How can I handle session requests?

[supriyo-biswas]

First of all, thanks for the great project! :)

I'm trying to log a few things from a AsyncSSH server, using a custom session. Typically handling sessions are easy enough with asyncssh.create_server(process_factory=handler), but It's not clear to me from reading the docs and the source as to how I can handle the session request when using a custom Session class.

Here's the code I have:

import sys
import asyncio
import subprocess
from asyncssh import *

class MySession(SSHServerSession):
    def connection_made(self, chan):
        self.ip = chan.get_extra_info('peername')[0]

    def shell_requested(self):
        print(f'{self.ip} - Shell session requested')
        return True

    def exec_requested(self, command):
        print(f'{self.ip} - Exec requested')
        return True

    def subsystem_requested(self, subsystem):
        print(f'{self.ip} - Subsystem requested')
        return True

class MySSHServer(SSHServer):
    def connection_made(self, conn):
        self.ip = conn.get_extra_info('peername')[0]
        print(f'{self.ip} - Connection received')

    def connection_lost(self, exc):
        print(f'{self.ip} - Connection closed')

    def begin_auth(self, username):
        return True

    def password_auth_supported(self):
        return True

    def kbdint_auth_supported(self):
        return False

    def validate_password(self, username, password):
        rv = len(password) > 4 and len(username) > 2
        status = "accepted" if rv else "rejected"

        print(f'{self.ip} - Password auth {status}: {username}:{password}')
        return rv

    def session_requested(self):
        print(f'{self.ip} - Session requested')
        return MySession()

async def start_server():
    await create_server(MySSHServer, '', 5833, server_host_keys=['ssh_host_key'])

if __name__ == '__main__':
    loop = asyncio.get_event_loop()
    loop.run_until_complete(start_server())
    loop.run_forever()

[ronf]

Hello,

There are three options here. The one I'd recommend is to stick with using process_factory, as it provides the richest API. If you want to distinguish between shell, exec, and subsystem, you can do so using get_command() and get_subsystem() from within the callback you provide. For example:

import asyncio, asyncssh, sys

async def handle_client(process):
    ip = process.get_extra_info('peername')[0]

    if process.command:
        print(f'{ip} - Exec requested')
    elif process.subsystem:
        print(f'{ip} - Subsystem requested')
    else:
        print(f'{ip} - Shell requested')
    
    # Continue to do I/O on the process here

async def start_server():
    await asyncssh.listen('', 5833, server_host_keys=['ssh_host_key'],
                          authorized_client_keys='ssh_user_ca',
                          process_factory=handle_client)

loop = asyncio.get_event_loop()

try:
    loop.run_until_complete(start_server())
except (OSError, asyncssh.Error) as exc:
    sys.exit('Error starting server: ' + str(exc))

loop.run_forever()

A second alternative would be to provide your own server class but have session_request() return a coroutine that takes stdin/stdout/stderr. It would look very much like my example above, except the callback would take stdin/stdout/stderr:

import asyncio, asyncssh, sys

async def handle_client(stdin, stdout, stderr):
    ip = stdin.channel.get_extra_info('peername')[0]
    command = stdin.channel.get_command()
    subsystem = stdin.channel.get_subsystem()

    if command:
        print(f'{ip} - Exec requested')
    elif subsystem:
        print(f'{ip} - Subsystem requested')
    else:
        print(f'{ip} - Shell requested')
    
    # Continue to do I/O on stdin/stdout/stderr here

async def start_server():
    await asyncssh.listen('', 8022, server_host_keys=['ssh_host_key'],
                          authorized_client_keys='ssh_user_ca',
                          session_factory=handle_client)

loop = asyncio.get_event_loop()

try:
    loop.run_until_complete(start_server())
except (OSError, asyncssh.Error) as exc:
    sys.exit('Error starting server: ' + str(exc))

loop.run_forever()

There really isn't much reason to use this over the process version, though. Using session_factory is mostly just there for backward compatibility with releases that didn't yet have SSHProcess support.

The final option is to build everything with callbacks. What you've written is correct so far if you want to take that approach, but to perform I/O you'll need to implement session_started() and other callbacks like data_received() and eof_received(). You can find an example of that at https://asyncssh.readthedocs.io/en/latest/#id13. This is the oldest AsyncSSH API, modeled after the original low-level asyncio API. The stream and process based APIs are built on top of this.

[supriyo-biswas]

Thanks for the info — the second technique looks good for my use case.

I would indeed have liked to use process_factory as it would make things much simpler. Unfortunately I need to have control over the authentication process and log various types of requests (session, direct-tcpip and others), which means I have to extend the SSHServer class and return a session handler from session_requested(). Is this part correct, or is there a way to handle it with process_factory like semantics?

[ronf]

You can still have your own SSHServer class even when using process_factory. You just need to call create_server() instead of listen() in that case. Since you've specified a process_factory, you don't actually need to implement session_requested() in your server class in that case. Here's an example:

import asyncio, asyncssh, sys
  
async def handle_client(process):
    ip = process.get_extra_info('peername')[0]

    if process.command:
        print(f'{ip} - Exec requested')
    elif process.subsystem: 
        print(f'{ip} - Subsystem requested')
    else:
        print(f'{ip} - Shell requested')
   
    # Continue to do I/O on the process here

class MySSHServer(asyncssh.SSHServer):
    def connection_made(self, conn):
        self.ip = conn.get_extra_info('peername')[0]
        print(f'{self.ip} - Connection received')

    def connection_lost(self, exc):
        print(f'{self.ip} - Connection closed')

    def begin_auth(self, username):
        return True

    def password_auth_supported(self):
        return True

    def kbdint_auth_supported(self):
        return False

    def validate_password(self, username, password):
        rv = len(password) > 4 and len(username) > 2
        status = "accepted" if rv else "rejected"

        print(f'{self.ip} - Password auth {status}: {username}:{password}')
        return rv

async def start_server():
    await asyncssh.create_server(MySSHServer, '', 5833, 
                          server_host_keys=['ssh_host_key'],
                          process_factory=handle_client)

if __name__ == '__main__':
    loop = asyncio.get_event_loop()

    try:
        loop.run_until_complete(start_server())
    except (OSError, asyncssh.Error) as exc:
        sys.exit('Error starting server: ' + str(exc))

    loop.run_forever()

However, you will still need to implement connection_requested() in your SSHServer class if you want to support direct TCP/IP connections, or server_requested() if you want to support forwarded TCP/IP connections, so it's up to you if you want to handle all of them in a similar manner.

[supriyo-biswas]

Thanks :)