{"action":"created","issue":{"url":"https://api.github.com/repos/google/google-authenticator/issues/484","labels_url":"https://api.github.com/repos/google/google-authenticator/issues/484/labels{/name}","comments_url":"https://api.github.com/repos/google/google-authenticator/issues/484/comments","events_url":"https://api.github.com/repos/google/google-authenticator/issues/484/events","html_url":"https://github.com/google/google-authenticator/issues/484","id":60208158,"number":484,"title":"Insecure default location of the configfiles","user":{"login":"allo-","id":1482341,"avatar_url":"https://avatars.githubusercontent.com/u/1482341?v=3","gravatar_id":"","url":"https://api.github.com/users/allo-","html_url":"https://github.com/allo-","followers_url":"https://api.github.com/users/allo-/followers","following_url":"https://api.github.com/users/allo-/following{/other_user}","gists_url":"https://api.github.com/users/allo-/gists{/gist_id}","starred_url":"https://api.github.com/users/allo-/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/allo-/subscriptions","organizations_url":"https://api.github.com/users/allo-/orgs","repos_url":"https://api.github.com/users/allo-/repos","events_url":"https://api.github.com/users/allo-/events{/privacy}","received_events_url":"https://api.github.com/users/allo-/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/google/google-authenticator/labels/wontfix","name":"wontfix","color":"ffffff"}],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":12,"created_at":"2015-03-07T14:23:40Z","updated_at":"2015-03-09T18:15:14Z","closed_at":"2015-03-09T07:54:30Z","body":"The default location of the config in the user's home readable by the user is insecure for anything but local login and ssh.\r\n\r\nWhen an attacker has access (i.e. via ssh with public/private key), he can import the secret key in his token generator or remove the whole config, if the module is configured to allow logins without google-authenticator, when the config is missing.\r\n\r\nThe default location should be somewhere outside of the $HOME and the configuration tool should be setuid (root) to write the config. Updating or removing the config should only be possible with a valid authentication (usually password+authenticator-token) or at least a authenticator-token valid for the current configuration.\r\n\r\nExample config for login:\r\n\r\n```\r\nauth required pam_google_authenticator.so secret=/var/lib/google-authenticator/${USER} user=root\r\n```"},"comment":{"url":"https://api.github.com/repos/google/google-authenticator/issues/comments/77910459","html_url":"https://github.com/google/google-authenticator/issues/484#issuecomment-77910459","issue_url":"https://api.github.com/repos/google/google-authenticator/issues/484","id":77910459,"user":{"login":"allo-","id":1482341,"avatar_url":"https://avatars.githubusercontent.com/u/1482341?v=3","gravatar_id":"","url":"https://api.github.com/users/allo-","html_url":"https://github.com/allo-","followers_url":"https://api.github.com/users/allo-/followers","following_url":"https://api.github.com/users/allo-/following{/other_user}","gists_url":"https://api.github.com/users/allo-/gists{/gist_id}","starred_url":"https://api.github.com/users/allo-/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/allo-/subscriptions","organizations_url":"https://api.github.com/users/allo-/orgs","repos_url":"https://api.github.com/users/allo-/repos","events_url":"https://api.github.com/users/allo-/events{/privacy}","received_events_url":"https://api.github.com/users/allo-/received_events","type":"User","site_admin":false},"created_at":"2015-03-09T18:15:14Z","updated_at":"2015-03-09T18:15:14Z","body":"There are protocols, which can do this, but i think they require some challenge from the server to be entered on the client."}}