blob: 2f89964eca590c7bfa3991a020355e3aecfb6f5b [file] [log] [blame]
Damien Millereba71ba2000-04-29 23:57:08 +10001/*
2 * Author: Tatu Ylonen <ylo@cs.hut.fi>
3 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
4 * All rights reserved
Damien Millereba71ba2000-04-29 23:57:08 +10005 * Code to connect to a remote host, and to perform the client side of the
6 * login (authentication) dialog.
7 *
Damien Millere4340be2000-09-16 13:29:08 +11008 * As far as I am concerned, the code I have written for this software
9 * can be used freely for any purpose. Any derived versions of this
10 * software must be clearly marked as such, and if the derived work is
11 * incompatible with the protocol description in the RFC file, it must be
12 * called by a name other than "ssh" or "Secure Shell".
Damien Millereba71ba2000-04-29 23:57:08 +100013 */
14
15#include "includes.h"
Damien Miller1a0c0b92003-09-02 22:51:17 +100016RCSID("$OpenBSD: sshconnect1.c,v 1.56 2003/08/28 12:54:34 markus Exp $");
Damien Millereba71ba2000-04-29 23:57:08 +100017
18#include <openssl/bn.h>
Damien Miller2ce18da2002-02-13 13:54:27 +110019#include <openssl/md5.h>
Damien Millereba71ba2000-04-29 23:57:08 +100020
Ben Lindstrom226cfa02001-01-22 05:34:40 +000021#include "ssh.h"
22#include "ssh1.h"
Damien Millereba71ba2000-04-29 23:57:08 +100023#include "xmalloc.h"
24#include "rsa.h"
Damien Millereba71ba2000-04-29 23:57:08 +100025#include "buffer.h"
26#include "packet.h"
Damien Millereba71ba2000-04-29 23:57:08 +100027#include "mpaux.h"
28#include "uidswap.h"
Ben Lindstrom226cfa02001-01-22 05:34:40 +000029#include "log.h"
Damien Millereba71ba2000-04-29 23:57:08 +100030#include "readconf.h"
31#include "key.h"
Damien Miller994cf142000-07-21 10:19:44 +100032#include "authfd.h"
Damien Millereba71ba2000-04-29 23:57:08 +100033#include "sshconnect.h"
34#include "authfile.h"
Ben Lindstrom226cfa02001-01-22 05:34:40 +000035#include "readpass.h"
36#include "cipher.h"
37#include "canohost.h"
Ben Lindstromec95ed92001-07-04 04:21:14 +000038#include "auth.h"
Damien Millereba71ba2000-04-29 23:57:08 +100039
40/* Session id for the current session. */
Ben Lindstrom46c16222000-12-22 01:43:59 +000041u_char session_id[16];
42u_int supported_authentications = 0;
Damien Millereba71ba2000-04-29 23:57:08 +100043
44extern Options options;
45extern char *__progname;
46
47/*
48 * Checks if the user has an authentication agent, and if so, tries to
49 * authenticate using the agent.
50 */
Ben Lindstrombba81212001-06-25 05:01:22 +000051static int
Ben Lindstrom31ca54a2001-02-09 02:11:24 +000052try_agent_authentication(void)
Damien Millereba71ba2000-04-29 23:57:08 +100053{
Damien Millerad833b32000-08-23 10:46:23 +100054 int type;
Damien Millereba71ba2000-04-29 23:57:08 +100055 char *comment;
56 AuthenticationConnection *auth;
Ben Lindstrom46c16222000-12-22 01:43:59 +000057 u_char response[16];
58 u_int i;
Damien Millerad833b32000-08-23 10:46:23 +100059 Key *key;
60 BIGNUM *challenge;
Damien Millereba71ba2000-04-29 23:57:08 +100061
62 /* Get connection to the agent. */
63 auth = ssh_get_authentication_connection();
64 if (!auth)
65 return 0;
66
Damien Millerda755162002-01-22 23:09:22 +110067 if ((challenge = BN_new()) == NULL)
68 fatal("try_agent_authentication: BN_new failed");
Damien Millereba71ba2000-04-29 23:57:08 +100069 /* Loop through identities served by the agent. */
Damien Millerad833b32000-08-23 10:46:23 +100070 for (key = ssh_get_first_identity(auth, &comment, 1);
Damien Miller9f0f5c62001-12-21 14:45:46 +110071 key != NULL;
72 key = ssh_get_next_identity(auth, &comment, 1)) {
Damien Millereba71ba2000-04-29 23:57:08 +100073
74 /* Try this identity. */
75 debug("Trying RSA authentication via agent with '%.100s'", comment);
76 xfree(comment);
77
78 /* Tell the server that we are willing to authenticate using this key. */
79 packet_start(SSH_CMSG_AUTH_RSA);
Damien Millerad833b32000-08-23 10:46:23 +100080 packet_put_bignum(key->rsa->n);
Damien Millereba71ba2000-04-29 23:57:08 +100081 packet_send();
82 packet_write_wait();
83
84 /* Wait for server's response. */
Damien Millerdff50992002-01-22 23:16:32 +110085 type = packet_read();
Damien Millereba71ba2000-04-29 23:57:08 +100086
87 /* The server sends failure if it doesn\'t like our key or
88 does not support RSA authentication. */
89 if (type == SSH_SMSG_FAILURE) {
90 debug("Server refused our key.");
Damien Millerad833b32000-08-23 10:46:23 +100091 key_free(key);
Damien Millereba71ba2000-04-29 23:57:08 +100092 continue;
93 }
94 /* Otherwise it should have sent a challenge. */
95 if (type != SSH_SMSG_AUTH_RSA_CHALLENGE)
96 packet_disconnect("Protocol error during RSA authentication: %d",
97 type);
98
Damien Millerd432ccf2002-01-22 23:14:44 +110099 packet_get_bignum(challenge);
Damien Miller48b03fc2002-01-22 23:11:40 +1100100 packet_check_eom();
Damien Millereba71ba2000-04-29 23:57:08 +1000101
102 debug("Received RSA challenge from server.");
103
104 /* Ask the agent to decrypt the challenge. */
Damien Millerad833b32000-08-23 10:46:23 +1000105 if (!ssh_decrypt_challenge(auth, key, challenge, session_id, 1, response)) {
106 /*
107 * The agent failed to authenticate this identifier
108 * although it advertised it supports this. Just
109 * return a wrong value.
110 */
Damien Miller996acd22003-04-09 20:59:48 +1000111 logit("Authentication agent failed to decrypt challenge.");
Damien Millereba71ba2000-04-29 23:57:08 +1000112 memset(response, 0, sizeof(response));
113 }
Damien Millerad833b32000-08-23 10:46:23 +1000114 key_free(key);
Damien Millereba71ba2000-04-29 23:57:08 +1000115 debug("Sending response to RSA challenge.");
116
117 /* Send the decrypted challenge back to the server. */
118 packet_start(SSH_CMSG_AUTH_RSA_RESPONSE);
119 for (i = 0; i < 16; i++)
120 packet_put_char(response[i]);
121 packet_send();
122 packet_write_wait();
123
124 /* Wait for response from the server. */
Damien Millerdff50992002-01-22 23:16:32 +1100125 type = packet_read();
Damien Millereba71ba2000-04-29 23:57:08 +1000126
127 /* The server returns success if it accepted the authentication. */
128 if (type == SSH_SMSG_SUCCESS) {
Ben Lindstrom48bd7c12001-01-09 00:35:42 +0000129 ssh_close_authentication_connection(auth);
Damien Millereba71ba2000-04-29 23:57:08 +1000130 BN_clear_free(challenge);
Damien Millerad833b32000-08-23 10:46:23 +1000131 debug("RSA authentication accepted by server.");
Damien Millereba71ba2000-04-29 23:57:08 +1000132 return 1;
133 }
134 /* Otherwise it should return failure. */
135 if (type != SSH_SMSG_FAILURE)
136 packet_disconnect("Protocol error waiting RSA auth response: %d",
137 type);
138 }
Ben Lindstrom48bd7c12001-01-09 00:35:42 +0000139 ssh_close_authentication_connection(auth);
Damien Millereba71ba2000-04-29 23:57:08 +1000140 BN_clear_free(challenge);
Damien Millereba71ba2000-04-29 23:57:08 +1000141 debug("RSA authentication using agent refused.");
142 return 0;
143}
144
145/*
146 * Computes the proper response to a RSA challenge, and sends the response to
147 * the server.
148 */
Ben Lindstrombba81212001-06-25 05:01:22 +0000149static void
Damien Millereba71ba2000-04-29 23:57:08 +1000150respond_to_rsa_challenge(BIGNUM * challenge, RSA * prv)
151{
Ben Lindstrom46c16222000-12-22 01:43:59 +0000152 u_char buf[32], response[16];
Damien Millereba71ba2000-04-29 23:57:08 +1000153 MD5_CTX md;
154 int i, len;
155
156 /* Decrypt the challenge using the private key. */
Damien Miller7650bc62001-01-30 09:27:26 +1100157 /* XXX think about Bleichenbacher, too */
158 if (rsa_private_decrypt(challenge, challenge, prv) <= 0)
159 packet_disconnect(
160 "respond_to_rsa_challenge: rsa_private_decrypt failed");
Damien Millereba71ba2000-04-29 23:57:08 +1000161
162 /* Compute the response. */
163 /* The response is MD5 of decrypted challenge plus session id. */
164 len = BN_num_bytes(challenge);
165 if (len <= 0 || len > sizeof(buf))
Damien Miller7650bc62001-01-30 09:27:26 +1100166 packet_disconnect(
167 "respond_to_rsa_challenge: bad challenge length %d", len);
Damien Millereba71ba2000-04-29 23:57:08 +1000168
169 memset(buf, 0, sizeof(buf));
170 BN_bn2bin(challenge, buf + sizeof(buf) - len);
171 MD5_Init(&md);
172 MD5_Update(&md, buf, 32);
173 MD5_Update(&md, session_id, 16);
174 MD5_Final(response, &md);
175
176 debug("Sending response to host key RSA challenge.");
177
178 /* Send the response back to the server. */
179 packet_start(SSH_CMSG_AUTH_RSA_RESPONSE);
180 for (i = 0; i < 16; i++)
181 packet_put_char(response[i]);
182 packet_send();
183 packet_write_wait();
184
185 memset(buf, 0, sizeof(buf));
186 memset(response, 0, sizeof(response));
187 memset(&md, 0, sizeof(md));
188}
189
190/*
191 * Checks if the user has authentication file, and if so, tries to authenticate
192 * the user using it.
193 */
Ben Lindstrombba81212001-06-25 05:01:22 +0000194static int
Ben Lindstromc5b68002001-07-04 04:52:03 +0000195try_rsa_authentication(int idx)
Damien Millereba71ba2000-04-29 23:57:08 +1000196{
197 BIGNUM *challenge;
Ben Lindstrom05209452001-06-25 05:16:02 +0000198 Key *public, *private;
Ben Lindstromc5b68002001-07-04 04:52:03 +0000199 char buf[300], *passphrase, *comment, *authfile;
Damien Millerdff50992002-01-22 23:16:32 +1100200 int i, type, quit;
Damien Millereba71ba2000-04-29 23:57:08 +1000201
Ben Lindstromc5b68002001-07-04 04:52:03 +0000202 public = options.identity_keys[idx];
203 authfile = options.identity_files[idx];
204 comment = xstrdup(authfile);
205
Damien Millereba71ba2000-04-29 23:57:08 +1000206 debug("Trying RSA authentication with key '%.100s'", comment);
207
208 /* Tell the server that we are willing to authenticate using this key. */
209 packet_start(SSH_CMSG_AUTH_RSA);
210 packet_put_bignum(public->rsa->n);
211 packet_send();
212 packet_write_wait();
213
Damien Millereba71ba2000-04-29 23:57:08 +1000214 /* Wait for server's response. */
Damien Millerdff50992002-01-22 23:16:32 +1100215 type = packet_read();
Damien Millereba71ba2000-04-29 23:57:08 +1000216
217 /*
218 * The server responds with failure if it doesn\'t like our key or
219 * doesn\'t support RSA authentication.
220 */
221 if (type == SSH_SMSG_FAILURE) {
222 debug("Server refused our key.");
223 xfree(comment);
224 return 0;
225 }
226 /* Otherwise, the server should respond with a challenge. */
227 if (type != SSH_SMSG_AUTH_RSA_CHALLENGE)
228 packet_disconnect("Protocol error during RSA authentication: %d", type);
229
230 /* Get the challenge from the packet. */
Damien Millerda755162002-01-22 23:09:22 +1100231 if ((challenge = BN_new()) == NULL)
232 fatal("try_rsa_authentication: BN_new failed");
Damien Millerd432ccf2002-01-22 23:14:44 +1100233 packet_get_bignum(challenge);
Damien Miller48b03fc2002-01-22 23:11:40 +1100234 packet_check_eom();
Damien Millereba71ba2000-04-29 23:57:08 +1000235
236 debug("Received RSA challenge from server.");
237
Damien Millereba71ba2000-04-29 23:57:08 +1000238 /*
Ben Lindstromc5b68002001-07-04 04:52:03 +0000239 * If the key is not stored in external hardware, we have to
240 * load the private key. Try first with empty passphrase; if it
Damien Millereba71ba2000-04-29 23:57:08 +1000241 * fails, ask for a passphrase.
242 */
Ben Lindstrome143f612002-08-20 18:41:15 +0000243 if (public->flags & KEY_FLAG_EXT)
Ben Lindstromc5b68002001-07-04 04:52:03 +0000244 private = public;
245 else
246 private = key_load_private_type(KEY_RSA1, authfile, "", NULL);
Ben Lindstrom05209452001-06-25 05:16:02 +0000247 if (private == NULL && !options.batch_mode) {
248 snprintf(buf, sizeof(buf),
249 "Enter passphrase for RSA key '%.100s': ", comment);
250 for (i = 0; i < options.number_of_password_prompts; i++) {
Damien Millereba71ba2000-04-29 23:57:08 +1000251 passphrase = read_passphrase(buf, 0);
Ben Lindstrom05209452001-06-25 05:16:02 +0000252 if (strcmp(passphrase, "") != 0) {
253 private = key_load_private_type(KEY_RSA1,
254 authfile, passphrase, NULL);
255 quit = 0;
256 } else {
257 debug2("no passphrase given, try next key");
258 quit = 1;
259 }
Damien Millereba71ba2000-04-29 23:57:08 +1000260 memset(passphrase, 0, strlen(passphrase));
261 xfree(passphrase);
Ben Lindstrom05209452001-06-25 05:16:02 +0000262 if (private != NULL || quit)
263 break;
264 debug2("bad passphrase given, try again...");
Damien Millereba71ba2000-04-29 23:57:08 +1000265 }
Damien Millereba71ba2000-04-29 23:57:08 +1000266 }
267 /* We no longer need the comment. */
268 xfree(comment);
269
Ben Lindstrom05209452001-06-25 05:16:02 +0000270 if (private == NULL) {
271 if (!options.batch_mode)
272 error("Bad passphrase.");
273
274 /* Send a dummy response packet to avoid protocol error. */
275 packet_start(SSH_CMSG_AUTH_RSA_RESPONSE);
276 for (i = 0; i < 16; i++)
277 packet_put_char(0);
278 packet_send();
279 packet_write_wait();
280
281 /* Expect the server to reject it... */
Damien Millerdff50992002-01-22 23:16:32 +1100282 packet_read_expect(SSH_SMSG_FAILURE);
Ben Lindstrom05209452001-06-25 05:16:02 +0000283 BN_clear_free(challenge);
284 return 0;
285 }
286
Damien Millereba71ba2000-04-29 23:57:08 +1000287 /* Compute and send a response to the challenge. */
288 respond_to_rsa_challenge(challenge, private->rsa);
289
Ben Lindstromc5b68002001-07-04 04:52:03 +0000290 /* Destroy the private key unless it in external hardware. */
291 if (!(private->flags & KEY_FLAG_EXT))
292 key_free(private);
Damien Millereba71ba2000-04-29 23:57:08 +1000293
294 /* We no longer need the challenge. */
295 BN_clear_free(challenge);
296
297 /* Wait for response from the server. */
Damien Millerdff50992002-01-22 23:16:32 +1100298 type = packet_read();
Damien Millereba71ba2000-04-29 23:57:08 +1000299 if (type == SSH_SMSG_SUCCESS) {
300 debug("RSA authentication accepted by server.");
301 return 1;
302 }
303 if (type != SSH_SMSG_FAILURE)
304 packet_disconnect("Protocol error waiting RSA auth response: %d", type);
305 debug("RSA authentication refused.");
306 return 0;
307}
308
309/*
310 * Tries to authenticate the user using combined rhosts or /etc/hosts.equiv
311 * authentication and RSA host authentication.
312 */
Ben Lindstrombba81212001-06-25 05:01:22 +0000313static int
Ben Lindstromd0fca422001-03-26 13:44:06 +0000314try_rhosts_rsa_authentication(const char *local_user, Key * host_key)
Damien Millereba71ba2000-04-29 23:57:08 +1000315{
316 int type;
317 BIGNUM *challenge;
Damien Millereba71ba2000-04-29 23:57:08 +1000318
319 debug("Trying rhosts or /etc/hosts.equiv with RSA host authentication.");
320
321 /* Tell the server that we are willing to authenticate using this key. */
322 packet_start(SSH_CMSG_AUTH_RHOSTS_RSA);
Ben Lindstrom664408d2001-06-09 01:42:01 +0000323 packet_put_cstring(local_user);
Ben Lindstromd0fca422001-03-26 13:44:06 +0000324 packet_put_int(BN_num_bits(host_key->rsa->n));
325 packet_put_bignum(host_key->rsa->e);
326 packet_put_bignum(host_key->rsa->n);
Damien Millereba71ba2000-04-29 23:57:08 +1000327 packet_send();
328 packet_write_wait();
329
330 /* Wait for server's response. */
Damien Millerdff50992002-01-22 23:16:32 +1100331 type = packet_read();
Damien Millereba71ba2000-04-29 23:57:08 +1000332
333 /* The server responds with failure if it doesn't admit our
334 .rhosts authentication or doesn't know our host key. */
335 if (type == SSH_SMSG_FAILURE) {
336 debug("Server refused our rhosts authentication or host key.");
337 return 0;
338 }
339 /* Otherwise, the server should respond with a challenge. */
340 if (type != SSH_SMSG_AUTH_RSA_CHALLENGE)
341 packet_disconnect("Protocol error during RSA authentication: %d", type);
342
343 /* Get the challenge from the packet. */
Damien Millerda755162002-01-22 23:09:22 +1100344 if ((challenge = BN_new()) == NULL)
345 fatal("try_rhosts_rsa_authentication: BN_new failed");
Damien Millerd432ccf2002-01-22 23:14:44 +1100346 packet_get_bignum(challenge);
Damien Miller48b03fc2002-01-22 23:11:40 +1100347 packet_check_eom();
Damien Millereba71ba2000-04-29 23:57:08 +1000348
349 debug("Received RSA challenge for host key from server.");
350
351 /* Compute a response to the challenge. */
Ben Lindstromd0fca422001-03-26 13:44:06 +0000352 respond_to_rsa_challenge(challenge, host_key->rsa);
Damien Millereba71ba2000-04-29 23:57:08 +1000353
354 /* We no longer need the challenge. */
355 BN_clear_free(challenge);
356
357 /* Wait for response from the server. */
Damien Millerdff50992002-01-22 23:16:32 +1100358 type = packet_read();
Damien Millereba71ba2000-04-29 23:57:08 +1000359 if (type == SSH_SMSG_SUCCESS) {
360 debug("Rhosts or /etc/hosts.equiv with RSA host authentication accepted by server.");
361 return 1;
362 }
363 if (type != SSH_SMSG_FAILURE)
364 packet_disconnect("Protocol error waiting RSA auth response: %d", type);
365 debug("Rhosts or /etc/hosts.equiv with RSA host authentication refused.");
366 return 0;
367}
368
Damien Millereba71ba2000-04-29 23:57:08 +1000369/*
370 * Tries to authenticate with any string-based challenge/response system.
371 * Note that the client code is not tied to s/key or TIS.
372 */
Ben Lindstrombba81212001-06-25 05:01:22 +0000373static int
Ben Lindstrom551ea372001-06-05 18:56:16 +0000374try_challenge_response_authentication(void)
Damien Millereba71ba2000-04-29 23:57:08 +1000375{
376 int type, i;
Ben Lindstrom46c16222000-12-22 01:43:59 +0000377 u_int clen;
Ben Lindstroma65c78a2000-12-10 22:57:30 +0000378 char prompt[1024];
Damien Millereba71ba2000-04-29 23:57:08 +1000379 char *challenge, *response;
Ben Lindstrombdfb4df2001-10-03 17:12:43 +0000380
381 debug("Doing challenge response authentication.");
382
Damien Millereba71ba2000-04-29 23:57:08 +1000383 for (i = 0; i < options.number_of_password_prompts; i++) {
Ben Lindstroma65c78a2000-12-10 22:57:30 +0000384 /* request a challenge */
385 packet_start(SSH_CMSG_AUTH_TIS);
386 packet_send();
387 packet_write_wait();
388
Damien Millerdff50992002-01-22 23:16:32 +1100389 type = packet_read();
Ben Lindstroma65c78a2000-12-10 22:57:30 +0000390 if (type != SSH_SMSG_FAILURE &&
391 type != SSH_SMSG_AUTH_TIS_CHALLENGE) {
392 packet_disconnect("Protocol error: got %d in response "
Ben Lindstrom95fb2dd2001-01-23 03:12:10 +0000393 "to SSH_CMSG_AUTH_TIS", type);
Ben Lindstroma65c78a2000-12-10 22:57:30 +0000394 }
395 if (type != SSH_SMSG_AUTH_TIS_CHALLENGE) {
Ben Lindstrom95fb2dd2001-01-23 03:12:10 +0000396 debug("No challenge.");
Ben Lindstroma65c78a2000-12-10 22:57:30 +0000397 return 0;
398 }
399 challenge = packet_get_string(&clen);
Damien Miller48b03fc2002-01-22 23:11:40 +1100400 packet_check_eom();
Ben Lindstromdb65e8f2001-01-19 04:26:52 +0000401 snprintf(prompt, sizeof prompt, "%s%s", challenge,
Damien Miller9f0f5c62001-12-21 14:45:46 +1100402 strchr(challenge, '\n') ? "" : "\nResponse: ");
Ben Lindstroma65c78a2000-12-10 22:57:30 +0000403 xfree(challenge);
Damien Millereba71ba2000-04-29 23:57:08 +1000404 if (i != 0)
405 error("Permission denied, please try again.");
Ben Lindstroma65c78a2000-12-10 22:57:30 +0000406 if (options.cipher == SSH_CIPHER_NONE)
Damien Miller996acd22003-04-09 20:59:48 +1000407 logit("WARNING: Encryption is disabled! "
Damien Millerf61c0152002-04-23 20:56:02 +1000408 "Response will be transmitted in clear text.");
Ben Lindstroma65c78a2000-12-10 22:57:30 +0000409 response = read_passphrase(prompt, 0);
410 if (strcmp(response, "") == 0) {
411 xfree(response);
412 break;
413 }
Damien Millereba71ba2000-04-29 23:57:08 +1000414 packet_start(SSH_CMSG_AUTH_TIS_RESPONSE);
Damien Miller79438cc2001-02-16 12:34:57 +1100415 ssh_put_password(response);
Damien Millereba71ba2000-04-29 23:57:08 +1000416 memset(response, 0, strlen(response));
417 xfree(response);
418 packet_send();
419 packet_write_wait();
Damien Millerdff50992002-01-22 23:16:32 +1100420 type = packet_read();
Damien Millereba71ba2000-04-29 23:57:08 +1000421 if (type == SSH_SMSG_SUCCESS)
422 return 1;
423 if (type != SSH_SMSG_FAILURE)
424 packet_disconnect("Protocol error: got %d in response "
Ben Lindstrom95fb2dd2001-01-23 03:12:10 +0000425 "to SSH_CMSG_AUTH_TIS_RESPONSE", type);
Damien Millereba71ba2000-04-29 23:57:08 +1000426 }
427 /* failure */
428 return 0;
429}
430
431/*
432 * Tries to authenticate with plain passwd authentication.
433 */
Ben Lindstrombba81212001-06-25 05:01:22 +0000434static int
Damien Millereba71ba2000-04-29 23:57:08 +1000435try_password_authentication(char *prompt)
436{
Damien Millerdff50992002-01-22 23:16:32 +1100437 int type, i;
Damien Millereba71ba2000-04-29 23:57:08 +1000438 char *password;
439
440 debug("Doing password authentication.");
441 if (options.cipher == SSH_CIPHER_NONE)
Damien Miller996acd22003-04-09 20:59:48 +1000442 logit("WARNING: Encryption is disabled! Password will be transmitted in clear text.");
Damien Millereba71ba2000-04-29 23:57:08 +1000443 for (i = 0; i < options.number_of_password_prompts; i++) {
444 if (i != 0)
445 error("Permission denied, please try again.");
446 password = read_passphrase(prompt, 0);
447 packet_start(SSH_CMSG_AUTH_PASSWORD);
Damien Miller79438cc2001-02-16 12:34:57 +1100448 ssh_put_password(password);
Damien Millereba71ba2000-04-29 23:57:08 +1000449 memset(password, 0, strlen(password));
450 xfree(password);
451 packet_send();
452 packet_write_wait();
453
Damien Millerdff50992002-01-22 23:16:32 +1100454 type = packet_read();
Damien Millereba71ba2000-04-29 23:57:08 +1000455 if (type == SSH_SMSG_SUCCESS)
456 return 1;
457 if (type != SSH_SMSG_FAILURE)
458 packet_disconnect("Protocol error: got %d in response to passwd auth", type);
459 }
460 /* failure */
461 return 0;
462}
463
464/*
465 * SSH1 key exchange
466 */
467void
468ssh_kex(char *host, struct sockaddr *hostaddr)
469{
470 int i;
471 BIGNUM *key;
Damien Millerda755162002-01-22 23:09:22 +1100472 Key *host_key, *server_key;
Damien Millereba71ba2000-04-29 23:57:08 +1000473 int bits, rbits;
474 int ssh_cipher_default = SSH_CIPHER_3DES;
Ben Lindstrom46c16222000-12-22 01:43:59 +0000475 u_char session_key[SSH_SESSION_KEY_LENGTH];
476 u_char cookie[8];
477 u_int supported_ciphers;
478 u_int server_flags, client_flags;
Damien Millereba71ba2000-04-29 23:57:08 +1000479 u_int32_t rand = 0;
480
481 debug("Waiting for server public key.");
482
483 /* Wait for a public key packet from the server. */
Damien Millerdff50992002-01-22 23:16:32 +1100484 packet_read_expect(SSH_SMSG_PUBLIC_KEY);
Damien Millereba71ba2000-04-29 23:57:08 +1000485
486 /* Get cookie from the packet. */
487 for (i = 0; i < 8; i++)
488 cookie[i] = packet_get_char();
489
490 /* Get the public key. */
Damien Millerda755162002-01-22 23:09:22 +1100491 server_key = key_new(KEY_RSA1);
492 bits = packet_get_int();
Damien Millerd432ccf2002-01-22 23:14:44 +1100493 packet_get_bignum(server_key->rsa->e);
494 packet_get_bignum(server_key->rsa->n);
Damien Millereba71ba2000-04-29 23:57:08 +1000495
Damien Millerda755162002-01-22 23:09:22 +1100496 rbits = BN_num_bits(server_key->rsa->n);
Damien Millereba71ba2000-04-29 23:57:08 +1000497 if (bits != rbits) {
Damien Miller996acd22003-04-09 20:59:48 +1000498 logit("Warning: Server lies about size of server public key: "
Damien Millereba71ba2000-04-29 23:57:08 +1000499 "actual size is %d bits vs. announced %d.", rbits, bits);
Damien Miller996acd22003-04-09 20:59:48 +1000500 logit("Warning: This may be due to an old implementation of ssh.");
Damien Millereba71ba2000-04-29 23:57:08 +1000501 }
502 /* Get the host key. */
Damien Millerda755162002-01-22 23:09:22 +1100503 host_key = key_new(KEY_RSA1);
504 bits = packet_get_int();
Damien Millerd432ccf2002-01-22 23:14:44 +1100505 packet_get_bignum(host_key->rsa->e);
506 packet_get_bignum(host_key->rsa->n);
Damien Millereba71ba2000-04-29 23:57:08 +1000507
Damien Millerda755162002-01-22 23:09:22 +1100508 rbits = BN_num_bits(host_key->rsa->n);
Damien Millereba71ba2000-04-29 23:57:08 +1000509 if (bits != rbits) {
Damien Miller996acd22003-04-09 20:59:48 +1000510 logit("Warning: Server lies about size of server host key: "
Damien Millereba71ba2000-04-29 23:57:08 +1000511 "actual size is %d bits vs. announced %d.", rbits, bits);
Damien Miller996acd22003-04-09 20:59:48 +1000512 logit("Warning: This may be due to an old implementation of ssh.");
Damien Millereba71ba2000-04-29 23:57:08 +1000513 }
514
515 /* Get protocol flags. */
516 server_flags = packet_get_int();
517 packet_set_protocol_flags(server_flags);
518
519 supported_ciphers = packet_get_int();
520 supported_authentications = packet_get_int();
Damien Miller48b03fc2002-01-22 23:11:40 +1100521 packet_check_eom();
Damien Millereba71ba2000-04-29 23:57:08 +1000522
523 debug("Received server public key (%d bits) and host key (%d bits).",
Damien Millerda755162002-01-22 23:09:22 +1100524 BN_num_bits(server_key->rsa->n), BN_num_bits(host_key->rsa->n));
Damien Millereba71ba2000-04-29 23:57:08 +1000525
Damien Millerda755162002-01-22 23:09:22 +1100526 if (verify_host_key(host, hostaddr, host_key) == -1)
Damien Miller59d9fb92001-10-10 15:03:11 +1000527 fatal("Host key verification failed.");
Damien Millereba71ba2000-04-29 23:57:08 +1000528
529 client_flags = SSH_PROTOFLAG_SCREEN_NUMBER | SSH_PROTOFLAG_HOST_IN_FWD_OPEN;
530
Damien Millerda755162002-01-22 23:09:22 +1100531 compute_session_id(session_id, cookie, host_key->rsa->n, server_key->rsa->n);
Damien Millereba71ba2000-04-29 23:57:08 +1000532
533 /* Generate a session key. */
534 arc4random_stir();
535
536 /*
537 * Generate an encryption key for the session. The key is a 256 bit
538 * random number, interpreted as a 32-byte key, with the least
539 * significant 8 bits being the first byte of the key.
540 */
541 for (i = 0; i < 32; i++) {
542 if (i % 4 == 0)
543 rand = arc4random();
544 session_key[i] = rand & 0xff;
545 rand >>= 8;
546 }
547
548 /*
549 * According to the protocol spec, the first byte of the session key
550 * is the highest byte of the integer. The session key is xored with
551 * the first 16 bytes of the session id.
552 */
Damien Millerda755162002-01-22 23:09:22 +1100553 if ((key = BN_new()) == NULL)
554 fatal("respond_to_rsa_challenge: BN_new failed");
Damien Millereba71ba2000-04-29 23:57:08 +1000555 BN_set_word(key, 0);
556 for (i = 0; i < SSH_SESSION_KEY_LENGTH; i++) {
557 BN_lshift(key, key, 8);
558 if (i < 16)
559 BN_add_word(key, session_key[i] ^ session_id[i]);
560 else
561 BN_add_word(key, session_key[i]);
562 }
563
564 /*
565 * Encrypt the integer using the public key and host key of the
566 * server (key with smaller modulus first).
567 */
Damien Millerda755162002-01-22 23:09:22 +1100568 if (BN_cmp(server_key->rsa->n, host_key->rsa->n) < 0) {
Damien Millereba71ba2000-04-29 23:57:08 +1000569 /* Public key has smaller modulus. */
Damien Millerda755162002-01-22 23:09:22 +1100570 if (BN_num_bits(host_key->rsa->n) <
571 BN_num_bits(server_key->rsa->n) + SSH_KEY_BITS_RESERVED) {
572 fatal("respond_to_rsa_challenge: host_key %d < server_key %d + "
Damien Miller9f0f5c62001-12-21 14:45:46 +1100573 "SSH_KEY_BITS_RESERVED %d",
Damien Millerda755162002-01-22 23:09:22 +1100574 BN_num_bits(host_key->rsa->n),
575 BN_num_bits(server_key->rsa->n),
Damien Miller9f0f5c62001-12-21 14:45:46 +1100576 SSH_KEY_BITS_RESERVED);
Damien Millereba71ba2000-04-29 23:57:08 +1000577 }
Damien Millerda755162002-01-22 23:09:22 +1100578 rsa_public_encrypt(key, key, server_key->rsa);
579 rsa_public_encrypt(key, key, host_key->rsa);
Damien Millereba71ba2000-04-29 23:57:08 +1000580 } else {
581 /* Host key has smaller modulus (or they are equal). */
Damien Millerda755162002-01-22 23:09:22 +1100582 if (BN_num_bits(server_key->rsa->n) <
583 BN_num_bits(host_key->rsa->n) + SSH_KEY_BITS_RESERVED) {
584 fatal("respond_to_rsa_challenge: server_key %d < host_key %d + "
Damien Miller9f0f5c62001-12-21 14:45:46 +1100585 "SSH_KEY_BITS_RESERVED %d",
Damien Millerda755162002-01-22 23:09:22 +1100586 BN_num_bits(server_key->rsa->n),
587 BN_num_bits(host_key->rsa->n),
Damien Miller9f0f5c62001-12-21 14:45:46 +1100588 SSH_KEY_BITS_RESERVED);
Damien Millereba71ba2000-04-29 23:57:08 +1000589 }
Damien Millerda755162002-01-22 23:09:22 +1100590 rsa_public_encrypt(key, key, host_key->rsa);
591 rsa_public_encrypt(key, key, server_key->rsa);
Damien Millereba71ba2000-04-29 23:57:08 +1000592 }
593
594 /* Destroy the public keys since we no longer need them. */
Damien Millerda755162002-01-22 23:09:22 +1100595 key_free(server_key);
596 key_free(host_key);
Damien Millereba71ba2000-04-29 23:57:08 +1000597
Damien Millere39cacc2000-11-29 12:18:44 +1100598 if (options.cipher == SSH_CIPHER_NOT_SET) {
599 if (cipher_mask_ssh1(1) & supported_ciphers & (1 << ssh_cipher_default))
600 options.cipher = ssh_cipher_default;
601 } else if (options.cipher == SSH_CIPHER_ILLEGAL ||
602 !(cipher_mask_ssh1(1) & (1 << options.cipher))) {
Damien Miller996acd22003-04-09 20:59:48 +1000603 logit("No valid SSH1 cipher, using %.100s instead.",
Damien Miller874d77b2000-10-14 16:23:11 +1100604 cipher_name(ssh_cipher_default));
605 options.cipher = ssh_cipher_default;
Damien Millereba71ba2000-04-29 23:57:08 +1000606 }
607 /* Check that the selected cipher is supported. */
608 if (!(supported_ciphers & (1 << options.cipher)))
609 fatal("Selected cipher type %.100s not supported by server.",
Damien Miller9f0f5c62001-12-21 14:45:46 +1100610 cipher_name(options.cipher));
Damien Millereba71ba2000-04-29 23:57:08 +1000611
612 debug("Encryption type: %.100s", cipher_name(options.cipher));
613
614 /* Send the encrypted session key to the server. */
615 packet_start(SSH_CMSG_SESSION_KEY);
616 packet_put_char(options.cipher);
617
618 /* Send the cookie back to the server. */
619 for (i = 0; i < 8; i++)
620 packet_put_char(cookie[i]);
621
622 /* Send and destroy the encrypted encryption key integer. */
623 packet_put_bignum(key);
624 BN_clear_free(key);
625
626 /* Send protocol flags. */
627 packet_put_int(client_flags);
628
629 /* Send the packet now. */
630 packet_send();
631 packet_write_wait();
632
633 debug("Sent encrypted session key.");
634
635 /* Set the encryption key. */
636 packet_set_encryption_key(session_key, SSH_SESSION_KEY_LENGTH, options.cipher);
637
638 /* We will no longer need the session key here. Destroy any extra copies. */
639 memset(session_key, 0, sizeof(session_key));
640
641 /*
642 * Expect a success message from the server. Note that this message
643 * will be received in encrypted form.
644 */
Damien Millerdff50992002-01-22 23:16:32 +1100645 packet_read_expect(SSH_SMSG_SUCCESS);
Damien Millereba71ba2000-04-29 23:57:08 +1000646
647 debug("Received encrypted confirmation.");
648}
649
650/*
651 * Authenticate user
652 */
653void
Ben Lindstrom5eabda32001-04-12 23:34:34 +0000654ssh_userauth1(const char *local_user, const char *server_user, char *host,
Ben Lindstrom1bad2562002-06-06 19:57:33 +0000655 Sensitive *sensitive)
Damien Millereba71ba2000-04-29 23:57:08 +1000656{
657 int i, type;
Damien Miller9f0f5c62001-12-21 14:45:46 +1100658
Damien Millereba71ba2000-04-29 23:57:08 +1000659 if (supported_authentications == 0)
Ben Lindstrom5eabda32001-04-12 23:34:34 +0000660 fatal("ssh_userauth1: server supports no auth methods");
Damien Millereba71ba2000-04-29 23:57:08 +1000661
662 /* Send the name of the user to log in as on the server. */
663 packet_start(SSH_CMSG_USER);
Ben Lindstrom664408d2001-06-09 01:42:01 +0000664 packet_put_cstring(server_user);
Damien Millereba71ba2000-04-29 23:57:08 +1000665 packet_send();
666 packet_write_wait();
667
668 /*
669 * The server should respond with success if no authentication is
670 * needed (the user has no password). Otherwise the server responds
671 * with failure.
672 */
Damien Millerdff50992002-01-22 23:16:32 +1100673 type = packet_read();
Damien Millereba71ba2000-04-29 23:57:08 +1000674
675 /* check whether the connection was accepted without authentication. */
676 if (type == SSH_SMSG_SUCCESS)
Ben Lindstromec95ed92001-07-04 04:21:14 +0000677 goto success;
Damien Millereba71ba2000-04-29 23:57:08 +1000678 if (type != SSH_SMSG_FAILURE)
Ben Lindstromec95ed92001-07-04 04:21:14 +0000679 packet_disconnect("Protocol error: got %d in response to SSH_CMSG_USER", type);
Damien Miller9f0f5c62001-12-21 14:45:46 +1100680
Damien Millereba71ba2000-04-29 23:57:08 +1000681 /*
Damien Millereba71ba2000-04-29 23:57:08 +1000682 * Try .rhosts or /etc/hosts.equiv authentication with RSA host
683 * authentication.
684 */
685 if ((supported_authentications & (1 << SSH_AUTH_RHOSTS_RSA)) &&
Ben Lindstrom5eabda32001-04-12 23:34:34 +0000686 options.rhosts_rsa_authentication) {
Ben Lindstrom1bad2562002-06-06 19:57:33 +0000687 for (i = 0; i < sensitive->nkeys; i++) {
688 if (sensitive->keys[i] != NULL &&
689 sensitive->keys[i]->type == KEY_RSA1 &&
690 try_rhosts_rsa_authentication(local_user,
691 sensitive->keys[i]))
Ben Lindstromec95ed92001-07-04 04:21:14 +0000692 goto success;
Ben Lindstrom5eabda32001-04-12 23:34:34 +0000693 }
Damien Millereba71ba2000-04-29 23:57:08 +1000694 }
695 /* Try RSA authentication if the server supports it. */
696 if ((supported_authentications & (1 << SSH_AUTH_RSA)) &&
697 options.rsa_authentication) {
698 /*
699 * Try RSA authentication using the authentication agent. The
700 * agent is tried first because no passphrase is needed for
701 * it, whereas identity files may require passphrases.
702 */
703 if (try_agent_authentication())
Ben Lindstromec95ed92001-07-04 04:21:14 +0000704 goto success;
Damien Millereba71ba2000-04-29 23:57:08 +1000705
706 /* Try RSA authentication for each identity. */
707 for (i = 0; i < options.num_identity_files; i++)
Ben Lindstrom266dfdf2001-03-09 00:12:22 +0000708 if (options.identity_keys[i] != NULL &&
709 options.identity_keys[i]->type == KEY_RSA1 &&
Ben Lindstromc5b68002001-07-04 04:52:03 +0000710 try_rsa_authentication(i))
Ben Lindstromec95ed92001-07-04 04:21:14 +0000711 goto success;
Damien Millereba71ba2000-04-29 23:57:08 +1000712 }
Ben Lindstrom95fb2dd2001-01-23 03:12:10 +0000713 /* Try challenge response authentication if the server supports it. */
Damien Millereba71ba2000-04-29 23:57:08 +1000714 if ((supported_authentications & (1 << SSH_AUTH_TIS)) &&
Ben Lindstrom551ea372001-06-05 18:56:16 +0000715 options.challenge_response_authentication && !options.batch_mode) {
716 if (try_challenge_response_authentication())
Ben Lindstromec95ed92001-07-04 04:21:14 +0000717 goto success;
Damien Millereba71ba2000-04-29 23:57:08 +1000718 }
719 /* Try password authentication if the server supports it. */
720 if ((supported_authentications & (1 << SSH_AUTH_PASSWORD)) &&
721 options.password_authentication && !options.batch_mode) {
722 char prompt[80];
723
Ben Lindstrome0557162001-02-11 00:00:24 +0000724 snprintf(prompt, sizeof(prompt), "%.30s@%.128s's password: ",
Damien Millereba71ba2000-04-29 23:57:08 +1000725 server_user, host);
726 if (try_password_authentication(prompt))
Ben Lindstromec95ed92001-07-04 04:21:14 +0000727 goto success;
Damien Millereba71ba2000-04-29 23:57:08 +1000728 }
729 /* All authentication methods have failed. Exit with an error message. */
730 fatal("Permission denied.");
731 /* NOTREACHED */
Ben Lindstromec95ed92001-07-04 04:21:14 +0000732
733 success:
Damien Miller40eb1d82001-07-14 12:16:59 +1000734 return; /* need statement after label */
Damien Millereba71ba2000-04-29 23:57:08 +1000735}