2 * Author: Tatu Ylonen <ylo@cs.hut.fi>
3 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
5 * Code to connect to a remote host, and to perform the client side of the
6 * login (authentication) dialog.
8 * As far as I am concerned, the code I have written for this software
9 * can be used freely for any purpose. Any derived versions of this
10 * software must be clearly marked as such, and if the derived work is
11 * incompatible with the protocol description in the RFC file, it must be
12 * called by a name other than "ssh" or "Secure Shell".
16 RCSID("$OpenBSD: sshconnect1.c,v 1.25 2001/02/08 23:11:43 dugsong Exp $");
18 #include <openssl/bn.h>
19 #include <openssl/evp.h>
41 #include "sshconnect.h"
47 /* Session id for the current session. */
48 u_char session_id[16];
49 u_int supported_authentications = 0;
51 extern Options options;
52 extern char *__progname;
55 ssh1_put_password(char *password)
60 size = roundup(strlen(password), 32);
61 padded = xmalloc(size);
62 strlcpy(padded, password, size);
63 packet_put_string(padded, size);
64 memset(padded, 0, size);
69 * Checks if the user has an authentication agent, and if so, tries to
70 * authenticate using the agent.
73 try_agent_authentication(void)
77 AuthenticationConnection *auth;
84 /* Get connection to the agent. */
85 auth = ssh_get_authentication_connection();
91 /* Loop through identities served by the agent. */
92 for (key = ssh_get_first_identity(auth, &comment, 1);
94 key = ssh_get_next_identity(auth, &comment, 1)) {
96 /* Try this identity. */
97 debug("Trying RSA authentication via agent with '%.100s'", comment);
100 /* Tell the server that we are willing to authenticate using this key. */
101 packet_start(SSH_CMSG_AUTH_RSA);
102 packet_put_bignum(key->rsa->n);
106 /* Wait for server's response. */
107 type = packet_read(&plen);
109 /* The server sends failure if it doesn\'t like our key or
110 does not support RSA authentication. */
111 if (type == SSH_SMSG_FAILURE) {
112 debug("Server refused our key.");
116 /* Otherwise it should have sent a challenge. */
117 if (type != SSH_SMSG_AUTH_RSA_CHALLENGE)
118 packet_disconnect("Protocol error during RSA authentication: %d",
121 packet_get_bignum(challenge, &clen);
123 packet_integrity_check(plen, clen, type);
125 debug("Received RSA challenge from server.");
127 /* Ask the agent to decrypt the challenge. */
128 if (!ssh_decrypt_challenge(auth, key, challenge, session_id, 1, response)) {
130 * The agent failed to authenticate this identifier
131 * although it advertised it supports this. Just
132 * return a wrong value.
134 log("Authentication agent failed to decrypt challenge.");
135 memset(response, 0, sizeof(response));
138 debug("Sending response to RSA challenge.");
140 /* Send the decrypted challenge back to the server. */
141 packet_start(SSH_CMSG_AUTH_RSA_RESPONSE);
142 for (i = 0; i < 16; i++)
143 packet_put_char(response[i]);
147 /* Wait for response from the server. */
148 type = packet_read(&plen);
150 /* The server returns success if it accepted the authentication. */
151 if (type == SSH_SMSG_SUCCESS) {
152 ssh_close_authentication_connection(auth);
153 BN_clear_free(challenge);
154 debug("RSA authentication accepted by server.");
157 /* Otherwise it should return failure. */
158 if (type != SSH_SMSG_FAILURE)
159 packet_disconnect("Protocol error waiting RSA auth response: %d",
162 ssh_close_authentication_connection(auth);
163 BN_clear_free(challenge);
164 debug("RSA authentication using agent refused.");
169 * Computes the proper response to a RSA challenge, and sends the response to
173 respond_to_rsa_challenge(BIGNUM * challenge, RSA * prv)
175 u_char buf[32], response[16];
179 /* Decrypt the challenge using the private key. */
180 /* XXX think about Bleichenbacher, too */
181 if (rsa_private_decrypt(challenge, challenge, prv) <= 0)
183 "respond_to_rsa_challenge: rsa_private_decrypt failed");
185 /* Compute the response. */
186 /* The response is MD5 of decrypted challenge plus session id. */
187 len = BN_num_bytes(challenge);
188 if (len <= 0 || len > sizeof(buf))
190 "respond_to_rsa_challenge: bad challenge length %d", len);
192 memset(buf, 0, sizeof(buf));
193 BN_bn2bin(challenge, buf + sizeof(buf) - len);
195 MD5_Update(&md, buf, 32);
196 MD5_Update(&md, session_id, 16);
197 MD5_Final(response, &md);
199 debug("Sending response to host key RSA challenge.");
201 /* Send the response back to the server. */
202 packet_start(SSH_CMSG_AUTH_RSA_RESPONSE);
203 for (i = 0; i < 16; i++)
204 packet_put_char(response[i]);
208 memset(buf, 0, sizeof(buf));
209 memset(response, 0, sizeof(response));
210 memset(&md, 0, sizeof(md));
214 * Checks if the user has authentication file, and if so, tries to authenticate
218 try_rsa_authentication(const char *authfile)
223 char *passphrase, *comment;
227 /* Try to load identification for the authentication key. */
228 public = key_new(KEY_RSA1);
229 if (!load_public_key(authfile, public, &comment)) {
231 /* Could not load it. Fail. */
234 debug("Trying RSA authentication with key '%.100s'", comment);
236 /* Tell the server that we are willing to authenticate using this key. */
237 packet_start(SSH_CMSG_AUTH_RSA);
238 packet_put_bignum(public->rsa->n);
242 /* We no longer need the public key. */
245 /* Wait for server's response. */
246 type = packet_read(&plen);
249 * The server responds with failure if it doesn\'t like our key or
250 * doesn\'t support RSA authentication.
252 if (type == SSH_SMSG_FAILURE) {
253 debug("Server refused our key.");
257 /* Otherwise, the server should respond with a challenge. */
258 if (type != SSH_SMSG_AUTH_RSA_CHALLENGE)
259 packet_disconnect("Protocol error during RSA authentication: %d", type);
261 /* Get the challenge from the packet. */
262 challenge = BN_new();
263 packet_get_bignum(challenge, &clen);
265 packet_integrity_check(plen, clen, type);
267 debug("Received RSA challenge from server.");
269 private = key_new(KEY_RSA1);
271 * Load the private key. Try first with empty passphrase; if it
272 * fails, ask for a passphrase.
274 if (!load_private_key(authfile, "", private, NULL)) {
276 snprintf(buf, sizeof buf, "Enter passphrase for RSA key '%.100s': ",
278 if (!options.batch_mode)
279 passphrase = read_passphrase(buf, 0);
281 debug("Will not query passphrase for %.100s in batch mode.",
283 passphrase = xstrdup("");
286 /* Load the authentication file using the pasphrase. */
287 if (!load_private_key(authfile, passphrase, private, NULL)) {
288 memset(passphrase, 0, strlen(passphrase));
290 error("Bad passphrase.");
292 /* Send a dummy response packet to avoid protocol error. */
293 packet_start(SSH_CMSG_AUTH_RSA_RESPONSE);
294 for (i = 0; i < 16; i++)
299 /* Expect the server to reject it... */
300 packet_read_expect(&plen, SSH_SMSG_FAILURE);
303 BN_clear_free(challenge);
306 /* Destroy the passphrase. */
307 memset(passphrase, 0, strlen(passphrase));
310 /* We no longer need the comment. */
313 /* Compute and send a response to the challenge. */
314 respond_to_rsa_challenge(challenge, private->rsa);
316 /* Destroy the private key. */
319 /* We no longer need the challenge. */
320 BN_clear_free(challenge);
322 /* Wait for response from the server. */
323 type = packet_read(&plen);
324 if (type == SSH_SMSG_SUCCESS) {
325 debug("RSA authentication accepted by server.");
328 if (type != SSH_SMSG_FAILURE)
329 packet_disconnect("Protocol error waiting RSA auth response: %d", type);
330 debug("RSA authentication refused.");
335 * Tries to authenticate the user using combined rhosts or /etc/hosts.equiv
336 * authentication and RSA host authentication.
339 try_rhosts_rsa_authentication(const char *local_user, RSA * host_key)
345 debug("Trying rhosts or /etc/hosts.equiv with RSA host authentication.");
347 /* Tell the server that we are willing to authenticate using this key. */
348 packet_start(SSH_CMSG_AUTH_RHOSTS_RSA);
349 packet_put_string(local_user, strlen(local_user));
350 packet_put_int(BN_num_bits(host_key->n));
351 packet_put_bignum(host_key->e);
352 packet_put_bignum(host_key->n);
356 /* Wait for server's response. */
357 type = packet_read(&plen);
359 /* The server responds with failure if it doesn't admit our
360 .rhosts authentication or doesn't know our host key. */
361 if (type == SSH_SMSG_FAILURE) {
362 debug("Server refused our rhosts authentication or host key.");
365 /* Otherwise, the server should respond with a challenge. */
366 if (type != SSH_SMSG_AUTH_RSA_CHALLENGE)
367 packet_disconnect("Protocol error during RSA authentication: %d", type);
369 /* Get the challenge from the packet. */
370 challenge = BN_new();
371 packet_get_bignum(challenge, &clen);
373 packet_integrity_check(plen, clen, type);
375 debug("Received RSA challenge for host key from server.");
377 /* Compute a response to the challenge. */
378 respond_to_rsa_challenge(challenge, host_key);
380 /* We no longer need the challenge. */
381 BN_clear_free(challenge);
383 /* Wait for response from the server. */
384 type = packet_read(&plen);
385 if (type == SSH_SMSG_SUCCESS) {
386 debug("Rhosts or /etc/hosts.equiv with RSA host authentication accepted by server.");
389 if (type != SSH_SMSG_FAILURE)
390 packet_disconnect("Protocol error waiting RSA auth response: %d", type);
391 debug("Rhosts or /etc/hosts.equiv with RSA host authentication refused.");
397 try_kerberos_authentication(void)
399 KTEXT_ST auth; /* Kerberos data */
406 Key_schedule schedule;
407 u_long checksum, cksum;
409 struct sockaddr_in local, foreign;
412 /* Don't do anything if we don't have any tickets. */
413 if (stat(tkt_string(), &st) < 0)
416 strncpy(inst, (char *) krb_get_phost(get_canonical_hostname(1)), INST_SZ);
418 realm = (char *) krb_realmofhost(get_canonical_hostname(1));
420 debug("Kerberos V4: no realm for %s", get_canonical_hostname(1));
423 /* This can really be anything. */
424 checksum = (u_long) getpid();
426 r = krb_mk_req(&auth, KRB4_SERVICE_NAME, inst, realm, checksum);
428 debug("Kerberos V4 krb_mk_req failed: %s", krb_err_txt[r]);
431 /* Get session key to decrypt the server's reply with. */
432 r = krb_get_cred(KRB4_SERVICE_NAME, inst, realm, &cred);
434 debug("get_cred failed: %s", krb_err_txt[r]);
437 des_key_sched((des_cblock *) cred.session, schedule);
439 /* Send authentication info to server. */
440 packet_start(SSH_CMSG_AUTH_KERBEROS);
441 packet_put_string((char *) auth.dat, auth.length);
445 /* Zero the buffer. */
446 (void) memset(auth.dat, 0, MAX_KTXT_LEN);
448 slen = sizeof(local);
449 memset(&local, 0, sizeof(local));
450 if (getsockname(packet_get_connection_in(),
451 (struct sockaddr *) & local, &slen) < 0)
452 debug("getsockname failed: %s", strerror(errno));
454 slen = sizeof(foreign);
455 memset(&foreign, 0, sizeof(foreign));
456 if (getpeername(packet_get_connection_in(),
457 (struct sockaddr *) & foreign, &slen) < 0) {
458 debug("getpeername failed: %s", strerror(errno));
461 /* Get server reply. */
462 type = packet_read(&plen);
464 case SSH_SMSG_FAILURE:
465 /* Should really be SSH_SMSG_AUTH_KERBEROS_FAILURE */
466 debug("Kerberos V4 authentication failed.");
470 case SSH_SMSG_AUTH_KERBEROS_RESPONSE:
471 /* SSH_SMSG_AUTH_KERBEROS_SUCCESS */
472 debug("Kerberos V4 authentication accepted.");
474 /* Get server's response. */
475 reply = packet_get_string((u_int *) &auth.length);
476 memcpy(auth.dat, reply, auth.length);
479 packet_integrity_check(plen, 4 + auth.length, type);
482 * If his response isn't properly encrypted with the session
483 * key, and the decrypted checksum fails to match, he's
486 r = krb_rd_priv(auth.dat, auth.length, schedule, &cred.session,
487 &foreign, &local, &msg_data);
489 debug("Kerberos V4 krb_rd_priv failed: %s", krb_err_txt[r]);
490 packet_disconnect("Kerberos V4 challenge failed!");
492 /* Fetch the (incremented) checksum that we supplied in the request. */
493 (void) memcpy((char *) &cksum, (char *) msg_data.app_data, sizeof(cksum));
494 cksum = ntohl(cksum);
496 /* If it matches, we're golden. */
497 if (cksum == checksum + 1) {
498 debug("Kerberos V4 challenge successful.");
501 packet_disconnect("Kerberos V4 challenge failed!");
505 packet_disconnect("Protocol error on Kerberos V4 response: %d", type);
514 send_kerberos_tgt(void)
517 char pname[ANAME_SZ], pinst[INST_SZ], prealm[REALM_SZ];
522 /* Don't do anything if we don't have any tickets. */
523 if (stat(tkt_string(), &st) < 0)
526 creds = xmalloc(sizeof(*creds));
528 if ((r = krb_get_tf_fullname(TKT_FILE, pname, pinst, prealm)) != KSUCCESS) {
529 debug("Kerberos V4 tf_fullname failed: %s", krb_err_txt[r]);
532 if ((r = krb_get_cred("krbtgt", prealm, prealm, creds)) != GC_OK) {
533 debug("Kerberos V4 get_cred failed: %s", krb_err_txt[r]);
536 if (time(0) > krb_life_to_time(creds->issue_date, creds->lifetime)) {
537 debug("Kerberos V4 ticket expired: %s", TKT_FILE);
540 creds_to_radix(creds, (u_char *)buffer, sizeof buffer);
543 packet_start(SSH_CMSG_HAVE_KERBEROS_TGT);
544 packet_put_string(buffer, strlen(buffer));
548 type = packet_read(&plen);
550 if (type == SSH_SMSG_FAILURE)
551 debug("Kerberos TGT for realm %s rejected.", prealm);
552 else if (type != SSH_SMSG_SUCCESS)
553 packet_disconnect("Protocol error on Kerberos TGT response: %d", type);
559 send_afs_tokens(void)
562 struct ViceIoctl parms;
563 struct ClearToken ct;
564 int i, type, len, plen;
565 char buf[2048], *p, *server_cell;
568 /* Move over ktc_GetToken, here's something leaner. */
569 for (i = 0; i < 100; i++) { /* just in case */
570 parms.in = (char *) &i;
571 parms.in_size = sizeof(i);
573 parms.out_size = sizeof(buf);
574 if (k_pioctl(0, VIOCGETTOK, &parms, 0) != 0)
578 /* Get secret token. */
579 memcpy(&creds.ticket_st.length, p, sizeof(u_int));
580 if (creds.ticket_st.length > MAX_KTXT_LEN)
583 memcpy(creds.ticket_st.dat, p, creds.ticket_st.length);
584 p += creds.ticket_st.length;
586 /* Get clear token. */
587 memcpy(&len, p, sizeof(len));
588 if (len != sizeof(struct ClearToken))
593 p += sizeof(len); /* primary flag */
596 /* Flesh out our credentials. */
597 strlcpy(creds.service, "afs", sizeof creds.service);
598 creds.instance[0] = '\0';
599 strlcpy(creds.realm, server_cell, REALM_SZ);
600 memcpy(creds.session, ct.HandShakeKey, DES_KEY_SZ);
601 creds.issue_date = ct.BeginTimestamp;
602 creds.lifetime = krb_time_to_life(creds.issue_date, ct.EndTimestamp);
603 creds.kvno = ct.AuthHandle;
604 snprintf(creds.pname, sizeof(creds.pname), "AFS ID %d", ct.ViceId);
605 creds.pinst[0] = '\0';
607 /* Encode token, ship it off. */
608 if (creds_to_radix(&creds, (u_char *) buffer, sizeof buffer) <= 0)
610 packet_start(SSH_CMSG_HAVE_AFS_TOKEN);
611 packet_put_string(buffer, strlen(buffer));
615 /* Roger, Roger. Clearance, Clarence. What's your vector,
617 type = packet_read(&plen);
619 if (type == SSH_SMSG_FAILURE)
620 debug("AFS token for cell %s rejected.", server_cell);
621 else if (type != SSH_SMSG_SUCCESS)
622 packet_disconnect("Protocol error on AFS token response: %d", type);
629 * Tries to authenticate with any string-based challenge/response system.
630 * Note that the client code is not tied to s/key or TIS.
633 try_challenge_reponse_authentication(void)
639 char *challenge, *response;
641 debug("Doing challenge reponse authentication.");
643 for (i = 0; i < options.number_of_password_prompts; i++) {
644 /* request a challenge */
645 packet_start(SSH_CMSG_AUTH_TIS);
649 type = packet_read(&payload_len);
650 if (type != SSH_SMSG_FAILURE &&
651 type != SSH_SMSG_AUTH_TIS_CHALLENGE) {
652 packet_disconnect("Protocol error: got %d in response "
653 "to SSH_CMSG_AUTH_TIS", type);
655 if (type != SSH_SMSG_AUTH_TIS_CHALLENGE) {
656 debug("No challenge.");
659 challenge = packet_get_string(&clen);
660 packet_integrity_check(payload_len, (4 + clen), type);
661 snprintf(prompt, sizeof prompt, "%s%s", challenge,
662 strchr(challenge, '\n') ? "" : "\nResponse: ");
665 error("Permission denied, please try again.");
666 if (options.cipher == SSH_CIPHER_NONE)
667 log("WARNING: Encryption is disabled! "
668 "Reponse will be transmitted in clear text.");
669 response = read_passphrase(prompt, 0);
670 if (strcmp(response, "") == 0) {
674 packet_start(SSH_CMSG_AUTH_TIS_RESPONSE);
675 ssh1_put_password(response);
676 memset(response, 0, strlen(response));
680 type = packet_read(&payload_len);
681 if (type == SSH_SMSG_SUCCESS)
683 if (type != SSH_SMSG_FAILURE)
684 packet_disconnect("Protocol error: got %d in response "
685 "to SSH_CMSG_AUTH_TIS_RESPONSE", type);
692 * Tries to authenticate with plain passwd authentication.
695 try_password_authentication(char *prompt)
697 int type, i, payload_len;
700 debug("Doing password authentication.");
701 if (options.cipher == SSH_CIPHER_NONE)
702 log("WARNING: Encryption is disabled! Password will be transmitted in clear text.");
703 for (i = 0; i < options.number_of_password_prompts; i++) {
705 error("Permission denied, please try again.");
706 password = read_passphrase(prompt, 0);
707 packet_start(SSH_CMSG_AUTH_PASSWORD);
708 ssh1_put_password(password);
709 memset(password, 0, strlen(password));
714 type = packet_read(&payload_len);
715 if (type == SSH_SMSG_SUCCESS)
717 if (type != SSH_SMSG_FAILURE)
718 packet_disconnect("Protocol error: got %d in response to passwd auth", type);
728 ssh_kex(char *host, struct sockaddr *hostaddr)
736 int ssh_cipher_default = SSH_CIPHER_3DES;
737 u_char session_key[SSH_SESSION_KEY_LENGTH];
739 u_int supported_ciphers;
740 u_int server_flags, client_flags;
741 int payload_len, clen, sum_len = 0;
744 debug("Waiting for server public key.");
746 /* Wait for a public key packet from the server. */
747 packet_read_expect(&payload_len, SSH_SMSG_PUBLIC_KEY);
749 /* Get cookie from the packet. */
750 for (i = 0; i < 8; i++)
751 cookie[i] = packet_get_char();
753 /* Get the public key. */
754 public_key = RSA_new();
755 bits = packet_get_int();/* bits */
756 public_key->e = BN_new();
757 packet_get_bignum(public_key->e, &clen);
759 public_key->n = BN_new();
760 packet_get_bignum(public_key->n, &clen);
763 rbits = BN_num_bits(public_key->n);
765 log("Warning: Server lies about size of server public key: "
766 "actual size is %d bits vs. announced %d.", rbits, bits);
767 log("Warning: This may be due to an old implementation of ssh.");
769 /* Get the host key. */
770 host_key = RSA_new();
771 bits = packet_get_int();/* bits */
772 host_key->e = BN_new();
773 packet_get_bignum(host_key->e, &clen);
775 host_key->n = BN_new();
776 packet_get_bignum(host_key->n, &clen);
779 rbits = BN_num_bits(host_key->n);
781 log("Warning: Server lies about size of server host key: "
782 "actual size is %d bits vs. announced %d.", rbits, bits);
783 log("Warning: This may be due to an old implementation of ssh.");
786 /* Get protocol flags. */
787 server_flags = packet_get_int();
788 packet_set_protocol_flags(server_flags);
790 supported_ciphers = packet_get_int();
791 supported_authentications = packet_get_int();
793 debug("Received server public key (%d bits) and host key (%d bits).",
794 BN_num_bits(public_key->n), BN_num_bits(host_key->n));
796 packet_integrity_check(payload_len,
797 8 + 4 + sum_len + 0 + 4 + 0 + 0 + 4 + 4 + 4,
798 SSH_SMSG_PUBLIC_KEY);
801 check_host_key(host, hostaddr, &k,
802 options.user_hostfile, options.system_hostfile);
804 client_flags = SSH_PROTOFLAG_SCREEN_NUMBER | SSH_PROTOFLAG_HOST_IN_FWD_OPEN;
806 compute_session_id(session_id, cookie, host_key->n, public_key->n);
808 /* Generate a session key. */
812 * Generate an encryption key for the session. The key is a 256 bit
813 * random number, interpreted as a 32-byte key, with the least
814 * significant 8 bits being the first byte of the key.
816 for (i = 0; i < 32; i++) {
819 session_key[i] = rand & 0xff;
824 * According to the protocol spec, the first byte of the session key
825 * is the highest byte of the integer. The session key is xored with
826 * the first 16 bytes of the session id.
830 for (i = 0; i < SSH_SESSION_KEY_LENGTH; i++) {
831 BN_lshift(key, key, 8);
833 BN_add_word(key, session_key[i] ^ session_id[i]);
835 BN_add_word(key, session_key[i]);
839 * Encrypt the integer using the public key and host key of the
840 * server (key with smaller modulus first).
842 if (BN_cmp(public_key->n, host_key->n) < 0) {
843 /* Public key has smaller modulus. */
844 if (BN_num_bits(host_key->n) <
845 BN_num_bits(public_key->n) + SSH_KEY_BITS_RESERVED) {
846 fatal("respond_to_rsa_challenge: host_key %d < public_key %d + "
847 "SSH_KEY_BITS_RESERVED %d",
848 BN_num_bits(host_key->n),
849 BN_num_bits(public_key->n),
850 SSH_KEY_BITS_RESERVED);
852 rsa_public_encrypt(key, key, public_key);
853 rsa_public_encrypt(key, key, host_key);
855 /* Host key has smaller modulus (or they are equal). */
856 if (BN_num_bits(public_key->n) <
857 BN_num_bits(host_key->n) + SSH_KEY_BITS_RESERVED) {
858 fatal("respond_to_rsa_challenge: public_key %d < host_key %d + "
859 "SSH_KEY_BITS_RESERVED %d",
860 BN_num_bits(public_key->n),
861 BN_num_bits(host_key->n),
862 SSH_KEY_BITS_RESERVED);
864 rsa_public_encrypt(key, key, host_key);
865 rsa_public_encrypt(key, key, public_key);
868 /* Destroy the public keys since we no longer need them. */
869 RSA_free(public_key);
872 if (options.cipher == SSH_CIPHER_NOT_SET) {
873 if (cipher_mask_ssh1(1) & supported_ciphers & (1 << ssh_cipher_default))
874 options.cipher = ssh_cipher_default;
875 } else if (options.cipher == SSH_CIPHER_ILLEGAL ||
876 !(cipher_mask_ssh1(1) & (1 << options.cipher))) {
877 log("No valid SSH1 cipher, using %.100s instead.",
878 cipher_name(ssh_cipher_default));
879 options.cipher = ssh_cipher_default;
881 /* Check that the selected cipher is supported. */
882 if (!(supported_ciphers & (1 << options.cipher)))
883 fatal("Selected cipher type %.100s not supported by server.",
884 cipher_name(options.cipher));
886 debug("Encryption type: %.100s", cipher_name(options.cipher));
888 /* Send the encrypted session key to the server. */
889 packet_start(SSH_CMSG_SESSION_KEY);
890 packet_put_char(options.cipher);
892 /* Send the cookie back to the server. */
893 for (i = 0; i < 8; i++)
894 packet_put_char(cookie[i]);
896 /* Send and destroy the encrypted encryption key integer. */
897 packet_put_bignum(key);
900 /* Send protocol flags. */
901 packet_put_int(client_flags);
903 /* Send the packet now. */
907 debug("Sent encrypted session key.");
909 /* Set the encryption key. */
910 packet_set_encryption_key(session_key, SSH_SESSION_KEY_LENGTH, options.cipher);
912 /* We will no longer need the session key here. Destroy any extra copies. */
913 memset(session_key, 0, sizeof(session_key));
916 * Expect a success message from the server. Note that this message
917 * will be received in encrypted form.
919 packet_read_expect(&payload_len, SSH_SMSG_SUCCESS);
921 debug("Received encrypted confirmation.");
929 const char *local_user,
930 const char *server_user,
932 int host_key_valid, RSA *own_host_key)
937 if (supported_authentications == 0)
938 fatal("ssh_userauth: server supports no auth methods");
940 /* Send the name of the user to log in as on the server. */
941 packet_start(SSH_CMSG_USER);
942 packet_put_string(server_user, strlen(server_user));
947 * The server should respond with success if no authentication is
948 * needed (the user has no password). Otherwise the server responds
951 type = packet_read(&payload_len);
953 /* check whether the connection was accepted without authentication. */
954 if (type == SSH_SMSG_SUCCESS)
956 if (type != SSH_SMSG_FAILURE)
957 packet_disconnect("Protocol error: got %d in response to SSH_CMSG_USER",
961 /* Try Kerberos tgt passing if the server supports it. */
962 if ((supported_authentications & (1 << SSH_PASS_KERBEROS_TGT)) &&
963 options.kerberos_tgt_passing) {
964 if (options.cipher == SSH_CIPHER_NONE)
965 log("WARNING: Encryption is disabled! Ticket will be transmitted in the clear!");
966 (void) send_kerberos_tgt();
968 /* Try AFS token passing if the server supports it. */
969 if ((supported_authentications & (1 << SSH_PASS_AFS_TOKEN)) &&
970 options.afs_token_passing && k_hasafs()) {
971 if (options.cipher == SSH_CIPHER_NONE)
972 log("WARNING: Encryption is disabled! Token will be transmitted in the clear!");
978 if ((supported_authentications & (1 << SSH_AUTH_KERBEROS)) &&
979 options.kerberos_authentication) {
980 debug("Trying Kerberos authentication.");
981 if (try_kerberos_authentication()) {
982 /* The server should respond with success or failure. */
983 type = packet_read(&payload_len);
984 if (type == SSH_SMSG_SUCCESS)
986 if (type != SSH_SMSG_FAILURE)
987 packet_disconnect("Protocol error: got %d in response to Kerberos auth", type);
993 * Use rhosts authentication if running in privileged socket and we
994 * do not wish to remain anonymous.
996 if ((supported_authentications & (1 << SSH_AUTH_RHOSTS)) &&
997 options.rhosts_authentication) {
998 debug("Trying rhosts authentication.");
999 packet_start(SSH_CMSG_AUTH_RHOSTS);
1000 packet_put_string(local_user, strlen(local_user));
1002 packet_write_wait();
1004 /* The server should respond with success or failure. */
1005 type = packet_read(&payload_len);
1006 if (type == SSH_SMSG_SUCCESS)
1008 if (type != SSH_SMSG_FAILURE)
1009 packet_disconnect("Protocol error: got %d in response to rhosts auth",
1013 * Try .rhosts or /etc/hosts.equiv authentication with RSA host
1016 if ((supported_authentications & (1 << SSH_AUTH_RHOSTS_RSA)) &&
1017 options.rhosts_rsa_authentication && host_key_valid) {
1018 if (try_rhosts_rsa_authentication(local_user, own_host_key))
1021 /* Try RSA authentication if the server supports it. */
1022 if ((supported_authentications & (1 << SSH_AUTH_RSA)) &&
1023 options.rsa_authentication) {
1025 * Try RSA authentication using the authentication agent. The
1026 * agent is tried first because no passphrase is needed for
1027 * it, whereas identity files may require passphrases.
1029 if (try_agent_authentication())
1032 /* Try RSA authentication for each identity. */
1033 for (i = 0; i < options.num_identity_files; i++)
1034 if (options.identity_files_type[i] == KEY_RSA1 &&
1035 try_rsa_authentication(options.identity_files[i]))
1038 /* Try challenge response authentication if the server supports it. */
1039 if ((supported_authentications & (1 << SSH_AUTH_TIS)) &&
1040 options.challenge_reponse_authentication && !options.batch_mode) {
1041 if (try_challenge_reponse_authentication())
1044 /* Try password authentication if the server supports it. */
1045 if ((supported_authentications & (1 << SSH_AUTH_PASSWORD)) &&
1046 options.password_authentication && !options.batch_mode) {
1049 snprintf(prompt, sizeof(prompt), "%.30s@%.128s's password: ",
1051 if (try_password_authentication(prompt))
1054 /* All authentication methods have failed. Exit with an error message. */
1055 fatal("Permission denied.");