Separate configuration from living data in the PAM module

[ThomasHabets]

Original issue 167 created by raphink on 2012-04-21T09:02:48.000Z:

Currently, the PAM module relies on one file per user: ~/.google_authenticator.

While this is simple, it mixes the configuration and living data in one file. The problem I have is when deploying this file on machines automatically: the file I deploy is a configuration file, containing the secret key, parameters and scratch codes available.

If for example I use one of the scratch codes, the file gets modified, but the configuration manager (puppet for example) will replace it with the same scratch codes next time it runs.

Ideally, the PAM module would use two files:

• One for static configuration (secret key, parameters, scratch codes);
• One for living data (used scratch codes, timestamps for rate limit, etc.).

[ThomasHabets]

This issue was moved to google/google-authenticator-libpam#35