diff --git a/.gitignore b/.gitignore
index 292c2e8..d2dab91 100644
--- a/.gitignore
+++ b/.gitignore
@@ -30,3 +30,5 @@
 /ocserv-0.10.7.tar.xz
 /ocserv-0.10.8.tar.xz.sig
 /ocserv-0.10.8.tar.xz
+/ocserv-0.10.9.tar.xz.sig
+/ocserv-0.10.9.tar.xz
diff --git a/ocserv.conf b/ocserv.conf
index 3dba4d5..df18a8a 100644
--- a/ocserv.conf
+++ b/ocserv.conf
@@ -12,12 +12,14 @@
 #  This enabled PAM authentication of the user. The gid-min option is used 
 # by auto-select-group option, in order to select the minimum valid group ID.
 #
-# plain[passwd=/etc/ocserv/ocpasswd]
+# plain[passwd=/etc/ocserv/ocpasswd,otp=/etc/ocserv/users.otp]
 #  The plain option requires specifying a password file which contains
 # entries of the following format.
 # "username:groupname1,groupname2:encoded-password"
 # One entry must be listed per line, and 'ocpasswd' should be used
-# to generate password entries.
+# to generate password entries. The 'otp' suboption allows to specify
+# an oath password file to be used for one time passwords; the format of
+# the file is described in https://code.google.com/p/mod-authn-otp/wiki/UsersFile
 #
 # radius[config=/etc/radiusclient/radiusclient.conf,groupconfig=true,nas-identifier=name,override-interim-updates=false]:
 #  The radius option requires specifying freeradius-client configuration
@@ -36,7 +38,7 @@
 
 auth = "pam"
 #auth = "pam[gid-min=1000]"
-#auth = "plain[passwd=./sample.passwd]"
+#auth = "plain[passwd=./sample.passwd,otp=./sample.otp]"
 #auth = "certificate"
 #auth = "radius[config=/etc/radiusclient/radiusclient.conf,groupconfig=true]"
 
@@ -51,6 +53,11 @@ auth = "pam"
 # radius: can be combined with any authentication method, it provides
 #      radius accounting to available users (see also stats-report-time).
 #
+# pam: can be combined with any authentication method, it provides
+#      a validation of the connecting user's name using PAM. It is
+#      superfluous to use this method when authentication is already
+#      PAM.
+#
 # Only one accounting method can be specified.
 #acct = "radius[config=/etc/radiusclient/radiusclient.conf]"
 
diff --git a/ocserv.spec b/ocserv.spec
index fe0f70e..8cfee07 100644
--- a/ocserv.spec
+++ b/ocserv.spec
@@ -1,8 +1,8 @@
 %global _hardened_build 1
 
 Name:		ocserv
-Version:	0.10.8
-Release:	2%{?dist}
+Version:	0.10.9
+Release:	1%{?dist}
 Summary:	OpenConnect SSL VPN server
 
 # For a breakdown of the licensing, see PACKAGE-LICENSING 
@@ -143,7 +143,7 @@ rm -rf %{buildroot}
 %config(noreplace) %{_sysconfdir}/ocserv/ocserv.conf
 %config(noreplace) %{_sysconfdir}/pam.d/ocserv
 
-%doc AUTHORS ChangeLog NEWS COPYING LICENSE README TODO PACKAGE-LICENSING
+%doc AUTHORS ChangeLog NEWS COPYING LICENSE README.md TODO PACKAGE-LICENSING
 %doc src/ccan/licenses/CC0 src/ccan/licenses/LGPL-2.1 src/ccan/licenses/BSD-MIT
 %{_mandir}/man8/ocserv.8*
 %{_mandir}/man8/occtl.8*
@@ -157,6 +157,9 @@ rm -rf %{buildroot}
 %{_localstatedir}/lib/ocserv/profile.xml
 
 %changelog
+* Thu Oct  8 2015 Nikos Mavrogiannopoulos <nmav@redhat.com> - 0.10.9-1
+- new upstream release (#1269479)
+
 * Thu Sep 17 2015 Nikos Mavrogiannopoulos <nmav@redhat.com> - 0.10.8-2
 - compile ocserv using radcli
 
diff --git a/sources b/sources
index e8a8158..34833c2 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-ffc602ecfb35df216874248eec5ddb85  ocserv-0.10.8.tar.xz.sig
-665b854377850db535271098a37213f1  ocserv-0.10.8.tar.xz
+650c80e96ef429f34787347a59476d07  ocserv-0.10.9.tar.xz.sig
+74834c59aa96beaa222c21ee6521adb2  ocserv-0.10.9.tar.xz