nhyatt/putty-source
1
0
Fork 0
mirror of https://git.tartarus.org/simon/putty.git synced 2025-07-18 19:41:01 -05:00
Code Issues Projects Releases Wiki Activity

New feature: k-i authentication helper plugins.

Browse Source 
In recent months I've had two requests from different people to build
support into PuTTY for automatically handling complicated third-party
auth protocols layered on top of keyboard-interactive - the kind of
thing where you're asked to enter some auth response, and you have to
refer to some external source like a web server to find out what the
right response _is_, which is a pain to do by hand, so you'd prefer it
to be automated in the SSH client.

That seems like a reasonable thing for an end user to want, but I
didn't think it was a good idea to build support for specific
protocols of that kind directly into PuTTY, where there would no doubt
be an ever-lengthening list, and maintenance needed on all of them.

So instead, in collaboration with one of my correspondents, I've
designed and implemented a protocol to be spoken between PuTTY and a
plugin running as a subprocess. The plugin can opt to handle the
keyboard-interactive authentication loop on behalf of the user, in
which case PuTTY passes on all the INFO_REQUEST packets to it, and
lets it make up responses. It can also ask questions of the user if
necessary.

The protocol spec is provided in a documentation appendix. The entire
configuration for the end user consists of providing a full command
line to use as the subprocess.

In the contrib directory I've provided an example plugin written in
Python. It gives a set of fixed responses suitable for getting through
Uppity's made-up k-i system, because that was a reasonable thing I
already had lying around to test against. But it also provides example
code that someone else could pick up and insert their own live
response-provider into the middle of, assuming they were happy with it
being in Python.
This commit is contained in:
Simon Tatham
2022-09-01 19:38:46 +01:00
parent 1f32a16dc8
commit 15f097f399
12 changed files with 1309 additions and 46 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
config.c
View File

@ -2899,8 +2899,8 @@ void setup_config_box(struct controlbox *b, bool midsession,
conf_checkbox_handler,
I(CONF_try_ki_auth));
s = ctrl_getset(b, "Connection/SSH/Auth", "params",
"Authentication parameters");
s = ctrl_getset(b, "Connection/SSH/Auth", "aux",
"Other authentication-related options");
ctrl_checkbox(s, "Allow agent forwarding", 'f',
HELPCTX(ssh_auth_agentfwd),
conf_checkbox_handler, I(CONF_agentfwd));
@ -2908,6 +2908,12 @@ void setup_config_box(struct controlbox *b, bool midsession,
HELPCTX(ssh_auth_changeuser),
conf_checkbox_handler,
I(CONF_change_username));
ctrl_settitle(b, "Connection/SSH/Auth/Credentials",
"Credentials to authenticate with");
s = ctrl_getset(b, "Connection/SSH/Auth/Credentials", "publickey",
"Public-key authentication");
ctrl_filesel(s, "Private key file for authentication:", 'k',
FILTER_KEY_FILES, false, "Select private key file",
HELPCTX(ssh_auth_privkey),
@ -2917,6 +2923,11 @@ void setup_config_box(struct controlbox *b, bool midsession,
HELPCTX(ssh_auth_cert),
conf_filesel_handler, I(CONF_detached_cert));
s = ctrl_getset(b, "Connection/SSH/Auth/Credentials", "plugin",
"Plugin to provide authentication responses");
ctrl_editbox(s, "Plugin command to run", NO_SHORTCUT, 100,
HELPCTX(ssh_auth_plugin),
conf_editbox_handler, I(CONF_auth_plugin), ED_STR);
#ifndef NO_GSSAPI
/*
* Connection/SSH/Auth/GSSAPI, which sadly won't fit on