2 * Author: Tatu Ylonen <ylo@cs.hut.fi>
3 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
5 * Created: Sat Mar 18 22:15:47 1995 ylo
6 * Code to connect to a remote host, and to perform the client side of the
7 * login (authentication) dialog.
12 RCSID("$OpenBSD: sshconnect1.c,v 1.5 2000/08/19 21:34:44 markus Exp $");
14 #include <openssl/bn.h>
15 #include <openssl/dsa.h>
16 #include <openssl/rsa.h>
17 #include <openssl/evp.h>
30 #include "sshconnect.h"
33 /* Session id for the current session. */
34 unsigned char session_id[16];
35 unsigned int supported_authentications = 0;
37 extern Options options;
38 extern char *__progname;
41 * Checks if the user has an authentication agent, and if so, tries to
42 * authenticate using the agent.
45 try_agent_authentication()
49 AuthenticationConnection *auth;
50 unsigned char response[16];
56 /* Get connection to the agent. */
57 auth = ssh_get_authentication_connection();
62 key = key_new(KEY_RSA);
64 /* Loop through identities served by the agent. */
65 for (key = ssh_get_first_identity(auth, &comment, 1);
67 key = ssh_get_next_identity(auth, &comment, 1)) {
69 /* Try this identity. */
70 debug("Trying RSA authentication via agent with '%.100s'", comment);
73 /* Tell the server that we are willing to authenticate using this key. */
74 packet_start(SSH_CMSG_AUTH_RSA);
75 packet_put_bignum(key->rsa->n);
79 /* Wait for server's response. */
80 type = packet_read(&plen);
82 /* The server sends failure if it doesn\'t like our key or
83 does not support RSA authentication. */
84 if (type == SSH_SMSG_FAILURE) {
85 debug("Server refused our key.");
89 /* Otherwise it should have sent a challenge. */
90 if (type != SSH_SMSG_AUTH_RSA_CHALLENGE)
91 packet_disconnect("Protocol error during RSA authentication: %d",
94 packet_get_bignum(challenge, &clen);
96 packet_integrity_check(plen, clen, type);
98 debug("Received RSA challenge from server.");
100 /* Ask the agent to decrypt the challenge. */
101 if (!ssh_decrypt_challenge(auth, key, challenge, session_id, 1, response)) {
103 * The agent failed to authenticate this identifier
104 * although it advertised it supports this. Just
105 * return a wrong value.
107 log("Authentication agent failed to decrypt challenge.");
108 memset(response, 0, sizeof(response));
111 debug("Sending response to RSA challenge.");
113 /* Send the decrypted challenge back to the server. */
114 packet_start(SSH_CMSG_AUTH_RSA_RESPONSE);
115 for (i = 0; i < 16; i++)
116 packet_put_char(response[i]);
120 /* Wait for response from the server. */
121 type = packet_read(&plen);
123 /* The server returns success if it accepted the authentication. */
124 if (type == SSH_SMSG_SUCCESS) {
125 BN_clear_free(challenge);
126 debug("RSA authentication accepted by server.");
129 /* Otherwise it should return failure. */
130 if (type != SSH_SMSG_FAILURE)
131 packet_disconnect("Protocol error waiting RSA auth response: %d",
134 BN_clear_free(challenge);
135 debug("RSA authentication using agent refused.");
140 * Computes the proper response to a RSA challenge, and sends the response to
144 respond_to_rsa_challenge(BIGNUM * challenge, RSA * prv)
146 unsigned char buf[32], response[16];
150 /* Decrypt the challenge using the private key. */
151 rsa_private_decrypt(challenge, challenge, prv);
153 /* Compute the response. */
154 /* The response is MD5 of decrypted challenge plus session id. */
155 len = BN_num_bytes(challenge);
156 if (len <= 0 || len > sizeof(buf))
157 packet_disconnect("respond_to_rsa_challenge: bad challenge length %d",
160 memset(buf, 0, sizeof(buf));
161 BN_bn2bin(challenge, buf + sizeof(buf) - len);
163 MD5_Update(&md, buf, 32);
164 MD5_Update(&md, session_id, 16);
165 MD5_Final(response, &md);
167 debug("Sending response to host key RSA challenge.");
169 /* Send the response back to the server. */
170 packet_start(SSH_CMSG_AUTH_RSA_RESPONSE);
171 for (i = 0; i < 16; i++)
172 packet_put_char(response[i]);
176 memset(buf, 0, sizeof(buf));
177 memset(response, 0, sizeof(response));
178 memset(&md, 0, sizeof(md));
182 * Checks if the user has authentication file, and if so, tries to authenticate
186 try_rsa_authentication(const char *authfile)
191 char *passphrase, *comment;
195 /* Try to load identification for the authentication key. */
196 public = key_new(KEY_RSA);
197 if (!load_public_key(authfile, public, &comment)) {
199 /* Could not load it. Fail. */
202 debug("Trying RSA authentication with key '%.100s'", comment);
204 /* Tell the server that we are willing to authenticate using this key. */
205 packet_start(SSH_CMSG_AUTH_RSA);
206 packet_put_bignum(public->rsa->n);
210 /* We no longer need the public key. */
213 /* Wait for server's response. */
214 type = packet_read(&plen);
217 * The server responds with failure if it doesn\'t like our key or
218 * doesn\'t support RSA authentication.
220 if (type == SSH_SMSG_FAILURE) {
221 debug("Server refused our key.");
225 /* Otherwise, the server should respond with a challenge. */
226 if (type != SSH_SMSG_AUTH_RSA_CHALLENGE)
227 packet_disconnect("Protocol error during RSA authentication: %d", type);
229 /* Get the challenge from the packet. */
230 challenge = BN_new();
231 packet_get_bignum(challenge, &clen);
233 packet_integrity_check(plen, clen, type);
235 debug("Received RSA challenge from server.");
237 private = key_new(KEY_RSA);
239 * Load the private key. Try first with empty passphrase; if it
240 * fails, ask for a passphrase.
242 if (!load_private_key(authfile, "", private, NULL)) {
244 snprintf(buf, sizeof buf, "Enter passphrase for RSA key '%.100s': ",
246 if (!options.batch_mode)
247 passphrase = read_passphrase(buf, 0);
249 debug("Will not query passphrase for %.100s in batch mode.",
251 passphrase = xstrdup("");
254 /* Load the authentication file using the pasphrase. */
255 if (!load_private_key(authfile, passphrase, private, NULL)) {
256 memset(passphrase, 0, strlen(passphrase));
258 error("Bad passphrase.");
260 /* Send a dummy response packet to avoid protocol error. */
261 packet_start(SSH_CMSG_AUTH_RSA_RESPONSE);
262 for (i = 0; i < 16; i++)
267 /* Expect the server to reject it... */
268 packet_read_expect(&plen, SSH_SMSG_FAILURE);
272 /* Destroy the passphrase. */
273 memset(passphrase, 0, strlen(passphrase));
276 /* We no longer need the comment. */
279 /* Compute and send a response to the challenge. */
280 respond_to_rsa_challenge(challenge, private->rsa);
282 /* Destroy the private key. */
285 /* We no longer need the challenge. */
286 BN_clear_free(challenge);
288 /* Wait for response from the server. */
289 type = packet_read(&plen);
290 if (type == SSH_SMSG_SUCCESS) {
291 debug("RSA authentication accepted by server.");
294 if (type != SSH_SMSG_FAILURE)
295 packet_disconnect("Protocol error waiting RSA auth response: %d", type);
296 debug("RSA authentication refused.");
301 * Tries to authenticate the user using combined rhosts or /etc/hosts.equiv
302 * authentication and RSA host authentication.
305 try_rhosts_rsa_authentication(const char *local_user, RSA * host_key)
311 debug("Trying rhosts or /etc/hosts.equiv with RSA host authentication.");
313 /* Tell the server that we are willing to authenticate using this key. */
314 packet_start(SSH_CMSG_AUTH_RHOSTS_RSA);
315 packet_put_string(local_user, strlen(local_user));
316 packet_put_int(BN_num_bits(host_key->n));
317 packet_put_bignum(host_key->e);
318 packet_put_bignum(host_key->n);
322 /* Wait for server's response. */
323 type = packet_read(&plen);
325 /* The server responds with failure if it doesn't admit our
326 .rhosts authentication or doesn't know our host key. */
327 if (type == SSH_SMSG_FAILURE) {
328 debug("Server refused our rhosts authentication or host key.");
331 /* Otherwise, the server should respond with a challenge. */
332 if (type != SSH_SMSG_AUTH_RSA_CHALLENGE)
333 packet_disconnect("Protocol error during RSA authentication: %d", type);
335 /* Get the challenge from the packet. */
336 challenge = BN_new();
337 packet_get_bignum(challenge, &clen);
339 packet_integrity_check(plen, clen, type);
341 debug("Received RSA challenge for host key from server.");
343 /* Compute a response to the challenge. */
344 respond_to_rsa_challenge(challenge, host_key);
346 /* We no longer need the challenge. */
347 BN_clear_free(challenge);
349 /* Wait for response from the server. */
350 type = packet_read(&plen);
351 if (type == SSH_SMSG_SUCCESS) {
352 debug("Rhosts or /etc/hosts.equiv with RSA host authentication accepted by server.");
355 if (type != SSH_SMSG_FAILURE)
356 packet_disconnect("Protocol error waiting RSA auth response: %d", type);
357 debug("Rhosts or /etc/hosts.equiv with RSA host authentication refused.");
363 try_kerberos_authentication()
365 KTEXT_ST auth; /* Kerberos data */
372 Key_schedule schedule;
373 u_long checksum, cksum;
375 struct sockaddr_in local, foreign;
378 /* Don't do anything if we don't have any tickets. */
379 if (stat(tkt_string(), &st) < 0)
382 strncpy(inst, (char *) krb_get_phost(get_canonical_hostname()), INST_SZ);
384 realm = (char *) krb_realmofhost(get_canonical_hostname());
386 debug("Kerberos V4: no realm for %s", get_canonical_hostname());
389 /* This can really be anything. */
390 checksum = (u_long) getpid();
392 r = krb_mk_req(&auth, KRB4_SERVICE_NAME, inst, realm, checksum);
394 debug("Kerberos V4 krb_mk_req failed: %s", krb_err_txt[r]);
397 /* Get session key to decrypt the server's reply with. */
398 r = krb_get_cred(KRB4_SERVICE_NAME, inst, realm, &cred);
400 debug("get_cred failed: %s", krb_err_txt[r]);
403 des_key_sched((des_cblock *) cred.session, schedule);
405 /* Send authentication info to server. */
406 packet_start(SSH_CMSG_AUTH_KERBEROS);
407 packet_put_string((char *) auth.dat, auth.length);
411 /* Zero the buffer. */
412 (void) memset(auth.dat, 0, MAX_KTXT_LEN);
414 slen = sizeof(local);
415 memset(&local, 0, sizeof(local));
416 if (getsockname(packet_get_connection_in(),
417 (struct sockaddr *) & local, &slen) < 0)
418 debug("getsockname failed: %s", strerror(errno));
420 slen = sizeof(foreign);
421 memset(&foreign, 0, sizeof(foreign));
422 if (getpeername(packet_get_connection_in(),
423 (struct sockaddr *) & foreign, &slen) < 0) {
424 debug("getpeername failed: %s", strerror(errno));
427 /* Get server reply. */
428 type = packet_read(&plen);
430 case SSH_SMSG_FAILURE:
431 /* Should really be SSH_SMSG_AUTH_KERBEROS_FAILURE */
432 debug("Kerberos V4 authentication failed.");
436 case SSH_SMSG_AUTH_KERBEROS_RESPONSE:
437 /* SSH_SMSG_AUTH_KERBEROS_SUCCESS */
438 debug("Kerberos V4 authentication accepted.");
440 /* Get server's response. */
441 reply = packet_get_string((unsigned int *) &auth.length);
442 memcpy(auth.dat, reply, auth.length);
445 packet_integrity_check(plen, 4 + auth.length, type);
448 * If his response isn't properly encrypted with the session
449 * key, and the decrypted checksum fails to match, he's
452 r = krb_rd_priv(auth.dat, auth.length, schedule, &cred.session,
453 &foreign, &local, &msg_data);
455 debug("Kerberos V4 krb_rd_priv failed: %s", krb_err_txt[r]);
456 packet_disconnect("Kerberos V4 challenge failed!");
458 /* Fetch the (incremented) checksum that we supplied in the request. */
459 (void) memcpy((char *) &cksum, (char *) msg_data.app_data, sizeof(cksum));
460 cksum = ntohl(cksum);
462 /* If it matches, we're golden. */
463 if (cksum == checksum + 1) {
464 debug("Kerberos V4 challenge successful.");
467 packet_disconnect("Kerberos V4 challenge failed!");
471 packet_disconnect("Protocol error on Kerberos V4 response: %d", type);
483 char pname[ANAME_SZ], pinst[INST_SZ], prealm[REALM_SZ];
488 /* Don't do anything if we don't have any tickets. */
489 if (stat(tkt_string(), &st) < 0)
492 creds = xmalloc(sizeof(*creds));
494 if ((r = krb_get_tf_fullname(TKT_FILE, pname, pinst, prealm)) != KSUCCESS) {
495 debug("Kerberos V4 tf_fullname failed: %s", krb_err_txt[r]);
498 if ((r = krb_get_cred("krbtgt", prealm, prealm, creds)) != GC_OK) {
499 debug("Kerberos V4 get_cred failed: %s", krb_err_txt[r]);
502 if (time(0) > krb_life_to_time(creds->issue_date, creds->lifetime)) {
503 debug("Kerberos V4 ticket expired: %s", TKT_FILE);
506 creds_to_radix(creds, (unsigned char *)buffer, sizeof buffer);
509 packet_start(SSH_CMSG_HAVE_KERBEROS_TGT);
510 packet_put_string(buffer, strlen(buffer));
514 type = packet_read(&plen);
516 if (type == SSH_SMSG_FAILURE)
517 debug("Kerberos TGT for realm %s rejected.", prealm);
518 else if (type != SSH_SMSG_SUCCESS)
519 packet_disconnect("Protocol error on Kerberos TGT response: %d", type);
525 send_afs_tokens(void)
528 struct ViceIoctl parms;
529 struct ClearToken ct;
530 int i, type, len, plen;
531 char buf[2048], *p, *server_cell;
534 /* Move over ktc_GetToken, here's something leaner. */
535 for (i = 0; i < 100; i++) { /* just in case */
536 parms.in = (char *) &i;
537 parms.in_size = sizeof(i);
539 parms.out_size = sizeof(buf);
540 if (k_pioctl(0, VIOCGETTOK, &parms, 0) != 0)
544 /* Get secret token. */
545 memcpy(&creds.ticket_st.length, p, sizeof(unsigned int));
546 if (creds.ticket_st.length > MAX_KTXT_LEN)
548 p += sizeof(unsigned int);
549 memcpy(creds.ticket_st.dat, p, creds.ticket_st.length);
550 p += creds.ticket_st.length;
552 /* Get clear token. */
553 memcpy(&len, p, sizeof(len));
554 if (len != sizeof(struct ClearToken))
559 p += sizeof(len); /* primary flag */
562 /* Flesh out our credentials. */
563 strlcpy(creds.service, "afs", sizeof creds.service);
564 creds.instance[0] = '\0';
565 strlcpy(creds.realm, server_cell, REALM_SZ);
566 memcpy(creds.session, ct.HandShakeKey, DES_KEY_SZ);
567 creds.issue_date = ct.BeginTimestamp;
568 creds.lifetime = krb_time_to_life(creds.issue_date, ct.EndTimestamp);
569 creds.kvno = ct.AuthHandle;
570 snprintf(creds.pname, sizeof(creds.pname), "AFS ID %d", ct.ViceId);
571 creds.pinst[0] = '\0';
573 /* Encode token, ship it off. */
574 if (creds_to_radix(&creds, (unsigned char*) buffer, sizeof buffer) <= 0)
576 packet_start(SSH_CMSG_HAVE_AFS_TOKEN);
577 packet_put_string(buffer, strlen(buffer));
581 /* Roger, Roger. Clearance, Clarence. What's your vector,
583 type = packet_read(&plen);
585 if (type == SSH_SMSG_FAILURE)
586 debug("AFS token for cell %s rejected.", server_cell);
587 else if (type != SSH_SMSG_SUCCESS)
588 packet_disconnect("Protocol error on AFS token response: %d", type);
595 * Tries to authenticate with any string-based challenge/response system.
596 * Note that the client code is not tied to s/key or TIS.
599 try_skey_authentication()
604 char *challenge, *response;
606 debug("Doing skey authentication.");
608 /* request a challenge */
609 packet_start(SSH_CMSG_AUTH_TIS);
613 type = packet_read(&payload_len);
614 if (type != SSH_SMSG_FAILURE &&
615 type != SSH_SMSG_AUTH_TIS_CHALLENGE) {
616 packet_disconnect("Protocol error: got %d in response "
617 "to skey-auth", type);
619 if (type != SSH_SMSG_AUTH_TIS_CHALLENGE) {
620 debug("No challenge for skey authentication.");
623 challenge = packet_get_string(&clen);
624 packet_integrity_check(payload_len, (4 + clen), type);
625 if (options.cipher == SSH_CIPHER_NONE)
626 log("WARNING: Encryption is disabled! "
627 "Reponse will be transmitted in clear text.");
628 fprintf(stderr, "%s\n", challenge);
631 for (i = 0; i < options.number_of_password_prompts; i++) {
633 error("Permission denied, please try again.");
634 response = read_passphrase("Response: ", 0);
635 packet_start(SSH_CMSG_AUTH_TIS_RESPONSE);
636 packet_put_string(response, strlen(response));
637 memset(response, 0, strlen(response));
641 type = packet_read(&payload_len);
642 if (type == SSH_SMSG_SUCCESS)
644 if (type != SSH_SMSG_FAILURE)
645 packet_disconnect("Protocol error: got %d in response "
646 "to skey-auth-reponse", type);
653 * Tries to authenticate with plain passwd authentication.
656 try_password_authentication(char *prompt)
658 int type, i, payload_len;
661 debug("Doing password authentication.");
662 if (options.cipher == SSH_CIPHER_NONE)
663 log("WARNING: Encryption is disabled! Password will be transmitted in clear text.");
664 for (i = 0; i < options.number_of_password_prompts; i++) {
666 error("Permission denied, please try again.");
667 password = read_passphrase(prompt, 0);
668 packet_start(SSH_CMSG_AUTH_PASSWORD);
669 packet_put_string(password, strlen(password));
670 memset(password, 0, strlen(password));
675 type = packet_read(&payload_len);
676 if (type == SSH_SMSG_SUCCESS)
678 if (type != SSH_SMSG_FAILURE)
679 packet_disconnect("Protocol error: got %d in response to passwd auth", type);
689 ssh_kex(char *host, struct sockaddr *hostaddr)
697 int ssh_cipher_default = SSH_CIPHER_3DES;
698 unsigned char session_key[SSH_SESSION_KEY_LENGTH];
699 unsigned char cookie[8];
700 unsigned int supported_ciphers;
701 unsigned int server_flags, client_flags;
702 int payload_len, clen, sum_len = 0;
705 debug("Waiting for server public key.");
707 /* Wait for a public key packet from the server. */
708 packet_read_expect(&payload_len, SSH_SMSG_PUBLIC_KEY);
710 /* Get cookie from the packet. */
711 for (i = 0; i < 8; i++)
712 cookie[i] = packet_get_char();
714 /* Get the public key. */
715 public_key = RSA_new();
716 bits = packet_get_int();/* bits */
717 public_key->e = BN_new();
718 packet_get_bignum(public_key->e, &clen);
720 public_key->n = BN_new();
721 packet_get_bignum(public_key->n, &clen);
724 rbits = BN_num_bits(public_key->n);
726 log("Warning: Server lies about size of server public key: "
727 "actual size is %d bits vs. announced %d.", rbits, bits);
728 log("Warning: This may be due to an old implementation of ssh.");
730 /* Get the host key. */
731 host_key = RSA_new();
732 bits = packet_get_int();/* bits */
733 host_key->e = BN_new();
734 packet_get_bignum(host_key->e, &clen);
736 host_key->n = BN_new();
737 packet_get_bignum(host_key->n, &clen);
740 rbits = BN_num_bits(host_key->n);
742 log("Warning: Server lies about size of server host key: "
743 "actual size is %d bits vs. announced %d.", rbits, bits);
744 log("Warning: This may be due to an old implementation of ssh.");
747 /* Get protocol flags. */
748 server_flags = packet_get_int();
749 packet_set_protocol_flags(server_flags);
751 supported_ciphers = packet_get_int();
752 supported_authentications = packet_get_int();
754 debug("Received server public key (%d bits) and host key (%d bits).",
755 BN_num_bits(public_key->n), BN_num_bits(host_key->n));
757 packet_integrity_check(payload_len,
758 8 + 4 + sum_len + 0 + 4 + 0 + 0 + 4 + 4 + 4,
759 SSH_SMSG_PUBLIC_KEY);
762 check_host_key(host, hostaddr, &k,
763 options.user_hostfile, options.system_hostfile);
765 client_flags = SSH_PROTOFLAG_SCREEN_NUMBER | SSH_PROTOFLAG_HOST_IN_FWD_OPEN;
767 compute_session_id(session_id, cookie, host_key->n, public_key->n);
769 /* Generate a session key. */
773 * Generate an encryption key for the session. The key is a 256 bit
774 * random number, interpreted as a 32-byte key, with the least
775 * significant 8 bits being the first byte of the key.
777 for (i = 0; i < 32; i++) {
780 session_key[i] = rand & 0xff;
785 * According to the protocol spec, the first byte of the session key
786 * is the highest byte of the integer. The session key is xored with
787 * the first 16 bytes of the session id.
791 for (i = 0; i < SSH_SESSION_KEY_LENGTH; i++) {
792 BN_lshift(key, key, 8);
794 BN_add_word(key, session_key[i] ^ session_id[i]);
796 BN_add_word(key, session_key[i]);
800 * Encrypt the integer using the public key and host key of the
801 * server (key with smaller modulus first).
803 if (BN_cmp(public_key->n, host_key->n) < 0) {
804 /* Public key has smaller modulus. */
805 if (BN_num_bits(host_key->n) <
806 BN_num_bits(public_key->n) + SSH_KEY_BITS_RESERVED) {
807 fatal("respond_to_rsa_challenge: host_key %d < public_key %d + "
808 "SSH_KEY_BITS_RESERVED %d",
809 BN_num_bits(host_key->n),
810 BN_num_bits(public_key->n),
811 SSH_KEY_BITS_RESERVED);
813 rsa_public_encrypt(key, key, public_key);
814 rsa_public_encrypt(key, key, host_key);
816 /* Host key has smaller modulus (or they are equal). */
817 if (BN_num_bits(public_key->n) <
818 BN_num_bits(host_key->n) + SSH_KEY_BITS_RESERVED) {
819 fatal("respond_to_rsa_challenge: public_key %d < host_key %d + "
820 "SSH_KEY_BITS_RESERVED %d",
821 BN_num_bits(public_key->n),
822 BN_num_bits(host_key->n),
823 SSH_KEY_BITS_RESERVED);
825 rsa_public_encrypt(key, key, host_key);
826 rsa_public_encrypt(key, key, public_key);
829 /* Destroy the public keys since we no longer need them. */
830 RSA_free(public_key);
833 if (options.cipher == SSH_CIPHER_ILLEGAL) {
834 log("No valid SSH1 cipher, using %.100s instead.",
835 cipher_name(SSH_FALLBACK_CIPHER));
836 options.cipher = SSH_FALLBACK_CIPHER;
837 } else if (options.cipher == SSH_CIPHER_NOT_SET) {
838 if (cipher_mask1() & supported_ciphers & (1 << ssh_cipher_default))
839 options.cipher = ssh_cipher_default;
841 debug("Cipher %s not supported, using %.100s instead.",
842 cipher_name(ssh_cipher_default),
843 cipher_name(SSH_FALLBACK_CIPHER));
844 options.cipher = SSH_FALLBACK_CIPHER;
847 /* Check that the selected cipher is supported. */
848 if (!(supported_ciphers & (1 << options.cipher)))
849 fatal("Selected cipher type %.100s not supported by server.",
850 cipher_name(options.cipher));
852 debug("Encryption type: %.100s", cipher_name(options.cipher));
854 /* Send the encrypted session key to the server. */
855 packet_start(SSH_CMSG_SESSION_KEY);
856 packet_put_char(options.cipher);
858 /* Send the cookie back to the server. */
859 for (i = 0; i < 8; i++)
860 packet_put_char(cookie[i]);
862 /* Send and destroy the encrypted encryption key integer. */
863 packet_put_bignum(key);
866 /* Send protocol flags. */
867 packet_put_int(client_flags);
869 /* Send the packet now. */
873 debug("Sent encrypted session key.");
875 /* Set the encryption key. */
876 packet_set_encryption_key(session_key, SSH_SESSION_KEY_LENGTH, options.cipher);
878 /* We will no longer need the session key here. Destroy any extra copies. */
879 memset(session_key, 0, sizeof(session_key));
882 * Expect a success message from the server. Note that this message
883 * will be received in encrypted form.
885 packet_read_expect(&payload_len, SSH_SMSG_SUCCESS);
887 debug("Received encrypted confirmation.");
895 const char* local_user,
896 const char* server_user,
898 int host_key_valid, RSA *own_host_key)
903 if (supported_authentications == 0)
904 fatal("ssh_userauth: server supports no auth methods");
906 /* Send the name of the user to log in as on the server. */
907 packet_start(SSH_CMSG_USER);
908 packet_put_string(server_user, strlen(server_user));
913 * The server should respond with success if no authentication is
914 * needed (the user has no password). Otherwise the server responds
917 type = packet_read(&payload_len);
919 /* check whether the connection was accepted without authentication. */
920 if (type == SSH_SMSG_SUCCESS)
922 if (type != SSH_SMSG_FAILURE)
923 packet_disconnect("Protocol error: got %d in response to SSH_CMSG_USER",
927 /* Try Kerberos tgt passing if the server supports it. */
928 if ((supported_authentications & (1 << SSH_PASS_KERBEROS_TGT)) &&
929 options.kerberos_tgt_passing) {
930 if (options.cipher == SSH_CIPHER_NONE)
931 log("WARNING: Encryption is disabled! Ticket will be transmitted in the clear!");
932 (void) send_kerberos_tgt();
934 /* Try AFS token passing if the server supports it. */
935 if ((supported_authentications & (1 << SSH_PASS_AFS_TOKEN)) &&
936 options.afs_token_passing && k_hasafs()) {
937 if (options.cipher == SSH_CIPHER_NONE)
938 log("WARNING: Encryption is disabled! Token will be transmitted in the clear!");
944 if ((supported_authentications & (1 << SSH_AUTH_KERBEROS)) &&
945 options.kerberos_authentication) {
946 debug("Trying Kerberos authentication.");
947 if (try_kerberos_authentication()) {
948 /* The server should respond with success or failure. */
949 type = packet_read(&payload_len);
950 if (type == SSH_SMSG_SUCCESS)
952 if (type != SSH_SMSG_FAILURE)
953 packet_disconnect("Protocol error: got %d in response to Kerberos auth", type);
959 * Use rhosts authentication if running in privileged socket and we
960 * do not wish to remain anonymous.
962 if ((supported_authentications & (1 << SSH_AUTH_RHOSTS)) &&
963 options.rhosts_authentication) {
964 debug("Trying rhosts authentication.");
965 packet_start(SSH_CMSG_AUTH_RHOSTS);
966 packet_put_string(local_user, strlen(local_user));
970 /* The server should respond with success or failure. */
971 type = packet_read(&payload_len);
972 if (type == SSH_SMSG_SUCCESS)
974 if (type != SSH_SMSG_FAILURE)
975 packet_disconnect("Protocol error: got %d in response to rhosts auth",
979 * Try .rhosts or /etc/hosts.equiv authentication with RSA host
982 if ((supported_authentications & (1 << SSH_AUTH_RHOSTS_RSA)) &&
983 options.rhosts_rsa_authentication && host_key_valid) {
984 if (try_rhosts_rsa_authentication(local_user, own_host_key))
987 /* Try RSA authentication if the server supports it. */
988 if ((supported_authentications & (1 << SSH_AUTH_RSA)) &&
989 options.rsa_authentication) {
991 * Try RSA authentication using the authentication agent. The
992 * agent is tried first because no passphrase is needed for
993 * it, whereas identity files may require passphrases.
995 if (try_agent_authentication())
998 /* Try RSA authentication for each identity. */
999 for (i = 0; i < options.num_identity_files; i++)
1000 if (try_rsa_authentication(options.identity_files[i]))
1003 /* Try skey authentication if the server supports it. */
1004 if ((supported_authentications & (1 << SSH_AUTH_TIS)) &&
1005 options.skey_authentication && !options.batch_mode) {
1006 if (try_skey_authentication())
1009 /* Try password authentication if the server supports it. */
1010 if ((supported_authentications & (1 << SSH_AUTH_PASSWORD)) &&
1011 options.password_authentication && !options.batch_mode) {
1014 snprintf(prompt, sizeof(prompt), "%.30s@%.40s's password: ",
1016 if (try_password_authentication(prompt))
1019 /* All authentication methods have failed. Exit with an error message. */
1020 fatal("Permission denied.");