mirror of
https://git.libssh.org/projects/libssh.git
synced 2025-08-07 08:02:55 +03:00
doc: Fix authentication docs.
This commit is contained in:
@@ -21,7 +21,7 @@ to read the abundant documentation on this topic to fully understand the
|
|||||||
advantages and security risks linked to each method.
|
advantages and security risks linked to each method.
|
||||||
|
|
||||||
|
|
||||||
@subsection pubkeys Authenticating with public keys
|
@subsection pubkeys Authenticating with public keys
|
||||||
|
|
||||||
libssh is fully compatible with the openssh public and private keys. You
|
libssh is fully compatible with the openssh public and private keys. You
|
||||||
can either use the automatic public key authentication method provided by
|
can either use the automatic public key authentication method provided by
|
||||||
@@ -40,22 +40,21 @@ The function ssh_userauth_autopubkey() does this using the available keys in
|
|||||||
- SSH_AUTH_DENIED: no key matched
|
- SSH_AUTH_DENIED: no key matched
|
||||||
- SSH_AUTH_SUCCESS: you are now authenticated
|
- SSH_AUTH_SUCCESS: you are now authenticated
|
||||||
- SSH_AUTH_PARTIAL: some key matched but you still have to provide an other
|
- SSH_AUTH_PARTIAL: some key matched but you still have to provide an other
|
||||||
mean of authentication (like a password).
|
mean of authentication (like a password).
|
||||||
|
|
||||||
The ssh_userauth_autopubkey() function also tries to authenticate using the
|
The ssh_userauth_publickey_auto() function also tries to authenticate using the
|
||||||
SSH agent, if you have one running, or the "none" method otherwise.
|
SSH agent, if you have one running, or the "none" method otherwise.
|
||||||
|
|
||||||
If you wish to authenticate with public key by your own, follow these steps:
|
If you wish to authenticate with public key by your own, follow these steps:
|
||||||
- Retrieve the public key in a ssh_string using publickey_from_file().
|
- Retrieve the public key with ssh_import_pubkey_file().
|
||||||
- Offer the public key to the SSH server using ssh_userauth_offer_pubkey().
|
- Offer the public key to the SSH server using ssh_userauth_try_publickey().
|
||||||
If the return value is SSH_AUTH_SUCCESS, the SSH server accepts to
|
If the return value is SSH_AUTH_SUCCESS, the SSH server accepts to
|
||||||
authenticate using the public key and you can go to the next step.
|
authenticate using the public key and you can go to the next step.
|
||||||
- Retrieve the private key, using the privatekey_from_file() function. If
|
- Retrieve the private key, using the ssh_pki_import_privkey_file() function.
|
||||||
a passphrase is needed, either the passphrase specified as argument or
|
If a passphrase is needed, either the passphrase specified as argument or
|
||||||
a callback (see callbacks section) will be used.
|
a callback will be used.
|
||||||
- Authenticate using ssh_userauth_pubkey() with your public key string
|
- Authenticate using ssh_userauth_publickey() with your private key.
|
||||||
and private key.
|
- Do not forget cleaning up memory using ssh_key_free().
|
||||||
- Do not forget cleaning up memory using string_free() and privatekey_free().
|
|
||||||
|
|
||||||
Here is a minimalistic example of public key authentication:
|
Here is a minimalistic example of public key authentication:
|
||||||
|
|
||||||
@@ -64,7 +63,7 @@ int authenticate_pubkey(ssh_session session)
|
|||||||
{
|
{
|
||||||
int rc;
|
int rc;
|
||||||
|
|
||||||
rc = ssh_userauth_autopubkey(session, NULL);
|
rc = ssh_userauth_publickey_auto(session, NULL);
|
||||||
|
|
||||||
if (rc == SSH_AUTH_ERROR)
|
if (rc == SSH_AUTH_ERROR)
|
||||||
{
|
{
|
||||||
@@ -77,14 +76,12 @@ int authenticate_pubkey(ssh_session session)
|
|||||||
}
|
}
|
||||||
@endcode
|
@endcode
|
||||||
|
|
||||||
@see ssh_userauth_autopubkey
|
@see ssh_userauth_publickey_auto()
|
||||||
@see ssh_userauth_offer_pubkey
|
@see ssh_userauth_try_publickey()
|
||||||
@see ssh_userauth_pubkey
|
@see ssh_userauth_publickey()
|
||||||
@see publickey_from_file
|
@see ssh_pki_import_pubkey_file()
|
||||||
@see publickey_from_privatekey
|
@see ssh_pki_import_privkey_file()
|
||||||
@see string_free
|
@see ssh_key_free()
|
||||||
@see privatekey_from_file
|
|
||||||
@see privatekey_free
|
|
||||||
|
|
||||||
|
|
||||||
@subsection password Authenticating with a password
|
@subsection password Authenticating with a password
|
||||||
@@ -167,13 +164,13 @@ Here is a little note about how to use the information from
|
|||||||
keyboard-interactive authentication, coming from the RFC itself (rfc4256):
|
keyboard-interactive authentication, coming from the RFC itself (rfc4256):
|
||||||
|
|
||||||
@verbatim
|
@verbatim
|
||||||
|
|
||||||
3.3 User Interface Upon receiving a request message, the client SHOULD
|
3.3 User Interface Upon receiving a request message, the client SHOULD
|
||||||
prompt the user as follows: A command line interface (CLI) client SHOULD
|
prompt the user as follows: A command line interface (CLI) client SHOULD
|
||||||
print the name and instruction (if non-empty), adding newlines. Then for
|
print the name and instruction (if non-empty), adding newlines. Then for
|
||||||
each prompt in turn, the client SHOULD display the prompt and read the
|
each prompt in turn, the client SHOULD display the prompt and read the
|
||||||
user input.
|
user input.
|
||||||
|
|
||||||
A graphical user interface (GUI) client has many choices on how to prompt
|
A graphical user interface (GUI) client has many choices on how to prompt
|
||||||
the user. One possibility is to use the name field (possibly prefixed
|
the user. One possibility is to use the name field (possibly prefixed
|
||||||
with the application's name) as the title of a dialog window in which
|
with the application's name) as the title of a dialog window in which
|
||||||
@@ -184,18 +181,18 @@ keyboard-interactive authentication, coming from the RFC itself (rfc4256):
|
|||||||
titles; it SHOULD instead find another way to display this information. If
|
titles; it SHOULD instead find another way to display this information. If
|
||||||
prompts are presented in a dialog window, then the client SHOULD NOT
|
prompts are presented in a dialog window, then the client SHOULD NOT
|
||||||
present each prompt in a separate window.
|
present each prompt in a separate window.
|
||||||
|
|
||||||
All clients MUST properly handle an instruction field with embedded
|
All clients MUST properly handle an instruction field with embedded
|
||||||
newlines. They SHOULD also be able to display at least 30 characters for
|
newlines. They SHOULD also be able to display at least 30 characters for
|
||||||
the name and prompts. If the server presents names or prompts longer than 30
|
the name and prompts. If the server presents names or prompts longer than 30
|
||||||
characters, the client MAY truncate these fields to the length it can
|
characters, the client MAY truncate these fields to the length it can
|
||||||
display. If the client does truncate any fields, there MUST be an obvious
|
display. If the client does truncate any fields, there MUST be an obvious
|
||||||
indication that such truncation has occured.
|
indication that such truncation has occured.
|
||||||
|
|
||||||
The instruction field SHOULD NOT be truncated. Clients SHOULD use control
|
The instruction field SHOULD NOT be truncated. Clients SHOULD use control
|
||||||
character filtering as discussed in [SSH-ARCH] to avoid attacks by
|
character filtering as discussed in [SSH-ARCH] to avoid attacks by
|
||||||
including terminal control characters in the fields to be displayed.
|
including terminal control characters in the fields to be displayed.
|
||||||
|
|
||||||
For each prompt, the corresponding echo field indicates whether or not
|
For each prompt, the corresponding echo field indicates whether or not
|
||||||
the user input should be echoed as characters are typed. Clients SHOULD
|
the user input should be echoed as characters are typed. Clients SHOULD
|
||||||
correctly echo/mask user input for each prompt independently of other
|
correctly echo/mask user input for each prompt independently of other
|
||||||
@@ -265,10 +262,10 @@ int authenticate_kbdint(ssh_session session)
|
|||||||
@endcode
|
@endcode
|
||||||
|
|
||||||
@see ssh_userauth_kbdint()
|
@see ssh_userauth_kbdint()
|
||||||
@see ssh_userauth_kbdint_getnprompts
|
@see ssh_userauth_kbdint_getnprompts()
|
||||||
@see ssh_userauth_kbdint_getname
|
@see ssh_userauth_kbdint_getname()
|
||||||
@see ssh_userauth_kbdint_getinstruction
|
@see ssh_userauth_kbdint_getinstruction()
|
||||||
@see ssh_userauth_kbdint_getprompt
|
@see ssh_userauth_kbdint_getprompt()
|
||||||
@see ssh_userauth_kbdint_setanswer()
|
@see ssh_userauth_kbdint_setanswer()
|
||||||
|
|
||||||
|
|
||||||
@@ -307,6 +304,11 @@ int test_several_auth_methods(ssh_session session)
|
|||||||
{
|
{
|
||||||
int method, rc;
|
int method, rc;
|
||||||
|
|
||||||
|
rc = ssh_userauth_none(session, NULL, NULL);
|
||||||
|
if (rc != SSH_AUTH_SUCCESS) {
|
||||||
|
return rc;
|
||||||
|
}
|
||||||
|
|
||||||
method = ssh_userauth_list(session, NULL);
|
method = ssh_userauth_list(session, NULL);
|
||||||
|
|
||||||
if (method & SSH_AUTH_METHOD_NONE)
|
if (method & SSH_AUTH_METHOD_NONE)
|
||||||
|
Reference in New Issue
Block a user