建立安全的VPN连接，不仅需要输入用户名和密码，还需要输入动态口令(token)。作为一个懒人，我更喜欢什么手工输入都不需要，既不需要输入password，也不需要输入token。也就是说，只需一个命令就能径直连接上VPN，那自然是极好滴。那么，懒人的愿望能实现吗？答案是肯定的！本文将基于FreeOTP 支持的TOTP(Time-based One-Time Password)算法，介绍如何利用Python代码自动获取动态口令(token)，进而利用Expect实现一个自动连接VPN的Bash脚本。
PyOTP是一套开源的函数库，可用来计算基于TOTP算法的Token。有关TOTP算法的细节，本文不做介绍，如有兴趣请参考这里。
1. 下载PyOTP
huanli@ThinkPadT460:tmp$ git clone https://github.com/pyotp/pyotp.git
Cloning into 'pyotp'...
remote: Counting objects: , done.
remote: Total (delta ), reused (delta ), pack-reused
Receiving objects: % (/), 165.02 KiB | 207.00 KiB/s, done.
Resolving deltas: % (/), done.
huanli@ThinkPadT460:tmp$
huanli@ThinkPadT460:tmp$ tree /tmp/pyotp/src
/tmp/pyotp/src
└── pyotp
├── compat.py
├── hotp.py
├── __init__.py
├── otp.py
├── totp.py
└── utils.py directory, files
huanli@ThinkPadT460:tmp$
2. 使用PyOTP
huanli@ThinkPadT460:tmp$ export PYTHONPATH=/tmp/pyotp/src:$PYTHONPATH
huanli@ThinkPadT460:tmp$ python
...<snip>...
>>> import base64
>>> import pyotp
>>> s = 'Hello World'
>>> secret = base64.b32encode(s)
>>> totp = pyotp.TOTP(secret)
>>> token = totp.now()
>>> print token
338462
>>>
由此可见，通过pyotp.TOTP()获取token非常容易。我们将调用到的核心代码实现如下：
# https://github.com/pyotp/pyotp/blob/master/src/pyotp/otp.py
..
10 class TOTP(OTP):
11 """
12 Handler for time-based OTP counters.
13 """
14 def __init__(self, *args, **kwargs):
15 """
16 :param interval: the time interval in seconds
17 for OTP. This defaults to 30.
18 :type interval: int
19 """
20 self.interval = kwargs.pop('interval', 30)
21 super(TOTP, self).__init__(*args, **kwargs)
..
37 def now(self):
38 """
39 Generate the current time OTP
40
41 :returns: OTP value
42 :rtype: str
43 """
44 return self.generate_otp(self.timecode(datetime.datetime.now()))
.. # https://github.com/pyotp/pyotp/blob/master/src/pyotp/otp.py
..
8 class OTP(object):
9 """
10 Base class for OTP handlers.
11 """
12 def __init__(self, s, digits=6, digest=hashlib.sha1):
13 """
14 :param s: secret in base32 format
15 :type s: str
16 :param digits: number of integers in the OTP. Some apps expect this to be 6 digits, others support more.
17 :type digits: int
18 :param digest: digest function to use in the HMAC (expected to be sha1)
19 :type digest: callable
20 """
21 self.digits = digits
22 self.digest = digest
23 self.secret = s
24
25 def generate_otp(self, input):
26 """
27 :param input: the HMAC counter value to use as the OTP input.
28 Usually either the counter, or the computed integer based on the Unix timestamp
29 :type input: int
30 """
31 if input < 0:
32 raise ValueError('input must be positive integer')
33 hasher = hmac.new(self.byte_secret(), self.int_to_bytestring(input), self.digest)
34 hmac_hash = bytearray(hasher.digest())
35 offset = hmac_hash[-1] & 0xf
36 code = ((hmac_hash[offset] & 0x7f) << 24 |
37 (hmac_hash[offset + 1] & 0xff) << 16 |
38 (hmac_hash[offset + 2] & 0xff) << 8 |
39 (hmac_hash[offset + 3] & 0xff))
40 str_code = str(code % 10 ** self.digits)
41 while len(str_code) < self.digits:
42 str_code = '' + str_code
43
44 return str_code
..
下面给出完整的Python脚本：
- vpn_token.py
#!/usr/bin/python
import sys
import datetime
import time def main(argc, argv):
if argc != 3:
sys.stderr.write("Usage: %s <token secret> <pyotp path>\n" % argv[0])
return 1 token_secret = argv[1]
pyotp_path = argv[2] sys.path.append(pyotp_path)
import pyotp
totp = pyotp.TOTP(token_secret) #
# The token is expected to be valid in 5 seconds,
# else sleep 5s and retry
#
while True:
tw = datetime.datetime.now() + datetime.timedelta(seconds=5)
token = totp.now()
if totp.verify(token, tw):
print "%s" % token
return 0
time.sleep(5) return 1 if __name__ == '__main__':
sys.exit(main(len(sys.argv), sys.argv))
- 来自Terminal的Token:
- 来自手机的Token:
由此可见，跟PyOTP计算出的Token码完全一致。于是，我们就可以利用Expect实现完全自动的VPN连接。例如： （注： 这里使用sexpect）
- autovpn.sh （完整的代码请戳这里）
#!/bin/bash function get_vpn_user
{
typeset user=${VPN_USER:-"$(id -un)"}
echo "$user"
return
} function get_vpn_password
{
typeset password=${VPN_PASSWORD:-"$(eval $($VPN_PASSWORD_HOOK))"}
echo "$password"
return
} function get_vpn_token
{
typeset f_py_cb=/tmp/.vpn_token.py
cat > $f_py_cb << EOF
#!/usr/bin/python
import sys
import datetime
import time def main(argc, argv):
if argc != :
sys.stderr.write("Usage: %s <token secret> <pyotp path>\\n" % argv[])
return token_secret = argv[]
pyotp_path = argv[] sys.path.append(pyotp_path)
import pyotp
totp = pyotp.TOTP(token_secret) #
# The token is expected to be valid in seconds,
# else sleep 5s and retry
#
while True:
tw = datetime.datetime.now() + datetime.timedelta(seconds=)
token = totp.now()
if totp.verify(token, tw):
print "%s" % token
return
time.sleep() return if __name__ == '__main__':
argv = sys.argv
argc = len(argv)
sys.exit(main(argc, argv))
EOF typeset pyotp_path=$VPN_PYOTP_PATH
typeset token_secret=$VPN_TOKEN_SECRET
if [[ -z $token_secret ]]; then
token_secret=$(eval $($VPN_TOKEN_SECRET_HOOK))
fi python $f_py_cb $token_secret $pyotp_path
typeset ret=$?
rm -f $f_py_cb
return $ret
} function get_vpn_conf
{
typeset conf=$VPN_CONF
echo "$conf"
return
} function check_sexpect
{
type sexpect >& | egrep 'not found' > /dev/null >&
(( $? != )) && return
return
} vpn_user=$(get_vpn_user)
(( $? != )) && exit
vpn_password=$(get_vpn_password)
(( $? != )) && exit
vpn_token=$(get_vpn_token)
(( $? != )) && exit
vpn_conf=$(get_vpn_conf)
(( $? != )) && exit check_sexpect || exit export SEXPECT_SOCKFILE=/tmp/sexpect-ssh-$$.sock
trap '{ sexpect close && sexpect wait; } > /dev/null 2>&1' EXIT sexpect spawn sudo openvpn --config $vpn_conf
sexpect set -timeout # XXX: 'set' should be invoked after server is running while :; do
sexpect expect -nocase -re "Username:|Password:"
ret=$?
if (( $ret == )); then
out=$(sexpect expect_out)
if [[ $out == *"Username:"* ]]; then
sexpect send -enter "$vpn_user"
elif [[ $out == *"Password:"* ]]; then
sexpect send -enter "$vpn_password$vpn_token"
break
else
echo "*** unknown catch: $out" >&
exit
fi
elif sexpect chkerr -errno $ret -is eof; then
sexpect wait
exit
elif sexpect chkerr -errno $ret -is timeout; then
sexpect close
sexpect wait
echo "*** timeout waiting for username/password prompt" >&
exit
else
echo "*** unknown error: $ret" >&
exit
fi
done sexpect interact
- 运行autovpn.sh
huanli@ThinkPadT460:~$ ./autovpn.sh
Sat Aug :: OpenVPN 2.4. x86_64-redhat-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Apr
Sat Aug :: library versions: OpenSSL 1.1.0h-fips Mar , LZO 2.08
Enter Auth Username: huanli
Enter Auth Password: ****************
Sat Aug :: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
...<snip>...
Sat Aug :: GID set to openvpn
Sat Aug :: UID set to openvpn
Sat Aug :: Initialization Sequence Completed