multiOTP Enterprise
===================
multiOTP Enterprise is a strong two-factor authentication device
multiOTP Enterprise is based on the OATH certified Pro edition
multiOTP Enterprise includes additional features like master-slave HA and REST API

(c) 2010-2026 SysCo systemes de communication sa
https://www.multiOTP.com/

Current build: 5.10.4.2 (2026-10-31)

Table of contents
 * What's new in this release
 * Change Log of released versions
 * Yubikey tokens provisioning file format
 * What is the prefix pin option ?
 * How does account lockout work ?
 * How to self-unlock an account ?
 * Free multiOTP Credential Provider
 * Free multiOTP token app
 * Self-registration of hardware tokens
 * Same windows generic account with multiple two-factor authentication accounts 
 * Using multiotp on linux for ssh login
 * Raspberry Pi multiOTP Enterprise distribution
 * Other projects used by multiOTP Enterprise


WHAT'S NEW IN THIS 5.10.x RELEASE
================================
- New Proxmox, OVA and Hyper-V appliances available (version 013-07, based on Debian 13)
- Easy new appliance update for any current appliance whith active maintenance support:
  - update the current appliance to the last available version
  - make a config backup with a password
  - install a new appliance
  - restore the config backup with the password
  - licences are automatically transferred to the new virtual appliance (Internet access needed)
  - contact us if the new appliance cannot have an Internet access for the first activation
- Free (and open source) multiOTP token app companion, proposed by default in the provisioning template
- New web interface preview available for the status page and the log page
- Push support available for free with Enterprise subscription, using the multiOTP token app
- YubiKey import now also supports the ‘Yubico CSV’ format
- Enhanced appliance console


CHANGE LOG OF RELEASED VERSIONS
===============================
2026-10-31 5.10.4.2 FIX: New virtual appliance 013-07 (kernel 6.12.113) with PHP2Shell and CVE-2026-98432 fixes
                    ENH: Added minimal virtual appliance version to address security issues
                    ENH: Modified backup/restore process to migrate and automatically reactivate the appliance licenses
                    ENH: Added additional features to the new web beta interface
                    ENH: Allowed license code 0000-0000-0000-0000-0000 to test the license addition process
2026-04-04 5.10.2.3 ENH: Import of "Yubico CSV" use now public ID as serial number, as for traditional format
2026-04-03 5.10.2.2 FIX: Hardware token import was not always working correctly for 013 appliances
                    ENH: New options in the console menu
                    ENH: Yubikey import now also accept "Yubico CSV" format
2026-03-23 5.10.2.1 FIX: Changing notification options (SMTP server and SysLog options) was not always possible
                    FIX: SMSEagle v2 implementation was not always able to send to international countries
                    ENH: Better network setup handling
                    ENH: Template updated to propose the free "multiOTP token app" by default for Android and iOS
2026-01-05 5.10.1.2 FIX: Locked and delayed status handled before push status
2025-12-18 5.10.0.7 ENH: New web interface preview available for the status page and the log page
                    ENH: New options: "don't auto disable" and "don't auto enable" LDAP accounts
                    ENH: New SMSEagle v2 API support
                    ENH: New QRcode enrollment for mOTP, compatible with the free multiOTP token app
                    ENH: Cleaned logs for unnecessary information
                    ENH: New download page for the multiOTP family
                    ENH: New multiOTP token app
2025-11-04 5.10.0.4 ENH: Option to disable sending radius groups for a specific device
                    ENH: Option to disable automatic activation/deactivation of user during LDAP synchronisation
2025-10-31 5.10.0.1 ENH: New Proxmox, OVA and Hyper-V appliances available (version 013, based on Debian 13)
                    ENH: Initial Push support with the multiOTP token app, available for free with Enterprise subscription
                    ENH: multiOTP Credential Provider enhanced support
2025-01-20 5.9.9.1 FIX: Case sensitive issue has been fixed with MSCHAPv2 authentication (thanks Alexey)
                   ENH: Created users are trimmed to avoid bad space prefix/suffix during copy/paste
                   ENH: multiOTP Credential Provider enhanced support
                   INF: This is the last available version for old appliances (010 and older)
2025-01-10 5.9.8.3 FIX: {MultiotpUserDisplayName} tag usage in templates (was not replaced in the QRcode)
                   ENH: New Message-Authenticator requirement support for FortiGate v7.2.10+, v7.4.5+ and v7.6.1+
2024-08-26 5.9.8.0 ENH: Spryng SMS provider support
                   ENH: Device with description containing "Fortinet" will send two additional RADIUS attributes
                        (ATTRIBUTE Fortinet-Group-Name 1 string, ATTRIBUTE Fortinet-Access-Profile 6 string)
                   ENH: Device with description containing "ZyXEL" will send one additional RADIUS attribute
                        (ATTRIBUTE User-type 1 string admin/limited-admin/user/guest)
2024-05-03 5.9.7.2 FIX: without2fa token can be now correctly converted to TOTP with default 30 seconds time interval
                   FIX: Without2fa tokens with prefix pin where not working with CHAP/MSCHAP/MSCHAPv2
2023-11-23 5.9.7.0 ENH: New Raspberry Pi distribution binary (for Enteprise appliance only)
                   ENH: Upgrade of internal tools
2023-10-12 5.9.6.9 FIX: Dashboard new firmware information is available again
2023-09-22 5.9.6.7 ENH: Without2FA tokens cannot be used for multi_account connection
2023-08-09 5.9.6.6 FIX: Prefix PIN information was sometimes missing on the provisioning info
                   ENH: New Raspberry Pi distribution binary (for Enterprise appliance only)
2023-07-07 5.9.6.5 FIX: Better Raspberry Pi support
2023-05-10 5.9.6.1 FIX: Template updated to display correct information for "Without2FA" tokens
                   FIX: Enhanced backup process, some configuration may be missing in the backup depending the initial firmware version
                   ENH: Template updated to print bigger QRcode for "MOTP-XML" tokens
                   ENH: Adding on-premises smsgateway (https://github.com/multiOTP/SMSGateway) as a new SMS provider
                   ENH: Better warning messages when ADP/LDAP password failed
2023-01-19 5.9.5.5 FIX: Challenge/response RADIUS was not always working correctly since version 5.9.3.1
2022-11-11 5.9.5.0 ENH: It's now possible to define a special AD/LDAP group to attribute "Without2FA" token to specific users
2022-11-04 5.9.4.0 ENH: Enhanced multiOTP Credential Provider (for Windows)
2022-10-21 5.9.3.1 FIX: Better special characters support in username and password
                   FIX: Better special characters support for RADIUS secret
                   ENH: The locked accounts list now also list the temporary delayed accounts
                   ENH: Accounts with Without2FA tokens can now also be stored in cache
2022-08-10 5.9.2.1 ENH: Enhanced Without2FA support, bypassing the 2FA in Credential Provider (for Windows)
2022-06-17 5.9.1.0 FIX: Scratch list was empty in some cases
                   ENH: Enhanced multiOTP Credential Provider (for Windows)
2022-05-26 5.9.0.3 FIX: User account containing octal encoded ISO characters are now also converted to UTF
                   FIX: {MultiOtpVersion} is now correctly replaced in scratchtemplate.html
                   ENH: {MultiotpUserDisplayName} tag (AD/LDAP DisplayName) can be used in templates
2022-05-18 5.9.0.0 FIX: User account containing special ISO characters are now also converted to UTF
                   ENH: New Hyper-V and OVA appliances available (version 011, based on Debian 11)
                   ENH: {MultiotpUserAccount} tag  can be used in templates
2022-04-28 5.8.7.0 ENH: Enhanced log information for refused connection
                   ENH: Code cleaning to support next appliance release
2022-04-14 5.8.6.1 FIX: Token "Without2FA" where not working all time with LDAP users
                   ENH: Telnyx SMS provider support
                   ENH: AD/LDAP synced user with "Without2FA" token don't need any licence
                   ENH: Email token is now supported for multiOTP Credential Provider (for Windows)
                   ENH: multiOTP Credential Provider: if username doesn't exist, the domain name is shortened step by step
2022-02-10 5.8.5.5 FIX: Upgrade process issue
2022-01-20 5.8.5.2 FIX: Device defined with 0.0.0.0/0 is now supported for multiOTP Credential Provider connection
                   FIX: Better mail server compatibility
2022-01-14 5.8.5.1 ENH: Enhanced multiOTP Credential Provider support
                   ENH: New Hyper-V file with full VM distribution
2021-11-18 5.8.3.2 ENH: Enhanced multiOTP Credential Provider support
2021-09-14 5.8.3.0 ENH: New OVA file with full VM distribution
                   ENH: Removed multicast support on the network card
2021-08-19 5.8.2.9 ENH: Added compatibility with new multiOTP Credential Provider (5.8.2 and further)
                   ENH: Additional log messages
2021-04-08 5.8.2.1 ENH: eDirectory LDAP server support
2021-03-25 5.8.1.9 FIX: Cookie privacy (httponly and secure) backported to previous virtual appliances
                   ENH: Weak SSL ciphers disabled
2021-03-21 5.8.1.2 ENH: Up to 7 days log entries available in the embedded log viewer
                   ENH: Storage free space information on dashboard
2021-03-14 5.8.1.1 FIX: In some cases, the HOTP/TOTP was not well computed
2021-02-12 5.8.1.0 FIX: Better unicode handling
                   ENH: Flexible licence support with demo licences
2020-12-11 5.8.0.6 FIX: Backend database optimization
2020-11-16 5.8.0.4 FIX: Cleaning orphans users on slave devices
2020-09-20 5.8.0.2 ENH: New Sync Delete Retention Days option in order to purge
                        inexistent AD/LDAP users (default retention value : 30 days)
2020-08-31 5.8.0.0 FIX: Clean automatically the log before the last 100 days
                   FIX: Too many ReadConfigData loop during initialization
                   FIX: Backend configuration access optimized
                   FIX: Better unicode handling
                   ENH: Cookies with HTTPOnly and Secure flag
                   ENH: Raspberry Pi 4B support
                   ENH: Smaller size for binary firmware files
                   ENH: Better custom Fortinet / ZyXEL support
2019-10-23 5.6.1.4 FIX: HA Configuration storage and synchronization
                   ENH: Generic web based SMS provider support
2019-10-22 5.6.1.3 ENH: Out of sync detection with specific error message
                   ENH: New 64 bits OVA file with full VM distribution
                   ENH: Enhanced custom SMS providers support
                   ENH: Active support date on dashboard
2019-07-17 5.5.0.1 FIX: Devices submask calculation error
2019-03-25 5.4.1.8 ENH: Enhanced error messages, more log information
                   ENH: New QRcode library
                   ENH: Added specific vendor device expert setup
2019-01-18 5.4.1.6 FIX: Update process for previous VM distribution
2019-01-18 5.4.1.5 ENH: New OVA file with full VM distribution
2019-01-18 5.4.1.4 FIX: Better IP address change handling
                   ENH: If any, clean specific NTP DHCP option at every reboot
2019-01-07 5.4.1.1 FIX: Fix some without2FA algorithm issues
                   FIX: Enhanced AD/LDAP process for Enterprise Edition
                   FIX: Fix some RADIUS challenge/response issues
                   ENH: Additional web based SMS providers support
                        (Swisscom LA REST, Afilnet, Clickatell2, eCall, Nexmo, NowSMS, SMSEagle)
                   ENH: New binary images available (version 008) for Raspberry Pi and Virtual Appliances
                   ENH: Official Raspberry Pi 3B+ support
                   ENH: Optimized size for Raspberry Pi binary image
                   ENH: Better information on the dashboard
2018-08-22 5.3.0.1 FIX: On master side, re-create a clean displayable list of slave devices each time a device is updated
                   FIX: Additional information and refresh rate in the CLI console
                   FIX: The Master mode was always displayed as disabled the first time the System tab is displayed
                   FIX: Additional users licence is now better synchronized with slave(s)
                   ENH: Multiple semicolon separated "Users DN" now supported for AD/LDAP synchronization
                   ENH: Additional info on both master and slave sides during synchronization process
2018-07-16 5.2.0.2 ENH: Active Directory nested groups support
                        (user1 in groupA, groupA in groupB, setting the OTP groups to "groupB" will add user1)
                   ENH: Enhanced AD/LDAP support for huge Microsoft Active Directory (much faster)
                   ENH: "Base DN" and "Users DN" are now two different parameters ("Users DN" is optional)
2018-01-03 5.1.0.1 FIX: A user is sometime created automatically (AD/LDAP sync) with a leading backslash
                   ENH: Algorithm selection for automatic AD/LDAP creation
                   ENH: Expired AD/LDAP password support
                   ENH: multiOTP Credential Provider (for Windows) improvements
                        (login@domain.name UPN support, default domain name supported and displayed, SMS request link)
2017-10-24 5.0.5.4 FIX: Depending of the configuration and the AD/LDAP cache feature, empty prefix AD/LDAP password may be accepted
2017-09-29 5.0.5.3 ENH: The proposed mOTP generator for Android/iOS is now OTP Authenticator
                        New QRCode provisioning format for mOTP (compatible with OTP Authenticator)
2017-09-08 5.0.5.0 FIX: Fixed too much detailed information in the log when trying
                        to detect a token serial number for self-registration
2017-05-16 5.0.4.4 ENH: VM plateform version displayed on the console
2017-05-12 5.0.4.3 ENH: Web GUI enhanced performance for the hardware device edition
2017-05-11 5.0.4.2 FIX: PDF provisioning pages were not generated through Web API for VM plateform version 005
2017-05-10 5.0.4.1 FIX: PDF provisioning pages were not always generated
2017-05-10 5.0.4.0 FIX: A user cannot be created anymore with a leading backslash
                   ENH: Additional Web API function GetAccountProvisioningPdf
                   ENH: Additional Web API function MasterSlaveFullResync
                   ENH: Additional Web API function GetAccountInfo
                   ENH: Web API function DisableAccount replaces the DesactivateAccount
                   ENH: A replay during 60 seconds of the previous refused password is rejected,
                        but the error counter is not incremented
                   ENH: Group names are now always trimed to avoid blank spaces
                   ENH: Slave synchronisation can now be done with or without system configuration
                   ENH: Additional authentication options parameters for fine tuning
2017-01-26 5.0.3.4 FIX: Better Eastern European languages support
                   ENH: UTC added in the list of time zones
                   ENH: Huge AD/LDAP synchronization optimization
                   ENH: Optimized Raspberry Pi binary image available on demand for any Enterprise appliance customer
                   ENH: In the template, the proposed TOTP/HOTP generator for Android/iOS is now FreeOTP Authenticator
                   ENH: New "Local admin account" attribute for any user, which allows to log-in as
                        an admin, using their username and their prefix (if any) and OTP password.
                   ENH: An invalid login attempt on the console will sent an alert to the Admin contact (if defined)
                   ENH: Multiple purpose tokens provisioning format PSKCV10,
                        like Gemalto e3050cL and t1050 tokens, is now supported.
                   ENH: SOAP service available (compatible with OpenOTP SOAP service)
                   ENH: Multiple groups per user can be enabled (not all devices support multiple groups)
                   ENH: Using AD/LDAP password instead of PIN code can be overwritten or not for all synchronized users
2016-11-14 5.0.3.0 FIX: New customized templates were not always used or synchronized by the system
                   ENH: Syslog process improved
                   ENH: Log messages better categorized and ordered
                   ENH: RC4 removed from available SSL ciphers
2016-11-04 5.0.2.6 ENH: Process optimization for high volume AD/LDAP synchronization with enabled HA
                   ENH: External packages update
2016-10-16 5.0.2.5 ENH: Performance optimization
2016-10-03 5.0.2.3 FIX: SSL connection was not working well due to security upgrade
2016-10-03 5.0.2.2 FIX: Fix some configuration backup/restore issue
                   ENH: Accounts can now be created based on other record than the UserId (like the Mail attribute)
                   ENH: Additional Web API functions
                   ENH: Easier master/slave handling
                   ENH: Automated licence sharing between the master and the slave appliance
2016-08-06 5.0.1.5 FIX: Better enhanced characters support in customized templates
                   ENH: Better restore handling from the Pro edition
                   ENH: A try on the previous password is rejected, but the error counter is not incremented
                   ENH: It's now possible to check an account from the dashboard
2016-08-02 5.0.1.4 FIX: SSL AD/LDAP connection was not always working with Windows 2008R2
2016-07-29 5.0.1.3 FIX: Special AD/LDAP chars support enhanced (as described in RFC4515)
                   ENH: Documented Web API to automate various tasks
                   ENH: Unified configuration backup and restore format for all editions
                   ENH: User documents language can be based on the user preferred language (synced with AD/LDAP)
                   ENH: Simplified HA (master-slave) configuration process
2016-05-03 4.3.4.0 First internal release


YUBIKEY TOKENS PROVISIONING FILE FORMAT
=======================================
The two following formats are supported:

- Yubikey traditional format log file (Yubikey Personalization Tools)
```
  LOGGING START,01.01.2015 04:03
  Yubico OTP,01.01.2015 04:03,1,vvccccdtvkiu,40e661b3ce2b,7b01896b5ef79d8092fd04556b4f4403,,,0,0,0,0,0,0,0,0,0,0
  Yubico OTP,01.01.2015 04:03,2,vvgdctvftcrt,f23f0218e3bb,64d66d0d758090bc6ef159866e63fea6,,,0,0,0,0,0,0,0,0,0,0
```

- YubiKey Yubico format log file (Yubico Authenticator)
```
  2604031,vvccccdtvkiu,40e661b3ce2b,7b01896b5ef79d8092fd04556b4f4403,,2026-04-03T05:10:02,
  2604032,vvgdctvftcrt,f23f0218e3bb,64d66d0d758090bc6ef159866e63fea6,,2026-04-03T05:10:02,
```


WHAT IS THE PREFIX PIN OPTION ?
===============================
The prefix PIN option is activated by default. Users will have to type their
PIN + the displayed token. The prefix PIN option has no effect for mOTP tokens,
and the users MUST NOT type their prefix PIN before the displayed token for
mOTP tokens, as the prefix PIN is already used by the algorithm in order to
generate the token.  

Starting with version 4.3, it's now possible to use the synchronized AD/LDAP
password as a prefix instead of the static PIN. Please note that even with the
AD/LDAP password as a prefix activated, the PIN used for mOTP tokens is still
the static PIN.  


HOW DOES ACCOUNT LOCKOUT WORK ?
===============================
To prevent brute-force attack, an account is temporary locked for 300 seconds
after 3 unsuccessful trials.  
After 6 unsuccessful trials, the account is definitely locked.  

A user can be unlocked by an administrator using the web GUI.

A user can also unlock his account by typing two consecutive codes, 
separated by a space (don't forget the prefix PIN/password if enabled).  
If prefix PIN is enabled, your PIN is 1234 and the two consecutive tokens are
984501 and 348202, you will have to type "1234984501 1234348202" as the
password in order to unlock the account during authentication.  


HOW TO SELF-UNLOCK AN ACCOUNT ?
===============================
The user can help itself by auto-deblocking its account like this:
Username: USERNAME
Password: [PREFIX PASSWORD] + [OTP] + [space] + [THE NEXT OTP]


FREE MULTIOTP CREDENTIAL PROVIDER
=================================
multiOTP Credential Provider is a compatible open source Credential Provider
for Windows 7/8/8.1/10/11/2012(R2)/2016/2019/2022/2025 in 64 bits, with caching
support option (for offline connection), RDP only 2FA, and some other options.
To download it: https://github.com/multiOTP/multiOTPCredentialProvider


FREE MULTIOTP TOKEN APP
=======================
multiOTP token is a free and open source application for Android and iOS, with
TOTP and MOTP token support, QRcode provisioning and import/export option.
Push support with Enterprise subscription is also available.
The app is available on both Google Play and Apple Store, and the source code
is available on https://github.com/multiOTP/multiOTP-token


SELF-REGISTRATION OF HARDWARE TOKENS
====================================
PAP mode: a user can register a non-attributed token by typing
[serial number][OTP] instead of [OTP].
If user has a prefix PIN, type [serial number][PIN][OTP]
PAP/CHAP mode: a user can register a non-attributed token by typing
[username:serialnumber] as the username and the [OTP] in the password field.
If user has a prefix PIN, [PIN][OTP] must be typed in the password field.


SAME WINDOWS GENERIC ACCOUNT WITH MULTIPLE TWO-FACTOR AUTHENTICATION ACCOUNTS 
=============================================================================
If you have to share the same generic Windows account, but you still need
2FA authentication for each user (like for a specific industrial computer in a
24/7/365 process), you can do the following configuration:
1) Create (or sync with AD/LDAP) a multiOTP account for the generic account
2) In multiOTP, set the description of the generic account to "multi_account"
   (if the account is synced by AD/LDAP, put the description in the AD/LDAP)
3) Create (or sync with AD/LDAP) the accounts of each users
4) On the login screen of the computer, use the following credentials:
   - Account : generic Windows account
   - Password : password of the generic Windows account
   - OTP : [username of the specific user][space][OTP code of the specific user]


USING MULTIOTP ON LINUX FOR SSH LOGIN
=====================================
0) Configure OpenSSH and PAM
   Configure your OpenSSH server to request the PassCode (PinCode+OTP)
   to the radius server. For this purpose we will use a radius PAM agent.

1) PAM configuration for OpenSSH server:
   Edit the file /etc/pam.d/sshd with this configuration.
   Comment the username/password line and add the PAM library.
   Be sure you have the PAM radius library.
```
   #auth required pam_stack.so service=system-auth
   auth required /lib/security/pam_radius_auth.so
```

2) Specify the Radius Server.
   Create and edit a file called server in /etc/raddb
   with the Radius IP,port and the shared secret key.
```
   #Server[:port]  shared_secret      timeout (s)
   127.0.0.1       secret             1
   10.1.23.1:1812  myfirstpass        6
```

3) OpenSSH server (radiusd daemon) configuration:
   Edit /etc/sshd/sshd_config and be sure PAM is
   enabled and keyboard-interactive AuthN support.
```
   UsePAM yes
   PasswordAuthentication no
   ChallengeResponseAuthentication yes
```

4) Stop and start the OpenSSH server
```
   /etc/init.d/sshd stop
   /etc/init.d/sshd start
```

5) You are now ready to test your login SSH with a software OTP :-)


RASPBERRY PI DISTRIBUTION
=========================
Please note that an optimized Raspberry Pi binary image is
available for any multiOTP Enterprise subscription customer.


OTHER PROJECTS USED BY MULTIOTP ENTERPRISE
==========================================

barcode (MIT License)
Kreative Software
https://github.com/kreativekorp/barcode

CryptoJS (BSD New)
This product contains software provided by Jeff Mott.
https://code.google.com/p/crypto-js/

FreeRADIUS (BSD)
This product contains software provided by FreeRADIUS team and its contributors.
http://freeradius.org/

md5 JavaScript 2010 algorithm (BSD)
Joseph Myers, Paul Johnston, Greg Holt, Will Bond
http://www.myersdaily.org/joseph/javascript/md5-text.html

Nginx (BSD)
This product contains software provided by Nginx, Inc. and its contributors.
http://nginx.org/

NuSOAP - PHP Web Services Toolkit (LGPLv2.1)
NuSphere Corporation
http://sourceforge.net/projects/nusoap/

phpseclib (MIT License)
MMVI Jim Wigginton
http://phpseclib.sourceforge.net/

PHP LDAP CLASS FOR MANIPULATING ACTIVE DIRECTORY (LGPLv2.1)
Scott Barnett - enhanced by SysCo
http://adldap.sourceforge.net/

QRcode image PHP scripts (FREE "AS IS")
Y. Swetake
http://www.swetake.com/qr/index-e.html

Sencha Ext JS (GPLv3)
Sencha Inc.
http://cdn.sencha.com/ext/gpl/4.2.1/

TCPDF (LGPLv3)
Nicola Asuni
https://tcpdf.org/

XML Parser Class (LGPLv3)
Adam A. Flynn - enhanced by SysCo
http://www.criticaldevelopment.net/xml/

XPertMailer package (LGPLv2.1)
Tanase Laurentiu Iulian
http://xpertmailer.sourceforge.net/


The source files of the core of multiOTP can be downloaded at
https://download.multiOTP.net/
