# $Header: /global/src/etc/cl-manage-scripts/patches/RCS/P-sshd_config-otpw,v 1.2 2016/10/30 08:41:13 pb22 Exp $
# patch-file matches = ChallengeResponseAuthentication.*yes
# Patch to allow (only) OTPW to use ChallengeResponseAuthentication (should NOT allow password auth)
# Uses a separate ssh daemon with its own binary (which selects the pam stack),
# config and banner files.
# Used iptables NAT to map port 22 to 225 sp that each sshd listens on its own
# port - so also requires iptables entry to allow port 225, and to detect brute
# force.
# Needs to have the daemon started by systemd, init, init.d or rc.local
#
# Process using /usr/bin/cl-patch-file unless matching the above
--- /etc/ssh/sshd5_config	2012-05-27 12:50:37.000000000 +0100
+++ /etc/ssh/sshd5_config	2013-09-22 09:42:44.000000000 +0100
@@ -48 +48,2 @@
-ChallengeResponseAuthentication no
+#1a cl.cam.ac.uk: OTPW needs CRA, so flip: ChallengeResponseAuthentication no
+ChallengeResponseAuthentication yes
