freeradius oath

etcfreeradiusmodulesoath

# -*- text -*-
#
#  $Id$

# Compares the a token generated with a token seed with the User-Password (TOTP)

exec oath {
        # wait for the program
        wait = yes

        # Compares the token with User-Password
        program = "/usr/bin/oath_radius --time-step-size=60 --totp %{control:OTP-Token}"

        input_pairs = request

        output_pairs = control

        shell_escape = yes

}

etcfreeradiussites-enableddefault

# ...
        update control {
                Cleartext-Password := "%{oath:/usr/bin/oath_radius --time-step-size=60s --totp <TOKEN>}"
        }
# ...

radiusd.conf

# ...
# look for instantiate
instantiate {
        exec
        oath
# ...

usrbinoath_radius

#!/bin/sh
env oathtool "$@" 2>/dev/null | tr -d '\n'
exit