Skip to content

Let user handle keyboard-interactive events - #192

Closed
MattCatz wants to merge 1 commit into
ParallelSSH:masterfrom
MattCatz:master
Closed

Let user handle keyboard-interactive events#192
MattCatz wants to merge 1 commit into
ParallelSSH:masterfrom
MattCatz:master

Conversation

@MattCatz

@MattCatz MattCatz commented Sep 21, 2023

Copy link
Copy Markdown
Contributor

Keyboard-interactive events can have multiple steps. Tweak the existing kbd_callback to massage prompts into a format that an end user can handle from python.

New public method userauth_keyboardinteractive_callback added to the session class to maintain backwards compatibility. See new example script for usage.

I didn't add any new test case since I'm not really sure how it would fit into the existing set-up. To test locally I set spun up a ssh server inside a docker container1 and pointed the example script at it. Below is an example command I used:

OTP=$(oathtool --totp -d 6 12345678909876543210)
python ./examples/keyboard_interactive_auth.py --host 127.0.0.1 --port 2022 -u sshuser $OTP 552099 hostname
Example Dockerfile

SSH server with MFA

FROM debian:latest

RUN apt-get update && apt-get install -y \
  openssh-server \
  libpam-oath \
  oathtool \
  && rm -rf /var/lib/apt/lists/*

RUN groupadd sshgroup
RUN useradd -ms /bin/bash -g sshgroup -p '$1$sshuser$TCmWDAEGpJ.Z.Sj/NN02I.' sshuser

RUN echo 'HOTP/T30/6 sshuser - 12345678909876543210' > /etc/users.oath 
RUN chmod 600 /etc/users.oath
RUN echo 'auth	  required pam_oath.so usersfile=/etc/users.oath window=30 digits=6' >> /etc/pam.d/sshd
run cat /etc/pam.d/sshd


RUN echo 'ChallengeResponseAuthentication yes \nKbdInteractiveAuthentication yes\n' >> /etc/ssh/sshd_config.d/otp.conf
RUN service ssh start
EXPOSE 22
CMD ["/usr/sbin/sshd","-D"]

Footnotes

  1. ↩

@MattCatz
Let user handle keyboard-interactive events
10a354e 
Keyboard-interactive events can have multiple steps. Tweak the existing
`kbd_callback` to massage prompts into a format that an end user can
handle from python.

New public method `userauth_keyboardinteractive_callback` added to the session
class to maintain backwards compatibility. See new example script for usage.
@MattCatz
MattCatz requested a review from pkittenis as a code owner September 21, 2023 03:14
@pkittenis

pkittenis commented Jan 12, 2025

Copy link
Copy Markdown
Member

Thanks, will update branch to get this in.

@pkittenis pkittenis mentioned this pull request Oct 3, 2025
Merged
@pkittenis

pkittenis commented Oct 3, 2025

Copy link
Copy Markdown
Member

Updated in #225 - added tests, merged with latest master.

@pkittenis pkittenis closed this Oct 3, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@pkittenis pkittenis Awaiting requested review from pkittenis pkittenis is a code owner

Assignees

No one assigned

Labels

enhancement

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@MattCatz @pkittenis