Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

x/crypto/ssh: Client Auth: handle partial success correctly when processing userAuthFailure responses #23461

Closed
samiponkanen opened this issue Jan 17, 2018 · 1 comment
Milestone

Comments

@samiponkanen
Copy link

@samiponkanen samiponkanen commented Jan 17, 2018

GO ssh library client does not handle correctly the partial success flag in SSH_MSG_USERAUTH_FAILURE authentication responses.

There seems to be some code in client_auth.go to handle this case when public key authentication is used. Password and keyboard-interactive authentication used with the RetryableAuthMethod wrapper do not handle such authentication responses correctly. Also the bookkeeping of failed authentication methods in clientAuthenticate() does not work correctly when authentication steps complete with partial success.

What version of Go are you using (go version)?

go version go1.9.2 linux/amd64

Does this issue reproduce with the latest release?

Yes

What operating system and processor architecture are you using (go env)?

GOHOSTARCH="amd64"
GOHOSTOS="linux"
GOOS="linux"

What did you do?

  1. Configure go ssh library client with RetryableAuthMethod(PasswordCallback) and PublicKeysCallback authentication methods. Use maxTries >= 2 with the RetryableAuthMethod.

  2. Configure openssh server with multi-auth: /etc/ssh/sshd_config:
    AuthenticationMethods password,publickey

  3. Connect client to server. Return the correct password when PasswordCallback() is called.

What did you expect to see?

Expected to see first PasswordCallback() getting called once and then PublicKeysCallback() getting called.

What did you see instead?

PasswordCallback() is always called two times, regardless if the returned password is correct or incorrect.

This happens because retryableAuthMethod.auth() does not exit from the loop when underlying auth method fails with userAuthFailure but PartialSuccess set to true.

@gopherbot gopherbot added this to the Unreleased milestone Jan 17, 2018
@gopherbot
Copy link

@gopherbot gopherbot commented Jan 17, 2018

Change https://golang.org/cl/88035 mentions this issue: ssh: fix support for partial success authentication responses in client

@golang golang locked and limited conversation to collaborators Feb 8, 2019
bored-engineer pushed a commit to bored-engineer/ssh that referenced this issue Oct 13, 2019
The existing client side authentication does not handle correctly
the partial success flag in SSH_MSG_USERAUTH_FAILURE authentication
responses.

This commit fixes two problems in ssh library:
1) RetryableAuthMethod() now breaks out from the retry loop and
   returns  when underlying auth method fails with partial success
   set to true.
2) Book keeping of tried (and failed) auth methods in
   clientAuthenticate() does not mark an auth method failed if it
   fails with partial success set to true.

Fixes golang/go#23461

Change-Id: Ib2e1a1d54bfe2549496199bb2f66ebbce58d130d
Reviewed-on: https://go-review.googlesource.com/88035
Reviewed-by: Han-Wen Nienhuys <hanwen@google.com>
Run-TryBot: Han-Wen Nienhuys <hanwen@google.com>
bored-engineer pushed a commit to bored-engineer/ssh that referenced this issue Oct 13, 2019
The existing client side authentication does not handle correctly
the partial success flag in SSH_MSG_USERAUTH_FAILURE authentication
responses.

This commit fixes two problems in ssh library:
1) RetryableAuthMethod() now breaks out from the retry loop and
   returns  when underlying auth method fails with partial success
   set to true.
2) Book keeping of tried (and failed) auth methods in
   clientAuthenticate() does not mark an auth method failed if it
   fails with partial success set to true.

Fixes golang/go#23461

Change-Id: Ib2e1a1d54bfe2549496199bb2f66ebbce58d130d
Reviewed-on: https://go-review.googlesource.com/88035
Reviewed-by: Han-Wen Nienhuys <hanwen@google.com>
Run-TryBot: Han-Wen Nienhuys <hanwen@google.com>
bored-engineer pushed a commit to bored-engineer/ssh that referenced this issue Oct 13, 2019
The existing client side authentication does not handle correctly
the partial success flag in SSH_MSG_USERAUTH_FAILURE authentication
responses.

This commit fixes two problems in ssh library:
1) RetryableAuthMethod() now breaks out from the retry loop and
   returns  when underlying auth method fails with partial success
   set to true.
2) Book keeping of tried (and failed) auth methods in
   clientAuthenticate() does not mark an auth method failed if it
   fails with partial success set to true.

Fixes golang/go#23461

Change-Id: Ib2e1a1d54bfe2549496199bb2f66ebbce58d130d
Reviewed-on: https://go-review.googlesource.com/88035
Reviewed-by: Han-Wen Nienhuys <hanwen@google.com>
Run-TryBot: Han-Wen Nienhuys <hanwen@google.com>
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Projects
None yet
Linked pull requests

Successfully merging a pull request may close this issue.

None yet
2 participants
You can’t perform that action at this time.