Skip to content

sshyp mfa

Jump to bottom
Randall Winkhart edited this page Jul 19, 2024 · 20 revisions

Installation:

sshyp-mfa is an experimental extension for sshyp v1.1.0+ that allows for generating totp/Steam otp keys for multi-factor authentication.

For most sshyp-supported platforms, sshyp extensions should be installed from the sshyp tweak menu's "extension management" option.

For Haiku and Termux ONLY, use the packages from the releases page.

Usage:

sshyp-mfa is fully dependent on your sshyp password manager entries. In order to add MFA data to an existing sshyp entry, run sshyp </entry name> edit -n and add MFA data to the SECOND notes line (the second line is used to avoid the copy function copying the MFA data from the first line). MFA data is read from the Authenticator backup format, e.g.:

otpauth://<OTP METHOD>/<ACCOUNT NAME, NOT USED>?secret=<SECRET>&issuer=<ISSUER, NOT USED>&algorithm=<ALGORITHM>&digits=<DIGITS>&period=<REFRESH PERIOD>

It might be easiest to import all of your MFA keys into Authenticator, export them into plain text, then add all of the exported MFA data into the second notes line in their respective sshyp entries.

To generate and start copying MFA keys to your clipboard, simply run sshyp /<entry name> copy -m.

Help! What do I put in each of those spaces?

<OTP METHOD> is almost always 'totp', but in the case of Steam, it needs to be set to 'steam'.

<ACCOUNT NAME, NOT USED> is a part of the Authenticator backup format, but it is not used in sshyp-mfa. Set to anything.

<SECRET> refers to the secret used to generate your MFA key. This is usually directly provided by the issuer, but it is sometimes hidden and more easily retrieved by copying it from a QR-compatible MFA app (such as Aegis).

<ISSUER, NOT USED> is a part of the Authenticator backup format, but it is not used in sshyp-mfa. Set to anything.

<ALGORITHM> refers to the algorithm used to generate your MFA key based on your secret. This is almost always 'sha1'.

<DIGITS> refers to the intended length of your MFA key. This is almost always '6', but in the case of Steam, it needs to be set to '5'.

<REFRESH PERIOD> refers to the interval at which a new MFA key needs to be generated. This is almost always '30', for 30 seconds.

Example configuration (for most services, see above for differences regarding Steam):

otpauth://totp/MyNameIsBob?secret=YUGBSG65SG9SDBSDF56SBFVSC86SBVD6&issuer=Github&algorithm=sha1&digits=6&period=30

Clone this wiki locally