Skip to content

Installing Icinga TOTP Web from Source

Please see the Icinga Web documentation on how to install modules from source. Make sure you use totp as the module name. The following requirements must also be met.

Requirements

Setting up the Database

A MySQL or PostgreSQL database is required to store TOTP secrets. Please follow the steps listed for your target database.

Setting up a MySQL Database

Set up a MySQL database for Icinga TOTP Web:

# mysql -u root -p

CREATE DATABASE totp;
CREATE USER 'totp'@'localhost' IDENTIFIED BY 'CHANGEME';
GRANT ALL ON totp.* TO 'totp'@'localhost';

Import the schema:

mysql -u totp -p totp < /usr/share/icingaweb2/modules/totp/schema/mysql/schema.sql

Setting up a PostgreSQL Database

Allow authenticated local sessions for the totp database user by modifying the pg_hba.conf file. Its location is operating-system specific, but can be queried:

su postgres -c "psql -c 'show hba_file;'"

Add the following entries before any broader matching rules:

local totp totp              scram-sha-256
host  totp totp 127.0.0.1/32 scram-sha-256
host  totp totp      ::1/128 scram-sha-256

Use md5 instead of scram-sha-256 only with PostgreSQL versions older than 10.

For a remote database server, make sure PostgreSQL listens on an address reachable from Icinga Web. Then add host entries before any broader matching rules, only for the Icinga Web server addresses or subnets that should connect to PostgreSQL. For example, if Icinga Web connects from 192.0.2.43:

host  totp totp 192.0.2.43/32 scram-sha-256

To apply the changes, reload PostgreSQL:

systemctl reload postgresql

Now proceed with actually creating both user and database.

The example below uses the en_US.UTF-8 locale. This locale must be available on the PostgreSQL server. Use locale -a to list available locale names and replace en_US.UTF-8 with the exact UTF-8 locale name on your system, such as en_US.utf8.

# su -l postgres

createuser -P totp
createdb -E UTF8 --locale en_US.UTF-8 -T template0 -O totp totp

Import the schema:

psql -U totp totp < /usr/share/icingaweb2/modules/totp/schema/pgsql/schema.sql

Enabling the Module

Enable the module using the icingacli:

icingacli module enable totp

This concludes the installation. Now proceed with the configuration.