pam_oath OATH_INVALID_DIGITS

Hello,

I've had two-factor authentication configured with liboath/pam_oath for my SSH server for almost two years.

For some time now, it hasn't been working. So I tried debugging it using a "su" command.

pam/su configuration:

# head /etc/pam.d/su
#
# The PAM configuration file for the Shadow \su' service #`

# TOTP
auth [success=done default=die] pam_oath.so usersfile=/etc/shadow.otp window=5 debug nolock

...

Secrets file:

HOTP/T30/6      thierry -       00

Error that appears when connecting via su:

# oathtool --totp 00
773466

# su - thierry
[../../pam_oath/pam_oath.c:parse_cfg(125)] called.
[../../pam_oath/pam_oath.c:parse_cfg(126)] flags 0 argc 4
[../../pam_oath/pam_oath.c:parse_cfg(128)] argv[0]=usersfile=/etc/shadow.otp
[../../pam_oath/pam_oath.c:parse_cfg(128)] argv[1]=window=5
[../../pam_oath/pam_oath.c:parse_cfg(128)] argv[2]=debug
[../../pam_oath/pam_oath.c:parse_cfg(128)] argv[3]=nolock
[../../pam_oath/pam_oath.c:parse_cfg(129)] debug=1
[../../pam_oath/pam_oath.c:parse_cfg(130)] alwaysok=0
[../../pam_oath/pam_oath.c:parse_cfg(131)] try_first_pass=0
[../../pam_oath/pam_oath.c:parse_cfg(132)] use_first_pass=0
[../../pam_oath/pam_oath.c:parse_cfg(133)] usersfile=/etc/shadow.otp
[../../pam_oath/pam_oath.c:parse_cfg(134)] digits=0
[../../pam_oath/pam_oath.c:parse_cfg(135)] window=5
[../../pam_oath/pam_oath.c:pam_sm_authenticate(295)] get user returned: thierry
[../../pam_oath/pam_oath.c:pam_sm_authenticate(303)] usersfile is /etc/shadow.otp (id 0/0)
[../../pam_oath/pam_oath.c:pam_sm_authenticate(332)] authenticate first pass rc -2 (OATH_INVALID_DIGITS: Unsupported number of OTP digits) last otp Sun Jul 24 16:17:36 3143459
One-time password (OATH) for \thierry': [../../pam_oath/pam_oath.c:pam_sm_authenticate(415)] conv returned: 773466 [../../pam_oath/pam_oath.c:pam_sm_authenticate(479)] OTP: 773466 [../../pam_oath/pam_oath.c:pam_sm_authenticate(487)] authenticate rc -15 (OATH_FILE_LOCK_ERROR: System error when locking file) last otp Sun Apr 25 17:10:25 4325886 [../../pam_oath/pam_oath.c:pam_sm_authenticate(494)] One-time password not authorized to login as user 'thierry' [../../pam_oath/pam_oath.c:pam_sm_authenticate(527)] done. [Authentication failure] su: Authentication failure`

As you can see, it says that 6 digits is not supported !?! and it refers to a last otp that is at a very strange date ...

For your information, I'm on Debian 12.13, AppArmor is disabled, and SELinux is disabled.

Does anyone have an explanation?

thanks for your help