multiOTP on Ubuntu 24.04 LTS

multiOTP on Ubuntu 24.04 LTS

multiOTP 5.10.2.2 is an open source, OATH certified strong two factor authentication server. It issues and validates time based and counter based one time passwords (TOTP and HOTP) as well as Mobile OTP, provisions users to authenticator apps with QR codes, and keeps its users and tokens in a simple local flat file store. It is driven both from a powerful command line utility and from a bundled web administration console, and integrates with RADIUS front ends such as FreeRADIUS, with PAM, and with VPN login flows to add a second factor to your existing authentication. This cloudimg image ships only the LGPL 3.0 licensed open source edition.

Open source edition only

This image installs the open source multiOTP edition from the project's own LGPL 3.0 source release, verified against its licence at build time. It never installs the commercial multiOTP Pro or Enterprise virtual appliance, so there is no proprietary tier, no vendor credentialed download and no separate subscription in the image.

Secure by default

An authentication server with a default administrator login is a liability, so nothing here ships with a known secret. The web admin console is fronted by nginx HTTP Basic authentication, and the multiOTP administrator account is rotated in lock step with it. On the first boot of every VM a single unique administrator password is generated, applied to both gates, and written to a root only credentials file, so no default admin login is ever reachable and no two VMs share a password. An unauthenticated request returns HTTP 401 and only the correct per VM credential returns HTTP 200; every path except a static health probe requires authentication.

What is included

• multiOTP 5.10.2.2 open source edition (LGPL 3.0), the CLI plus the bundled web admin console
• nginx and PHP FPM 8.3 with OPcache and every PHP extension multiOTP requires
• OATH certified TOTP, HOTP and Mobile OTP with QR code provisioning and a flat file user and token store
• A per VM administrator password generated at first boot, applied to both the reverse proxy and the multiOTP admin account, stored in a root only file
• An unauthenticated health endpoint for load balancers and monitors; every other path authenticated
• A fully patched Ubuntu 24.04 LTS base with automatic security updates

Licensing and support

multiOTP open source is LGPL 3.0 licensed and free; only the open source edition is included, with no commercial multiOTP Pro or Enterprise component. The cloudimg charge covers packaging, security patching, image maintenance and 24/7 expert support. Recommended VM size: Standard_B2s. Prerequisites: an Azure subscription, a VNet and an SSH key. NSG inbound: port 22 for SSH and port 80 for the admin console and authentication service, with port 443 once you enable HTTPS. Deployment guide: https://www.cloudimg.co.uk/guides/multiotp-on-ubuntu-24-04-azure/. 24/7 support: support@cloudimg.co.uk.