72 lines
2.4 KiB
Ruby
72 lines
2.4 KiB
Ruby
|
require 'net/ssh/authentication/methods/abstract'
|
||
|
|
|
||
|
|
module Net
|
||
|
|
module SSH
|
||
|
|
module Authentication
|
||
|
|
module Methods
|
||
|
|
|
||
|
|
# Implements the host-based SSH authentication method.
|
||
|
|
class Hostbased < Abstract
|
||
|
|
include Constants
|
||
|
|
|
||
|
|
# Attempts to perform host-based authorization of the user by trying
|
||
|
|
# all known keys.
|
||
|
|
def authenticate(next_service, username, password=nil)
|
||
|
|
return false unless key_manager
|
||
|
|
|
||
|
|
key_manager.each_identity do |identity|
|
||
|
|
return true if authenticate_with(identity, next_service,
|
||
|
|
username, key_manager)
|
||
|
|
end
|
||
|
|
|
||
|
|
return false
|
||
|
|
end
|
||
|
|
|
||
|
|
private
|
||
|
|
|
||
|
|
# Returns the hostname as reported by the underlying socket.
|
||
|
|
def hostname
|
||
|
|
session.transport.socket.client_name
|
||
|
|
end
|
||
|
|
|
||
|
|
# Attempts to perform host-based authentication of the user, using
|
||
|
|
# the given host identity (key).
|
||
|
|
def authenticate_with(identity, next_service, username, key_manager)
|
||
|
|
debug { "trying hostbased (#{identity.fingerprint})" }
|
||
|
|
client_username = ENV['USER'] || username
|
||
|
|
|
||
|
|
req = build_request(identity, next_service, username, "#{hostname}.", client_username)
|
||
|
|
sig_data = Buffer.from(:string, session_id, :raw, req)
|
||
|
|
|
||
|
|
sig = key_manager.sign(identity, sig_data.to_s)
|
||
|
|
|
||
|
|
message = Buffer.from(:raw, req, :string, sig)
|
||
|
|
|
||
|
|
send_message(message)
|
||
|
|
message = session.next_message
|
||
|
|
|
||
|
|
case message.type
|
||
|
|
when USERAUTH_SUCCESS
|
||
|
|
info { "hostbased succeeded (#{identity.fingerprint})" }
|
||
|
|
return true
|
||
|
|
when USERAUTH_FAILURE
|
||
|
|
info { "hostbased failed (#{identity.fingerprint})" }
|
||
|
|
return false
|
||
|
|
else
|
||
|
|
raise Net::SSH::Exception, "unexpected server response to USERAUTH_REQUEST: #{message.type} (#{message.inspect})"
|
||
|
|
end
|
||
|
|
end
|
||
|
|
|
||
|
|
# Build the "core" hostbased request string.
|
||
|
|
def build_request(identity, next_service, username, hostname, client_username)
|
||
|
|
userauth_request(username, next_service, "hostbased", identity.ssh_type,
|
||
|
|
Buffer.from(:key, identity).to_s, hostname, client_username).to_s
|
||
|
|
end
|
||
|
|
|
||
|
|
end
|
||
|
|
|
||
|
|
end
|
||
|
|
end
|
||
|
|
end
|
||
|
|
end
|