         echo "$user"

         return

 }

 function get_vpn_password

 {

         typeset password=${VPN_PASSWORD:-"$(eval $($VPN_PASSWORD_HOOK))"}

         echo "$password"

         return

 }

 function get_vpn_token

 {

         typeset f_py_cb=/tmp/.vpn_token.py

         cat > $f_py_cb << EOF

 #!/usr/bin/python

 import sys

 import datetime

 import time

 def main(argc, argv):

     if argc != :

         sys.stderr.write("Usage: %s <token secret> <pyotp path>\\n" % argv[])

         return 

     token_secret = argv[]

     pyotp_path = argv[]

     sys.path.append(pyotp_path)

     import pyotp

     totp = pyotp.TOTP(token_secret)

     #

     # The token is expected to be valid in  seconds,

     # else sleep 5s and retry

     #

     while True:

         tw = datetime.datetime.now() + datetime.timedelta(seconds=)

         token = totp.now()

         if totp.verify(token, tw):

             print "%s" % token

             return

         time.sleep()

     return 

 if __name__ == '__main__':

     argv = sys.argv

     argc = len(argv)

     sys.exit(main(argc, argv))

 EOF

         typeset pyotp_path=$VPN_PYOTP_PATH

         typeset token_secret=$VPN_TOKEN_SECRET

         if [[ -z $token_secret ]]; then

                 token_secret=$(eval $($VPN_TOKEN_SECRET_HOOK))

         fi

         python $f_py_cb $token_secret $pyotp_path

         typeset ret=$?

         rm -f $f_py_cb

         return $ret

 }

 function get_vpn_conf

 {

         typeset conf=$VPN_CONF

         echo "$conf"

         return

 }

 function check_sexpect

 {

         type sexpect >& | egrep 'not found' > /dev/null >&

         (( $? !=  )) && return

         return

 }

 vpn_user=$(get_vpn_user)

 (( $? !=  )) && exit

 vpn_password=$(get_vpn_password)

 (( $? !=  )) && exit

 vpn_token=$(get_vpn_token)

 (( $? !=  )) && exit

 vpn_conf=$(get_vpn_conf)

 (( $? !=  )) && exit 

 check_sexpect || exit 

 export SEXPECT_SOCKFILE=/tmp/sexpect-ssh-$$.sock

 trap '{ sexpect close && sexpect wait; } > /dev/null 2>&1' EXIT

 sexpect spawn sudo openvpn --config $vpn_conf

 sexpect set -timeout  # XXX: 'set' should be invoked after server is running

 while :; do

         sexpect expect -nocase -re "Username:|Password:"

         ret=$?

         if (( $ret ==  )); then

                 out=$(sexpect expect_out)

                 if [[ $out == *"Username:"* ]]; then

                         sexpect send -enter "$vpn_user"

                 elif [[ $out == *"Password:"* ]]; then

                         sexpect send -enter "$vpn_password$vpn_token"

                         break

                 else

                         echo "*** unknown catch: $out" >&

                         exit

                 fi

         elif sexpect chkerr -errno $ret -is eof; then

                 sexpect wait

                 exit

         elif sexpect chkerr -errno $ret -is timeout; then

                 sexpect close

                 sexpect wait

                 echo "*** timeout waiting for username/password prompt" >&

                 exit

         else

                 echo "*** unknown error: $ret" >&

                 exit

         fi

 done

 sexpect interact

• 运行autovpn.sh

huanli@ThinkPadT460:~$ ./autovpn.sh

Sat Aug  ::  OpenVPN 2.4. x86_64-redhat-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Apr

Sat Aug  ::  library versions: OpenSSL 1.1.0h-fips   Mar , LZO 2.08

Enter Auth Username: huanli

Enter Auth Password: ****************

Sat Aug  ::  NOTE: the current --script-security setting may allow this configuration to call user-defined scripts

...<snip>...

Sat Aug  ::  GID set to openvpn

Sat Aug  ::  UID set to openvpn

Sat Aug  ::  Initialization Sequence Completed