2 * Author: Tatu Ylonen <ylo@cs.hut.fi>
3 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
5 * Code to connect to a remote host, and to perform the client side of the
6 * login (authentication) dialog.
8 * As far as I am concerned, the code I have written for this software
9 * can be used freely for any purpose. Any derived versions of this
10 * software must be clearly marked as such, and if the derived work is
11 * incompatible with the protocol description in the RFC file, it must be
12 * called by a name other than "ssh" or "Secure Shell".
16 RCSID("$OpenBSD: sshconnect1.c,v 1.8 2000/10/12 09:59:19 markus Exp $");
18 #include <openssl/bn.h>
19 #include <openssl/dsa.h>
20 #include <openssl/rsa.h>
21 #include <openssl/evp.h>
33 #include "sshconnect.h"
36 /* Session id for the current session. */
37 unsigned char session_id[16];
38 unsigned int supported_authentications = 0;
40 extern Options options;
41 extern char *__progname;
44 * Checks if the user has an authentication agent, and if so, tries to
45 * authenticate using the agent.
48 try_agent_authentication()
52 AuthenticationConnection *auth;
53 unsigned char response[16];
59 /* Get connection to the agent. */
60 auth = ssh_get_authentication_connection();
65 key = key_new(KEY_RSA);
67 /* Loop through identities served by the agent. */
68 for (key = ssh_get_first_identity(auth, &comment, 1);
70 key = ssh_get_next_identity(auth, &comment, 1)) {
72 /* Try this identity. */
73 debug("Trying RSA authentication via agent with '%.100s'", comment);
76 /* Tell the server that we are willing to authenticate using this key. */
77 packet_start(SSH_CMSG_AUTH_RSA);
78 packet_put_bignum(key->rsa->n);
82 /* Wait for server's response. */
83 type = packet_read(&plen);
85 /* The server sends failure if it doesn\'t like our key or
86 does not support RSA authentication. */
87 if (type == SSH_SMSG_FAILURE) {
88 debug("Server refused our key.");
92 /* Otherwise it should have sent a challenge. */
93 if (type != SSH_SMSG_AUTH_RSA_CHALLENGE)
94 packet_disconnect("Protocol error during RSA authentication: %d",
97 packet_get_bignum(challenge, &clen);
99 packet_integrity_check(plen, clen, type);
101 debug("Received RSA challenge from server.");
103 /* Ask the agent to decrypt the challenge. */
104 if (!ssh_decrypt_challenge(auth, key, challenge, session_id, 1, response)) {
106 * The agent failed to authenticate this identifier
107 * although it advertised it supports this. Just
108 * return a wrong value.
110 log("Authentication agent failed to decrypt challenge.");
111 memset(response, 0, sizeof(response));
114 debug("Sending response to RSA challenge.");
116 /* Send the decrypted challenge back to the server. */
117 packet_start(SSH_CMSG_AUTH_RSA_RESPONSE);
118 for (i = 0; i < 16; i++)
119 packet_put_char(response[i]);
123 /* Wait for response from the server. */
124 type = packet_read(&plen);
126 /* The server returns success if it accepted the authentication. */
127 if (type == SSH_SMSG_SUCCESS) {
128 BN_clear_free(challenge);
129 debug("RSA authentication accepted by server.");
132 /* Otherwise it should return failure. */
133 if (type != SSH_SMSG_FAILURE)
134 packet_disconnect("Protocol error waiting RSA auth response: %d",
137 BN_clear_free(challenge);
138 debug("RSA authentication using agent refused.");
143 * Computes the proper response to a RSA challenge, and sends the response to
147 respond_to_rsa_challenge(BIGNUM * challenge, RSA * prv)
149 unsigned char buf[32], response[16];
153 /* Decrypt the challenge using the private key. */
154 rsa_private_decrypt(challenge, challenge, prv);
156 /* Compute the response. */
157 /* The response is MD5 of decrypted challenge plus session id. */
158 len = BN_num_bytes(challenge);
159 if (len <= 0 || len > sizeof(buf))
160 packet_disconnect("respond_to_rsa_challenge: bad challenge length %d",
163 memset(buf, 0, sizeof(buf));
164 BN_bn2bin(challenge, buf + sizeof(buf) - len);
166 MD5_Update(&md, buf, 32);
167 MD5_Update(&md, session_id, 16);
168 MD5_Final(response, &md);
170 debug("Sending response to host key RSA challenge.");
172 /* Send the response back to the server. */
173 packet_start(SSH_CMSG_AUTH_RSA_RESPONSE);
174 for (i = 0; i < 16; i++)
175 packet_put_char(response[i]);
179 memset(buf, 0, sizeof(buf));
180 memset(response, 0, sizeof(response));
181 memset(&md, 0, sizeof(md));
185 * Checks if the user has authentication file, and if so, tries to authenticate
189 try_rsa_authentication(const char *authfile)
194 char *passphrase, *comment;
198 /* Try to load identification for the authentication key. */
199 public = key_new(KEY_RSA);
200 if (!load_public_key(authfile, public, &comment)) {
202 /* Could not load it. Fail. */
205 debug("Trying RSA authentication with key '%.100s'", comment);
207 /* Tell the server that we are willing to authenticate using this key. */
208 packet_start(SSH_CMSG_AUTH_RSA);
209 packet_put_bignum(public->rsa->n);
213 /* We no longer need the public key. */
216 /* Wait for server's response. */
217 type = packet_read(&plen);
220 * The server responds with failure if it doesn\'t like our key or
221 * doesn\'t support RSA authentication.
223 if (type == SSH_SMSG_FAILURE) {
224 debug("Server refused our key.");
228 /* Otherwise, the server should respond with a challenge. */
229 if (type != SSH_SMSG_AUTH_RSA_CHALLENGE)
230 packet_disconnect("Protocol error during RSA authentication: %d", type);
232 /* Get the challenge from the packet. */
233 challenge = BN_new();
234 packet_get_bignum(challenge, &clen);
236 packet_integrity_check(plen, clen, type);
238 debug("Received RSA challenge from server.");
240 private = key_new(KEY_RSA);
242 * Load the private key. Try first with empty passphrase; if it
243 * fails, ask for a passphrase.
245 if (!load_private_key(authfile, "", private, NULL)) {
247 snprintf(buf, sizeof buf, "Enter passphrase for RSA key '%.100s': ",
249 if (!options.batch_mode)
250 passphrase = read_passphrase(buf, 0);
252 debug("Will not query passphrase for %.100s in batch mode.",
254 passphrase = xstrdup("");
257 /* Load the authentication file using the pasphrase. */
258 if (!load_private_key(authfile, passphrase, private, NULL)) {
259 memset(passphrase, 0, strlen(passphrase));
261 error("Bad passphrase.");
263 /* Send a dummy response packet to avoid protocol error. */
264 packet_start(SSH_CMSG_AUTH_RSA_RESPONSE);
265 for (i = 0; i < 16; i++)
270 /* Expect the server to reject it... */
271 packet_read_expect(&plen, SSH_SMSG_FAILURE);
275 /* Destroy the passphrase. */
276 memset(passphrase, 0, strlen(passphrase));
279 /* We no longer need the comment. */
282 /* Compute and send a response to the challenge. */
283 respond_to_rsa_challenge(challenge, private->rsa);
285 /* Destroy the private key. */
288 /* We no longer need the challenge. */
289 BN_clear_free(challenge);
291 /* Wait for response from the server. */
292 type = packet_read(&plen);
293 if (type == SSH_SMSG_SUCCESS) {
294 debug("RSA authentication accepted by server.");
297 if (type != SSH_SMSG_FAILURE)
298 packet_disconnect("Protocol error waiting RSA auth response: %d", type);
299 debug("RSA authentication refused.");
304 * Tries to authenticate the user using combined rhosts or /etc/hosts.equiv
305 * authentication and RSA host authentication.
308 try_rhosts_rsa_authentication(const char *local_user, RSA * host_key)
314 debug("Trying rhosts or /etc/hosts.equiv with RSA host authentication.");
316 /* Tell the server that we are willing to authenticate using this key. */
317 packet_start(SSH_CMSG_AUTH_RHOSTS_RSA);
318 packet_put_string(local_user, strlen(local_user));
319 packet_put_int(BN_num_bits(host_key->n));
320 packet_put_bignum(host_key->e);
321 packet_put_bignum(host_key->n);
325 /* Wait for server's response. */
326 type = packet_read(&plen);
328 /* The server responds with failure if it doesn't admit our
329 .rhosts authentication or doesn't know our host key. */
330 if (type == SSH_SMSG_FAILURE) {
331 debug("Server refused our rhosts authentication or host key.");
334 /* Otherwise, the server should respond with a challenge. */
335 if (type != SSH_SMSG_AUTH_RSA_CHALLENGE)
336 packet_disconnect("Protocol error during RSA authentication: %d", type);
338 /* Get the challenge from the packet. */
339 challenge = BN_new();
340 packet_get_bignum(challenge, &clen);
342 packet_integrity_check(plen, clen, type);
344 debug("Received RSA challenge for host key from server.");
346 /* Compute a response to the challenge. */
347 respond_to_rsa_challenge(challenge, host_key);
349 /* We no longer need the challenge. */
350 BN_clear_free(challenge);
352 /* Wait for response from the server. */
353 type = packet_read(&plen);
354 if (type == SSH_SMSG_SUCCESS) {
355 debug("Rhosts or /etc/hosts.equiv with RSA host authentication accepted by server.");
358 if (type != SSH_SMSG_FAILURE)
359 packet_disconnect("Protocol error waiting RSA auth response: %d", type);
360 debug("Rhosts or /etc/hosts.equiv with RSA host authentication refused.");
366 try_kerberos_authentication()
368 KTEXT_ST auth; /* Kerberos data */
375 Key_schedule schedule;
376 u_long checksum, cksum;
378 struct sockaddr_in local, foreign;
381 /* Don't do anything if we don't have any tickets. */
382 if (stat(tkt_string(), &st) < 0)
385 strncpy(inst, (char *) krb_get_phost(get_canonical_hostname()), INST_SZ);
387 realm = (char *) krb_realmofhost(get_canonical_hostname());
389 debug("Kerberos V4: no realm for %s", get_canonical_hostname());
392 /* This can really be anything. */
393 checksum = (u_long) getpid();
395 r = krb_mk_req(&auth, KRB4_SERVICE_NAME, inst, realm, checksum);
397 debug("Kerberos V4 krb_mk_req failed: %s", krb_err_txt[r]);
400 /* Get session key to decrypt the server's reply with. */
401 r = krb_get_cred(KRB4_SERVICE_NAME, inst, realm, &cred);
403 debug("get_cred failed: %s", krb_err_txt[r]);
406 des_key_sched((des_cblock *) cred.session, schedule);
408 /* Send authentication info to server. */
409 packet_start(SSH_CMSG_AUTH_KERBEROS);
410 packet_put_string((char *) auth.dat, auth.length);
414 /* Zero the buffer. */
415 (void) memset(auth.dat, 0, MAX_KTXT_LEN);
417 slen = sizeof(local);
418 memset(&local, 0, sizeof(local));
419 if (getsockname(packet_get_connection_in(),
420 (struct sockaddr *) & local, &slen) < 0)
421 debug("getsockname failed: %s", strerror(errno));
423 slen = sizeof(foreign);
424 memset(&foreign, 0, sizeof(foreign));
425 if (getpeername(packet_get_connection_in(),
426 (struct sockaddr *) & foreign, &slen) < 0) {
427 debug("getpeername failed: %s", strerror(errno));
430 /* Get server reply. */
431 type = packet_read(&plen);
433 case SSH_SMSG_FAILURE:
434 /* Should really be SSH_SMSG_AUTH_KERBEROS_FAILURE */
435 debug("Kerberos V4 authentication failed.");
439 case SSH_SMSG_AUTH_KERBEROS_RESPONSE:
440 /* SSH_SMSG_AUTH_KERBEROS_SUCCESS */
441 debug("Kerberos V4 authentication accepted.");
443 /* Get server's response. */
444 reply = packet_get_string((unsigned int *) &auth.length);
445 memcpy(auth.dat, reply, auth.length);
448 packet_integrity_check(plen, 4 + auth.length, type);
451 * If his response isn't properly encrypted with the session
452 * key, and the decrypted checksum fails to match, he's
455 r = krb_rd_priv(auth.dat, auth.length, schedule, &cred.session,
456 &foreign, &local, &msg_data);
458 debug("Kerberos V4 krb_rd_priv failed: %s", krb_err_txt[r]);
459 packet_disconnect("Kerberos V4 challenge failed!");
461 /* Fetch the (incremented) checksum that we supplied in the request. */
462 (void) memcpy((char *) &cksum, (char *) msg_data.app_data, sizeof(cksum));
463 cksum = ntohl(cksum);
465 /* If it matches, we're golden. */
466 if (cksum == checksum + 1) {
467 debug("Kerberos V4 challenge successful.");
470 packet_disconnect("Kerberos V4 challenge failed!");
474 packet_disconnect("Protocol error on Kerberos V4 response: %d", type);
486 char pname[ANAME_SZ], pinst[INST_SZ], prealm[REALM_SZ];
491 /* Don't do anything if we don't have any tickets. */
492 if (stat(tkt_string(), &st) < 0)
495 creds = xmalloc(sizeof(*creds));
497 if ((r = krb_get_tf_fullname(TKT_FILE, pname, pinst, prealm)) != KSUCCESS) {
498 debug("Kerberos V4 tf_fullname failed: %s", krb_err_txt[r]);
501 if ((r = krb_get_cred("krbtgt", prealm, prealm, creds)) != GC_OK) {
502 debug("Kerberos V4 get_cred failed: %s", krb_err_txt[r]);
505 if (time(0) > krb_life_to_time(creds->issue_date, creds->lifetime)) {
506 debug("Kerberos V4 ticket expired: %s", TKT_FILE);
509 creds_to_radix(creds, (unsigned char *)buffer, sizeof buffer);
512 packet_start(SSH_CMSG_HAVE_KERBEROS_TGT);
513 packet_put_string(buffer, strlen(buffer));
517 type = packet_read(&plen);
519 if (type == SSH_SMSG_FAILURE)
520 debug("Kerberos TGT for realm %s rejected.", prealm);
521 else if (type != SSH_SMSG_SUCCESS)
522 packet_disconnect("Protocol error on Kerberos TGT response: %d", type);
528 send_afs_tokens(void)
531 struct ViceIoctl parms;
532 struct ClearToken ct;
533 int i, type, len, plen;
534 char buf[2048], *p, *server_cell;
537 /* Move over ktc_GetToken, here's something leaner. */
538 for (i = 0; i < 100; i++) { /* just in case */
539 parms.in = (char *) &i;
540 parms.in_size = sizeof(i);
542 parms.out_size = sizeof(buf);
543 if (k_pioctl(0, VIOCGETTOK, &parms, 0) != 0)
547 /* Get secret token. */
548 memcpy(&creds.ticket_st.length, p, sizeof(unsigned int));
549 if (creds.ticket_st.length > MAX_KTXT_LEN)
551 p += sizeof(unsigned int);
552 memcpy(creds.ticket_st.dat, p, creds.ticket_st.length);
553 p += creds.ticket_st.length;
555 /* Get clear token. */
556 memcpy(&len, p, sizeof(len));
557 if (len != sizeof(struct ClearToken))
562 p += sizeof(len); /* primary flag */
565 /* Flesh out our credentials. */
566 strlcpy(creds.service, "afs", sizeof creds.service);
567 creds.instance[0] = '\0';
568 strlcpy(creds.realm, server_cell, REALM_SZ);
569 memcpy(creds.session, ct.HandShakeKey, DES_KEY_SZ);
570 creds.issue_date = ct.BeginTimestamp;
571 creds.lifetime = krb_time_to_life(creds.issue_date, ct.EndTimestamp);
572 creds.kvno = ct.AuthHandle;
573 snprintf(creds.pname, sizeof(creds.pname), "AFS ID %d", ct.ViceId);
574 creds.pinst[0] = '\0';
576 /* Encode token, ship it off. */
577 if (creds_to_radix(&creds, (unsigned char*) buffer, sizeof buffer) <= 0)
579 packet_start(SSH_CMSG_HAVE_AFS_TOKEN);
580 packet_put_string(buffer, strlen(buffer));
584 /* Roger, Roger. Clearance, Clarence. What's your vector,
586 type = packet_read(&plen);
588 if (type == SSH_SMSG_FAILURE)
589 debug("AFS token for cell %s rejected.", server_cell);
590 else if (type != SSH_SMSG_SUCCESS)
591 packet_disconnect("Protocol error on AFS token response: %d", type);
598 * Tries to authenticate with any string-based challenge/response system.
599 * Note that the client code is not tied to s/key or TIS.
602 try_skey_authentication()
607 char *challenge, *response;
609 debug("Doing skey authentication.");
611 /* request a challenge */
612 packet_start(SSH_CMSG_AUTH_TIS);
616 type = packet_read(&payload_len);
617 if (type != SSH_SMSG_FAILURE &&
618 type != SSH_SMSG_AUTH_TIS_CHALLENGE) {
619 packet_disconnect("Protocol error: got %d in response "
620 "to skey-auth", type);
622 if (type != SSH_SMSG_AUTH_TIS_CHALLENGE) {
623 debug("No challenge for skey authentication.");
626 challenge = packet_get_string(&clen);
627 packet_integrity_check(payload_len, (4 + clen), type);
628 if (options.cipher == SSH_CIPHER_NONE)
629 log("WARNING: Encryption is disabled! "
630 "Reponse will be transmitted in clear text.");
631 fprintf(stderr, "%s\n", challenge);
634 for (i = 0; i < options.number_of_password_prompts; i++) {
636 error("Permission denied, please try again.");
637 response = read_passphrase("Response: ", 0);
638 packet_start(SSH_CMSG_AUTH_TIS_RESPONSE);
639 packet_put_string(response, strlen(response));
640 memset(response, 0, strlen(response));
644 type = packet_read(&payload_len);
645 if (type == SSH_SMSG_SUCCESS)
647 if (type != SSH_SMSG_FAILURE)
648 packet_disconnect("Protocol error: got %d in response "
649 "to skey-auth-reponse", type);
656 * Tries to authenticate with plain passwd authentication.
659 try_password_authentication(char *prompt)
661 int type, i, payload_len;
664 debug("Doing password authentication.");
665 if (options.cipher == SSH_CIPHER_NONE)
666 log("WARNING: Encryption is disabled! Password will be transmitted in clear text.");
667 for (i = 0; i < options.number_of_password_prompts; i++) {
669 error("Permission denied, please try again.");
670 password = read_passphrase(prompt, 0);
671 packet_start(SSH_CMSG_AUTH_PASSWORD);
672 packet_put_string(password, strlen(password));
673 memset(password, 0, strlen(password));
678 type = packet_read(&payload_len);
679 if (type == SSH_SMSG_SUCCESS)
681 if (type != SSH_SMSG_FAILURE)
682 packet_disconnect("Protocol error: got %d in response to passwd auth", type);
692 ssh_kex(char *host, struct sockaddr *hostaddr)
700 int ssh_cipher_default = SSH_CIPHER_3DES;
701 unsigned char session_key[SSH_SESSION_KEY_LENGTH];
702 unsigned char cookie[8];
703 unsigned int supported_ciphers;
704 unsigned int server_flags, client_flags;
705 int payload_len, clen, sum_len = 0;
708 debug("Waiting for server public key.");
710 /* Wait for a public key packet from the server. */
711 packet_read_expect(&payload_len, SSH_SMSG_PUBLIC_KEY);
713 /* Get cookie from the packet. */
714 for (i = 0; i < 8; i++)
715 cookie[i] = packet_get_char();
717 /* Get the public key. */
718 public_key = RSA_new();
719 bits = packet_get_int();/* bits */
720 public_key->e = BN_new();
721 packet_get_bignum(public_key->e, &clen);
723 public_key->n = BN_new();
724 packet_get_bignum(public_key->n, &clen);
727 rbits = BN_num_bits(public_key->n);
729 log("Warning: Server lies about size of server public key: "
730 "actual size is %d bits vs. announced %d.", rbits, bits);
731 log("Warning: This may be due to an old implementation of ssh.");
733 /* Get the host key. */
734 host_key = RSA_new();
735 bits = packet_get_int();/* bits */
736 host_key->e = BN_new();
737 packet_get_bignum(host_key->e, &clen);
739 host_key->n = BN_new();
740 packet_get_bignum(host_key->n, &clen);
743 rbits = BN_num_bits(host_key->n);
745 log("Warning: Server lies about size of server host key: "
746 "actual size is %d bits vs. announced %d.", rbits, bits);
747 log("Warning: This may be due to an old implementation of ssh.");
750 /* Get protocol flags. */
751 server_flags = packet_get_int();
752 packet_set_protocol_flags(server_flags);
754 supported_ciphers = packet_get_int();
755 supported_authentications = packet_get_int();
757 debug("Received server public key (%d bits) and host key (%d bits).",
758 BN_num_bits(public_key->n), BN_num_bits(host_key->n));
760 packet_integrity_check(payload_len,
761 8 + 4 + sum_len + 0 + 4 + 0 + 0 + 4 + 4 + 4,
762 SSH_SMSG_PUBLIC_KEY);
765 check_host_key(host, hostaddr, &k,
766 options.user_hostfile, options.system_hostfile);
768 client_flags = SSH_PROTOFLAG_SCREEN_NUMBER | SSH_PROTOFLAG_HOST_IN_FWD_OPEN;
770 compute_session_id(session_id, cookie, host_key->n, public_key->n);
772 /* Generate a session key. */
776 * Generate an encryption key for the session. The key is a 256 bit
777 * random number, interpreted as a 32-byte key, with the least
778 * significant 8 bits being the first byte of the key.
780 for (i = 0; i < 32; i++) {
783 session_key[i] = rand & 0xff;
788 * According to the protocol spec, the first byte of the session key
789 * is the highest byte of the integer. The session key is xored with
790 * the first 16 bytes of the session id.
794 for (i = 0; i < SSH_SESSION_KEY_LENGTH; i++) {
795 BN_lshift(key, key, 8);
797 BN_add_word(key, session_key[i] ^ session_id[i]);
799 BN_add_word(key, session_key[i]);
803 * Encrypt the integer using the public key and host key of the
804 * server (key with smaller modulus first).
806 if (BN_cmp(public_key->n, host_key->n) < 0) {
807 /* Public key has smaller modulus. */
808 if (BN_num_bits(host_key->n) <
809 BN_num_bits(public_key->n) + SSH_KEY_BITS_RESERVED) {
810 fatal("respond_to_rsa_challenge: host_key %d < public_key %d + "
811 "SSH_KEY_BITS_RESERVED %d",
812 BN_num_bits(host_key->n),
813 BN_num_bits(public_key->n),
814 SSH_KEY_BITS_RESERVED);
816 rsa_public_encrypt(key, key, public_key);
817 rsa_public_encrypt(key, key, host_key);
819 /* Host key has smaller modulus (or they are equal). */
820 if (BN_num_bits(public_key->n) <
821 BN_num_bits(host_key->n) + SSH_KEY_BITS_RESERVED) {
822 fatal("respond_to_rsa_challenge: public_key %d < host_key %d + "
823 "SSH_KEY_BITS_RESERVED %d",
824 BN_num_bits(public_key->n),
825 BN_num_bits(host_key->n),
826 SSH_KEY_BITS_RESERVED);
828 rsa_public_encrypt(key, key, host_key);
829 rsa_public_encrypt(key, key, public_key);
832 /* Destroy the public keys since we no longer need them. */
833 RSA_free(public_key);
836 if (options.cipher == SSH_CIPHER_ILLEGAL) {
837 log("No valid SSH1 cipher, using %.100s instead.",
838 cipher_name(ssh_cipher_default));
839 options.cipher = ssh_cipher_default;
840 } else if (options.cipher == SSH_CIPHER_NOT_SET) {
841 if (cipher_mask_ssh1(1) & supported_ciphers & (1 << ssh_cipher_default))
842 options.cipher = ssh_cipher_default;
844 /* Check that the selected cipher is supported. */
845 if (!(supported_ciphers & (1 << options.cipher)))
846 fatal("Selected cipher type %.100s not supported by server.",
847 cipher_name(options.cipher));
849 debug("Encryption type: %.100s", cipher_name(options.cipher));
851 /* Send the encrypted session key to the server. */
852 packet_start(SSH_CMSG_SESSION_KEY);
853 packet_put_char(options.cipher);
855 /* Send the cookie back to the server. */
856 for (i = 0; i < 8; i++)
857 packet_put_char(cookie[i]);
859 /* Send and destroy the encrypted encryption key integer. */
860 packet_put_bignum(key);
863 /* Send protocol flags. */
864 packet_put_int(client_flags);
866 /* Send the packet now. */
870 debug("Sent encrypted session key.");
872 /* Set the encryption key. */
873 packet_set_encryption_key(session_key, SSH_SESSION_KEY_LENGTH, options.cipher);
875 /* We will no longer need the session key here. Destroy any extra copies. */
876 memset(session_key, 0, sizeof(session_key));
879 * Expect a success message from the server. Note that this message
880 * will be received in encrypted form.
882 packet_read_expect(&payload_len, SSH_SMSG_SUCCESS);
884 debug("Received encrypted confirmation.");
892 const char* local_user,
893 const char* server_user,
895 int host_key_valid, RSA *own_host_key)
900 if (supported_authentications == 0)
901 fatal("ssh_userauth: server supports no auth methods");
903 /* Send the name of the user to log in as on the server. */
904 packet_start(SSH_CMSG_USER);
905 packet_put_string(server_user, strlen(server_user));
910 * The server should respond with success if no authentication is
911 * needed (the user has no password). Otherwise the server responds
914 type = packet_read(&payload_len);
916 /* check whether the connection was accepted without authentication. */
917 if (type == SSH_SMSG_SUCCESS)
919 if (type != SSH_SMSG_FAILURE)
920 packet_disconnect("Protocol error: got %d in response to SSH_CMSG_USER",
924 /* Try Kerberos tgt passing if the server supports it. */
925 if ((supported_authentications & (1 << SSH_PASS_KERBEROS_TGT)) &&
926 options.kerberos_tgt_passing) {
927 if (options.cipher == SSH_CIPHER_NONE)
928 log("WARNING: Encryption is disabled! Ticket will be transmitted in the clear!");
929 (void) send_kerberos_tgt();
931 /* Try AFS token passing if the server supports it. */
932 if ((supported_authentications & (1 << SSH_PASS_AFS_TOKEN)) &&
933 options.afs_token_passing && k_hasafs()) {
934 if (options.cipher == SSH_CIPHER_NONE)
935 log("WARNING: Encryption is disabled! Token will be transmitted in the clear!");
941 if ((supported_authentications & (1 << SSH_AUTH_KERBEROS)) &&
942 options.kerberos_authentication) {
943 debug("Trying Kerberos authentication.");
944 if (try_kerberos_authentication()) {
945 /* The server should respond with success or failure. */
946 type = packet_read(&payload_len);
947 if (type == SSH_SMSG_SUCCESS)
949 if (type != SSH_SMSG_FAILURE)
950 packet_disconnect("Protocol error: got %d in response to Kerberos auth", type);
956 * Use rhosts authentication if running in privileged socket and we
957 * do not wish to remain anonymous.
959 if ((supported_authentications & (1 << SSH_AUTH_RHOSTS)) &&
960 options.rhosts_authentication) {
961 debug("Trying rhosts authentication.");
962 packet_start(SSH_CMSG_AUTH_RHOSTS);
963 packet_put_string(local_user, strlen(local_user));
967 /* The server should respond with success or failure. */
968 type = packet_read(&payload_len);
969 if (type == SSH_SMSG_SUCCESS)
971 if (type != SSH_SMSG_FAILURE)
972 packet_disconnect("Protocol error: got %d in response to rhosts auth",
976 * Try .rhosts or /etc/hosts.equiv authentication with RSA host
979 if ((supported_authentications & (1 << SSH_AUTH_RHOSTS_RSA)) &&
980 options.rhosts_rsa_authentication && host_key_valid) {
981 if (try_rhosts_rsa_authentication(local_user, own_host_key))
984 /* Try RSA authentication if the server supports it. */
985 if ((supported_authentications & (1 << SSH_AUTH_RSA)) &&
986 options.rsa_authentication) {
988 * Try RSA authentication using the authentication agent. The
989 * agent is tried first because no passphrase is needed for
990 * it, whereas identity files may require passphrases.
992 if (try_agent_authentication())
995 /* Try RSA authentication for each identity. */
996 for (i = 0; i < options.num_identity_files; i++)
997 if (try_rsa_authentication(options.identity_files[i]))
1000 /* Try skey authentication if the server supports it. */
1001 if ((supported_authentications & (1 << SSH_AUTH_TIS)) &&
1002 options.skey_authentication && !options.batch_mode) {
1003 if (try_skey_authentication())
1006 /* Try password authentication if the server supports it. */
1007 if ((supported_authentications & (1 << SSH_AUTH_PASSWORD)) &&
1008 options.password_authentication && !options.batch_mode) {
1011 snprintf(prompt, sizeof(prompt), "%.30s@%.40s's password: ",
1013 if (try_password_authentication(prompt))
1016 /* All authentication methods have failed. Exit with an error message. */
1017 fatal("Permission denied.");