2 * Author: Tatu Ylonen <ylo@cs.hut.fi>
3 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
5 * Created: Sat Mar 18 22:15:47 1995 ylo
6 * Code to connect to a remote host, and to perform the client side of the
7 * login (authentication) dialog.
12 RCSID("$OpenBSD: sshconnect1.c,v 1.4 2000/07/16 08:27:22 markus Exp $");
14 #include <openssl/bn.h>
15 #include <openssl/dsa.h>
16 #include <openssl/rsa.h>
17 #include <openssl/evp.h>
30 #include "sshconnect.h"
33 /* Session id for the current session. */
34 unsigned char session_id[16];
35 unsigned int supported_authentications = 0;
37 extern Options options;
38 extern char *__progname;
41 * Checks if the user has an authentication agent, and if so, tries to
42 * authenticate using the agent.
45 try_agent_authentication()
49 AuthenticationConnection *auth;
50 unsigned char response[16];
52 BIGNUM *e, *n, *challenge;
54 /* Get connection to the agent. */
55 auth = ssh_get_authentication_connection();
63 /* Loop through identities served by the agent. */
64 for (status = ssh_get_first_identity(auth, e, n, &comment);
66 status = ssh_get_next_identity(auth, e, n, &comment)) {
69 /* Try this identity. */
70 debug("Trying RSA authentication via agent with '%.100s'", comment);
73 /* Tell the server that we are willing to authenticate using this key. */
74 packet_start(SSH_CMSG_AUTH_RSA);
79 /* Wait for server's response. */
80 type = packet_read(&plen);
82 /* The server sends failure if it doesn\'t like our key or
83 does not support RSA authentication. */
84 if (type == SSH_SMSG_FAILURE) {
85 debug("Server refused our key.");
88 /* Otherwise it should have sent a challenge. */
89 if (type != SSH_SMSG_AUTH_RSA_CHALLENGE)
90 packet_disconnect("Protocol error during RSA authentication: %d",
93 packet_get_bignum(challenge, &clen);
95 packet_integrity_check(plen, clen, type);
97 debug("Received RSA challenge from server.");
99 /* Ask the agent to decrypt the challenge. */
100 if (!ssh_decrypt_challenge(auth, e, n, challenge,
101 session_id, 1, response)) {
102 /* The agent failed to authenticate this identifier although it
103 advertised it supports this. Just return a wrong value. */
104 log("Authentication agent failed to decrypt challenge.");
105 memset(response, 0, sizeof(response));
107 debug("Sending response to RSA challenge.");
109 /* Send the decrypted challenge back to the server. */
110 packet_start(SSH_CMSG_AUTH_RSA_RESPONSE);
111 for (i = 0; i < 16; i++)
112 packet_put_char(response[i]);
116 /* Wait for response from the server. */
117 type = packet_read(&plen);
119 /* The server returns success if it accepted the authentication. */
120 if (type == SSH_SMSG_SUCCESS) {
121 debug("RSA authentication accepted by server.");
124 BN_clear_free(challenge);
127 /* Otherwise it should return failure. */
128 if (type != SSH_SMSG_FAILURE)
129 packet_disconnect("Protocol error waiting RSA auth response: %d",
135 BN_clear_free(challenge);
137 debug("RSA authentication using agent refused.");
142 * Computes the proper response to a RSA challenge, and sends the response to
146 respond_to_rsa_challenge(BIGNUM * challenge, RSA * prv)
148 unsigned char buf[32], response[16];
152 /* Decrypt the challenge using the private key. */
153 rsa_private_decrypt(challenge, challenge, prv);
155 /* Compute the response. */
156 /* The response is MD5 of decrypted challenge plus session id. */
157 len = BN_num_bytes(challenge);
158 if (len <= 0 || len > sizeof(buf))
159 packet_disconnect("respond_to_rsa_challenge: bad challenge length %d",
162 memset(buf, 0, sizeof(buf));
163 BN_bn2bin(challenge, buf + sizeof(buf) - len);
165 MD5_Update(&md, buf, 32);
166 MD5_Update(&md, session_id, 16);
167 MD5_Final(response, &md);
169 debug("Sending response to host key RSA challenge.");
171 /* Send the response back to the server. */
172 packet_start(SSH_CMSG_AUTH_RSA_RESPONSE);
173 for (i = 0; i < 16; i++)
174 packet_put_char(response[i]);
178 memset(buf, 0, sizeof(buf));
179 memset(response, 0, sizeof(response));
180 memset(&md, 0, sizeof(md));
184 * Checks if the user has authentication file, and if so, tries to authenticate
188 try_rsa_authentication(const char *authfile)
193 char *passphrase, *comment;
197 /* Try to load identification for the authentication key. */
198 public = key_new(KEY_RSA);
199 if (!load_public_key(authfile, public, &comment)) {
201 /* Could not load it. Fail. */
204 debug("Trying RSA authentication with key '%.100s'", comment);
206 /* Tell the server that we are willing to authenticate using this key. */
207 packet_start(SSH_CMSG_AUTH_RSA);
208 packet_put_bignum(public->rsa->n);
212 /* We no longer need the public key. */
215 /* Wait for server's response. */
216 type = packet_read(&plen);
219 * The server responds with failure if it doesn\'t like our key or
220 * doesn\'t support RSA authentication.
222 if (type == SSH_SMSG_FAILURE) {
223 debug("Server refused our key.");
227 /* Otherwise, the server should respond with a challenge. */
228 if (type != SSH_SMSG_AUTH_RSA_CHALLENGE)
229 packet_disconnect("Protocol error during RSA authentication: %d", type);
231 /* Get the challenge from the packet. */
232 challenge = BN_new();
233 packet_get_bignum(challenge, &clen);
235 packet_integrity_check(plen, clen, type);
237 debug("Received RSA challenge from server.");
239 private = key_new(KEY_RSA);
241 * Load the private key. Try first with empty passphrase; if it
242 * fails, ask for a passphrase.
244 if (!load_private_key(authfile, "", private, NULL)) {
246 snprintf(buf, sizeof buf, "Enter passphrase for RSA key '%.100s': ",
248 if (!options.batch_mode)
249 passphrase = read_passphrase(buf, 0);
251 debug("Will not query passphrase for %.100s in batch mode.",
253 passphrase = xstrdup("");
256 /* Load the authentication file using the pasphrase. */
257 if (!load_private_key(authfile, passphrase, private, NULL)) {
258 memset(passphrase, 0, strlen(passphrase));
260 error("Bad passphrase.");
262 /* Send a dummy response packet to avoid protocol error. */
263 packet_start(SSH_CMSG_AUTH_RSA_RESPONSE);
264 for (i = 0; i < 16; i++)
269 /* Expect the server to reject it... */
270 packet_read_expect(&plen, SSH_SMSG_FAILURE);
274 /* Destroy the passphrase. */
275 memset(passphrase, 0, strlen(passphrase));
278 /* We no longer need the comment. */
281 /* Compute and send a response to the challenge. */
282 respond_to_rsa_challenge(challenge, private->rsa);
284 /* Destroy the private key. */
287 /* We no longer need the challenge. */
288 BN_clear_free(challenge);
290 /* Wait for response from the server. */
291 type = packet_read(&plen);
292 if (type == SSH_SMSG_SUCCESS) {
293 debug("RSA authentication accepted by server.");
296 if (type != SSH_SMSG_FAILURE)
297 packet_disconnect("Protocol error waiting RSA auth response: %d", type);
298 debug("RSA authentication refused.");
303 * Tries to authenticate the user using combined rhosts or /etc/hosts.equiv
304 * authentication and RSA host authentication.
307 try_rhosts_rsa_authentication(const char *local_user, RSA * host_key)
313 debug("Trying rhosts or /etc/hosts.equiv with RSA host authentication.");
315 /* Tell the server that we are willing to authenticate using this key. */
316 packet_start(SSH_CMSG_AUTH_RHOSTS_RSA);
317 packet_put_string(local_user, strlen(local_user));
318 packet_put_int(BN_num_bits(host_key->n));
319 packet_put_bignum(host_key->e);
320 packet_put_bignum(host_key->n);
324 /* Wait for server's response. */
325 type = packet_read(&plen);
327 /* The server responds with failure if it doesn't admit our
328 .rhosts authentication or doesn't know our host key. */
329 if (type == SSH_SMSG_FAILURE) {
330 debug("Server refused our rhosts authentication or host key.");
333 /* Otherwise, the server should respond with a challenge. */
334 if (type != SSH_SMSG_AUTH_RSA_CHALLENGE)
335 packet_disconnect("Protocol error during RSA authentication: %d", type);
337 /* Get the challenge from the packet. */
338 challenge = BN_new();
339 packet_get_bignum(challenge, &clen);
341 packet_integrity_check(plen, clen, type);
343 debug("Received RSA challenge for host key from server.");
345 /* Compute a response to the challenge. */
346 respond_to_rsa_challenge(challenge, host_key);
348 /* We no longer need the challenge. */
349 BN_clear_free(challenge);
351 /* Wait for response from the server. */
352 type = packet_read(&plen);
353 if (type == SSH_SMSG_SUCCESS) {
354 debug("Rhosts or /etc/hosts.equiv with RSA host authentication accepted by server.");
357 if (type != SSH_SMSG_FAILURE)
358 packet_disconnect("Protocol error waiting RSA auth response: %d", type);
359 debug("Rhosts or /etc/hosts.equiv with RSA host authentication refused.");
365 try_kerberos_authentication()
367 KTEXT_ST auth; /* Kerberos data */
374 Key_schedule schedule;
375 u_long checksum, cksum;
377 struct sockaddr_in local, foreign;
380 /* Don't do anything if we don't have any tickets. */
381 if (stat(tkt_string(), &st) < 0)
384 strncpy(inst, (char *) krb_get_phost(get_canonical_hostname()), INST_SZ);
386 realm = (char *) krb_realmofhost(get_canonical_hostname());
388 debug("Kerberos V4: no realm for %s", get_canonical_hostname());
391 /* This can really be anything. */
392 checksum = (u_long) getpid();
394 r = krb_mk_req(&auth, KRB4_SERVICE_NAME, inst, realm, checksum);
396 debug("Kerberos V4 krb_mk_req failed: %s", krb_err_txt[r]);
399 /* Get session key to decrypt the server's reply with. */
400 r = krb_get_cred(KRB4_SERVICE_NAME, inst, realm, &cred);
402 debug("get_cred failed: %s", krb_err_txt[r]);
405 des_key_sched((des_cblock *) cred.session, schedule);
407 /* Send authentication info to server. */
408 packet_start(SSH_CMSG_AUTH_KERBEROS);
409 packet_put_string((char *) auth.dat, auth.length);
413 /* Zero the buffer. */
414 (void) memset(auth.dat, 0, MAX_KTXT_LEN);
416 slen = sizeof(local);
417 memset(&local, 0, sizeof(local));
418 if (getsockname(packet_get_connection_in(),
419 (struct sockaddr *) & local, &slen) < 0)
420 debug("getsockname failed: %s", strerror(errno));
422 slen = sizeof(foreign);
423 memset(&foreign, 0, sizeof(foreign));
424 if (getpeername(packet_get_connection_in(),
425 (struct sockaddr *) & foreign, &slen) < 0) {
426 debug("getpeername failed: %s", strerror(errno));
429 /* Get server reply. */
430 type = packet_read(&plen);
432 case SSH_SMSG_FAILURE:
433 /* Should really be SSH_SMSG_AUTH_KERBEROS_FAILURE */
434 debug("Kerberos V4 authentication failed.");
438 case SSH_SMSG_AUTH_KERBEROS_RESPONSE:
439 /* SSH_SMSG_AUTH_KERBEROS_SUCCESS */
440 debug("Kerberos V4 authentication accepted.");
442 /* Get server's response. */
443 reply = packet_get_string((unsigned int *) &auth.length);
444 memcpy(auth.dat, reply, auth.length);
447 packet_integrity_check(plen, 4 + auth.length, type);
450 * If his response isn't properly encrypted with the session
451 * key, and the decrypted checksum fails to match, he's
454 r = krb_rd_priv(auth.dat, auth.length, schedule, &cred.session,
455 &foreign, &local, &msg_data);
457 debug("Kerberos V4 krb_rd_priv failed: %s", krb_err_txt[r]);
458 packet_disconnect("Kerberos V4 challenge failed!");
460 /* Fetch the (incremented) checksum that we supplied in the request. */
461 (void) memcpy((char *) &cksum, (char *) msg_data.app_data, sizeof(cksum));
462 cksum = ntohl(cksum);
464 /* If it matches, we're golden. */
465 if (cksum == checksum + 1) {
466 debug("Kerberos V4 challenge successful.");
469 packet_disconnect("Kerberos V4 challenge failed!");
473 packet_disconnect("Protocol error on Kerberos V4 response: %d", type);
485 char pname[ANAME_SZ], pinst[INST_SZ], prealm[REALM_SZ];
490 /* Don't do anything if we don't have any tickets. */
491 if (stat(tkt_string(), &st) < 0)
494 creds = xmalloc(sizeof(*creds));
496 if ((r = krb_get_tf_fullname(TKT_FILE, pname, pinst, prealm)) != KSUCCESS) {
497 debug("Kerberos V4 tf_fullname failed: %s", krb_err_txt[r]);
500 if ((r = krb_get_cred("krbtgt", prealm, prealm, creds)) != GC_OK) {
501 debug("Kerberos V4 get_cred failed: %s", krb_err_txt[r]);
504 if (time(0) > krb_life_to_time(creds->issue_date, creds->lifetime)) {
505 debug("Kerberos V4 ticket expired: %s", TKT_FILE);
508 creds_to_radix(creds, (unsigned char *)buffer, sizeof buffer);
511 packet_start(SSH_CMSG_HAVE_KERBEROS_TGT);
512 packet_put_string(buffer, strlen(buffer));
516 type = packet_read(&plen);
518 if (type == SSH_SMSG_FAILURE)
519 debug("Kerberos TGT for realm %s rejected.", prealm);
520 else if (type != SSH_SMSG_SUCCESS)
521 packet_disconnect("Protocol error on Kerberos TGT response: %d", type);
527 send_afs_tokens(void)
530 struct ViceIoctl parms;
531 struct ClearToken ct;
532 int i, type, len, plen;
533 char buf[2048], *p, *server_cell;
536 /* Move over ktc_GetToken, here's something leaner. */
537 for (i = 0; i < 100; i++) { /* just in case */
538 parms.in = (char *) &i;
539 parms.in_size = sizeof(i);
541 parms.out_size = sizeof(buf);
542 if (k_pioctl(0, VIOCGETTOK, &parms, 0) != 0)
546 /* Get secret token. */
547 memcpy(&creds.ticket_st.length, p, sizeof(unsigned int));
548 if (creds.ticket_st.length > MAX_KTXT_LEN)
550 p += sizeof(unsigned int);
551 memcpy(creds.ticket_st.dat, p, creds.ticket_st.length);
552 p += creds.ticket_st.length;
554 /* Get clear token. */
555 memcpy(&len, p, sizeof(len));
556 if (len != sizeof(struct ClearToken))
561 p += sizeof(len); /* primary flag */
564 /* Flesh out our credentials. */
565 strlcpy(creds.service, "afs", sizeof creds.service);
566 creds.instance[0] = '\0';
567 strlcpy(creds.realm, server_cell, REALM_SZ);
568 memcpy(creds.session, ct.HandShakeKey, DES_KEY_SZ);
569 creds.issue_date = ct.BeginTimestamp;
570 creds.lifetime = krb_time_to_life(creds.issue_date, ct.EndTimestamp);
571 creds.kvno = ct.AuthHandle;
572 snprintf(creds.pname, sizeof(creds.pname), "AFS ID %d", ct.ViceId);
573 creds.pinst[0] = '\0';
575 /* Encode token, ship it off. */
576 if (creds_to_radix(&creds, (unsigned char*) buffer, sizeof buffer) <= 0)
578 packet_start(SSH_CMSG_HAVE_AFS_TOKEN);
579 packet_put_string(buffer, strlen(buffer));
583 /* Roger, Roger. Clearance, Clarence. What's your vector,
585 type = packet_read(&plen);
587 if (type == SSH_SMSG_FAILURE)
588 debug("AFS token for cell %s rejected.", server_cell);
589 else if (type != SSH_SMSG_SUCCESS)
590 packet_disconnect("Protocol error on AFS token response: %d", type);
597 * Tries to authenticate with any string-based challenge/response system.
598 * Note that the client code is not tied to s/key or TIS.
601 try_skey_authentication()
606 char *challenge, *response;
608 debug("Doing skey authentication.");
610 /* request a challenge */
611 packet_start(SSH_CMSG_AUTH_TIS);
615 type = packet_read(&payload_len);
616 if (type != SSH_SMSG_FAILURE &&
617 type != SSH_SMSG_AUTH_TIS_CHALLENGE) {
618 packet_disconnect("Protocol error: got %d in response "
619 "to skey-auth", type);
621 if (type != SSH_SMSG_AUTH_TIS_CHALLENGE) {
622 debug("No challenge for skey authentication.");
625 challenge = packet_get_string(&clen);
626 packet_integrity_check(payload_len, (4 + clen), type);
627 if (options.cipher == SSH_CIPHER_NONE)
628 log("WARNING: Encryption is disabled! "
629 "Reponse will be transmitted in clear text.");
630 fprintf(stderr, "%s\n", challenge);
633 for (i = 0; i < options.number_of_password_prompts; i++) {
635 error("Permission denied, please try again.");
636 response = read_passphrase("Response: ", 0);
637 packet_start(SSH_CMSG_AUTH_TIS_RESPONSE);
638 packet_put_string(response, strlen(response));
639 memset(response, 0, strlen(response));
643 type = packet_read(&payload_len);
644 if (type == SSH_SMSG_SUCCESS)
646 if (type != SSH_SMSG_FAILURE)
647 packet_disconnect("Protocol error: got %d in response "
648 "to skey-auth-reponse", type);
655 * Tries to authenticate with plain passwd authentication.
658 try_password_authentication(char *prompt)
660 int type, i, payload_len;
663 debug("Doing password authentication.");
664 if (options.cipher == SSH_CIPHER_NONE)
665 log("WARNING: Encryption is disabled! Password will be transmitted in clear text.");
666 for (i = 0; i < options.number_of_password_prompts; i++) {
668 error("Permission denied, please try again.");
669 password = read_passphrase(prompt, 0);
670 packet_start(SSH_CMSG_AUTH_PASSWORD);
671 packet_put_string(password, strlen(password));
672 memset(password, 0, strlen(password));
677 type = packet_read(&payload_len);
678 if (type == SSH_SMSG_SUCCESS)
680 if (type != SSH_SMSG_FAILURE)
681 packet_disconnect("Protocol error: got %d in response to passwd auth", type);
691 ssh_kex(char *host, struct sockaddr *hostaddr)
699 int ssh_cipher_default = SSH_CIPHER_3DES;
700 unsigned char session_key[SSH_SESSION_KEY_LENGTH];
701 unsigned char cookie[8];
702 unsigned int supported_ciphers;
703 unsigned int server_flags, client_flags;
704 int payload_len, clen, sum_len = 0;
707 debug("Waiting for server public key.");
709 /* Wait for a public key packet from the server. */
710 packet_read_expect(&payload_len, SSH_SMSG_PUBLIC_KEY);
712 /* Get cookie from the packet. */
713 for (i = 0; i < 8; i++)
714 cookie[i] = packet_get_char();
716 /* Get the public key. */
717 public_key = RSA_new();
718 bits = packet_get_int();/* bits */
719 public_key->e = BN_new();
720 packet_get_bignum(public_key->e, &clen);
722 public_key->n = BN_new();
723 packet_get_bignum(public_key->n, &clen);
726 rbits = BN_num_bits(public_key->n);
728 log("Warning: Server lies about size of server public key: "
729 "actual size is %d bits vs. announced %d.", rbits, bits);
730 log("Warning: This may be due to an old implementation of ssh.");
732 /* Get the host key. */
733 host_key = RSA_new();
734 bits = packet_get_int();/* bits */
735 host_key->e = BN_new();
736 packet_get_bignum(host_key->e, &clen);
738 host_key->n = BN_new();
739 packet_get_bignum(host_key->n, &clen);
742 rbits = BN_num_bits(host_key->n);
744 log("Warning: Server lies about size of server host key: "
745 "actual size is %d bits vs. announced %d.", rbits, bits);
746 log("Warning: This may be due to an old implementation of ssh.");
749 /* Get protocol flags. */
750 server_flags = packet_get_int();
751 packet_set_protocol_flags(server_flags);
753 supported_ciphers = packet_get_int();
754 supported_authentications = packet_get_int();
756 debug("Received server public key (%d bits) and host key (%d bits).",
757 BN_num_bits(public_key->n), BN_num_bits(host_key->n));
759 packet_integrity_check(payload_len,
760 8 + 4 + sum_len + 0 + 4 + 0 + 0 + 4 + 4 + 4,
761 SSH_SMSG_PUBLIC_KEY);
764 check_host_key(host, hostaddr, &k,
765 options.user_hostfile, options.system_hostfile);
767 client_flags = SSH_PROTOFLAG_SCREEN_NUMBER | SSH_PROTOFLAG_HOST_IN_FWD_OPEN;
769 compute_session_id(session_id, cookie, host_key->n, public_key->n);
771 /* Generate a session key. */
775 * Generate an encryption key for the session. The key is a 256 bit
776 * random number, interpreted as a 32-byte key, with the least
777 * significant 8 bits being the first byte of the key.
779 for (i = 0; i < 32; i++) {
782 session_key[i] = rand & 0xff;
787 * According to the protocol spec, the first byte of the session key
788 * is the highest byte of the integer. The session key is xored with
789 * the first 16 bytes of the session id.
793 for (i = 0; i < SSH_SESSION_KEY_LENGTH; i++) {
794 BN_lshift(key, key, 8);
796 BN_add_word(key, session_key[i] ^ session_id[i]);
798 BN_add_word(key, session_key[i]);
802 * Encrypt the integer using the public key and host key of the
803 * server (key with smaller modulus first).
805 if (BN_cmp(public_key->n, host_key->n) < 0) {
806 /* Public key has smaller modulus. */
807 if (BN_num_bits(host_key->n) <
808 BN_num_bits(public_key->n) + SSH_KEY_BITS_RESERVED) {
809 fatal("respond_to_rsa_challenge: host_key %d < public_key %d + "
810 "SSH_KEY_BITS_RESERVED %d",
811 BN_num_bits(host_key->n),
812 BN_num_bits(public_key->n),
813 SSH_KEY_BITS_RESERVED);
815 rsa_public_encrypt(key, key, public_key);
816 rsa_public_encrypt(key, key, host_key);
818 /* Host key has smaller modulus (or they are equal). */
819 if (BN_num_bits(public_key->n) <
820 BN_num_bits(host_key->n) + SSH_KEY_BITS_RESERVED) {
821 fatal("respond_to_rsa_challenge: public_key %d < host_key %d + "
822 "SSH_KEY_BITS_RESERVED %d",
823 BN_num_bits(public_key->n),
824 BN_num_bits(host_key->n),
825 SSH_KEY_BITS_RESERVED);
827 rsa_public_encrypt(key, key, host_key);
828 rsa_public_encrypt(key, key, public_key);
831 /* Destroy the public keys since we no longer need them. */
832 RSA_free(public_key);
835 if (options.cipher == SSH_CIPHER_ILLEGAL) {
836 log("No valid SSH1 cipher, using %.100s instead.",
837 cipher_name(SSH_FALLBACK_CIPHER));
838 options.cipher = SSH_FALLBACK_CIPHER;
839 } else if (options.cipher == SSH_CIPHER_NOT_SET) {
840 if (cipher_mask1() & supported_ciphers & (1 << ssh_cipher_default))
841 options.cipher = ssh_cipher_default;
843 debug("Cipher %s not supported, using %.100s instead.",
844 cipher_name(ssh_cipher_default),
845 cipher_name(SSH_FALLBACK_CIPHER));
846 options.cipher = SSH_FALLBACK_CIPHER;
849 /* Check that the selected cipher is supported. */
850 if (!(supported_ciphers & (1 << options.cipher)))
851 fatal("Selected cipher type %.100s not supported by server.",
852 cipher_name(options.cipher));
854 debug("Encryption type: %.100s", cipher_name(options.cipher));
856 /* Send the encrypted session key to the server. */
857 packet_start(SSH_CMSG_SESSION_KEY);
858 packet_put_char(options.cipher);
860 /* Send the cookie back to the server. */
861 for (i = 0; i < 8; i++)
862 packet_put_char(cookie[i]);
864 /* Send and destroy the encrypted encryption key integer. */
865 packet_put_bignum(key);
868 /* Send protocol flags. */
869 packet_put_int(client_flags);
871 /* Send the packet now. */
875 debug("Sent encrypted session key.");
877 /* Set the encryption key. */
878 packet_set_encryption_key(session_key, SSH_SESSION_KEY_LENGTH, options.cipher);
880 /* We will no longer need the session key here. Destroy any extra copies. */
881 memset(session_key, 0, sizeof(session_key));
884 * Expect a success message from the server. Note that this message
885 * will be received in encrypted form.
887 packet_read_expect(&payload_len, SSH_SMSG_SUCCESS);
889 debug("Received encrypted confirmation.");
897 const char* local_user,
898 const char* server_user,
900 int host_key_valid, RSA *own_host_key)
905 if (supported_authentications == 0)
906 fatal("ssh_userauth: server supports no auth methods");
908 /* Send the name of the user to log in as on the server. */
909 packet_start(SSH_CMSG_USER);
910 packet_put_string(server_user, strlen(server_user));
915 * The server should respond with success if no authentication is
916 * needed (the user has no password). Otherwise the server responds
919 type = packet_read(&payload_len);
921 /* check whether the connection was accepted without authentication. */
922 if (type == SSH_SMSG_SUCCESS)
924 if (type != SSH_SMSG_FAILURE)
925 packet_disconnect("Protocol error: got %d in response to SSH_CMSG_USER",
929 /* Try Kerberos tgt passing if the server supports it. */
930 if ((supported_authentications & (1 << SSH_PASS_KERBEROS_TGT)) &&
931 options.kerberos_tgt_passing) {
932 if (options.cipher == SSH_CIPHER_NONE)
933 log("WARNING: Encryption is disabled! Ticket will be transmitted in the clear!");
934 (void) send_kerberos_tgt();
936 /* Try AFS token passing if the server supports it. */
937 if ((supported_authentications & (1 << SSH_PASS_AFS_TOKEN)) &&
938 options.afs_token_passing && k_hasafs()) {
939 if (options.cipher == SSH_CIPHER_NONE)
940 log("WARNING: Encryption is disabled! Token will be transmitted in the clear!");
946 if ((supported_authentications & (1 << SSH_AUTH_KERBEROS)) &&
947 options.kerberos_authentication) {
948 debug("Trying Kerberos authentication.");
949 if (try_kerberos_authentication()) {
950 /* The server should respond with success or failure. */
951 type = packet_read(&payload_len);
952 if (type == SSH_SMSG_SUCCESS)
954 if (type != SSH_SMSG_FAILURE)
955 packet_disconnect("Protocol error: got %d in response to Kerberos auth", type);
961 * Use rhosts authentication if running in privileged socket and we
962 * do not wish to remain anonymous.
964 if ((supported_authentications & (1 << SSH_AUTH_RHOSTS)) &&
965 options.rhosts_authentication) {
966 debug("Trying rhosts authentication.");
967 packet_start(SSH_CMSG_AUTH_RHOSTS);
968 packet_put_string(local_user, strlen(local_user));
972 /* The server should respond with success or failure. */
973 type = packet_read(&payload_len);
974 if (type == SSH_SMSG_SUCCESS)
976 if (type != SSH_SMSG_FAILURE)
977 packet_disconnect("Protocol error: got %d in response to rhosts auth",
981 * Try .rhosts or /etc/hosts.equiv authentication with RSA host
984 if ((supported_authentications & (1 << SSH_AUTH_RHOSTS_RSA)) &&
985 options.rhosts_rsa_authentication && host_key_valid) {
986 if (try_rhosts_rsa_authentication(local_user, own_host_key))
989 /* Try RSA authentication if the server supports it. */
990 if ((supported_authentications & (1 << SSH_AUTH_RSA)) &&
991 options.rsa_authentication) {
993 * Try RSA authentication using the authentication agent. The
994 * agent is tried first because no passphrase is needed for
995 * it, whereas identity files may require passphrases.
997 if (try_agent_authentication())
1000 /* Try RSA authentication for each identity. */
1001 for (i = 0; i < options.num_identity_files; i++)
1002 if (try_rsa_authentication(options.identity_files[i]))
1005 /* Try skey authentication if the server supports it. */
1006 if ((supported_authentications & (1 << SSH_AUTH_TIS)) &&
1007 options.skey_authentication && !options.batch_mode) {
1008 if (try_skey_authentication())
1011 /* Try password authentication if the server supports it. */
1012 if ((supported_authentications & (1 << SSH_AUTH_PASSWORD)) &&
1013 options.password_authentication && !options.batch_mode) {
1016 snprintf(prompt, sizeof(prompt), "%.30s@%.40s's password: ",
1018 if (try_password_authentication(prompt))
1021 /* All authentication methods have failed. Exit with an error message. */
1022 fatal("Permission denied.");