twisted conch, overriding authentication

Question

I have been trying to override the default authentication scheme in a twisted conch module. Something that I thought I understood how to do. The script itself is the answer to this question. I am subclassing SSHUserAuthClient in the following way:

class ClientUserAuth(SSHUserAuthClient):
    def getPassword(self, prompt = None):
        return defer.succeed("*****")

and I am obviously replacing the SSHUserAuthClient call with a call to my class in the script. For reasons I can't understand the script is not executing the getPassword method in my class but the superclass getPassword method. Does anyone know what I am doing wrong? The only other change to the script I made is I added the following module import

from twisted.internet import defer

Thanks!

EDIT: Strangely the subclass method getPublicKey is being called correctly. It is just the getPassword method that is acting weird.

score 3 · Accepted Answer · answered Mar 06 '11 at 23:20

3

You're probably actually seeing keyboard-interactive authentication taking place. This is like password authentication, but separate. The reason you see different behavior between Linux and OS X is just that your Linux and OS X SSH servers are configured differently.

Override getGenericAnswers to handle this one.

answered Mar 06 '11 at 23:20

Jean-Paul Calderone

47,755
6
94
122

Well I am a moron. Your suggestion works perfectly...thanks again :) – rymurr Mar 06 '11 at 23:52

score 3 · Answer 2 · answered Sep 06 '11 at 20:42

Some additional details of how to implement a keyboard-interactive authentication.

I thought I had this working the first time, but my server sends two interactive requests. The first requests contains a prompt = [('Password: ', False)].
The second contains an empty prompt = []

The code below works with every server I've tested so far (Redhat, Ubuntu, OpenSUSE)

from twisted.conch.ssh import keys, userauth

class ClientUserAuth(userauth.SSHUserAuthClient):
    def getPassword(self, prompt = None):
        #normal password authentication
        print "PASSWORD AUTH"
        return defer.succeed('*****') # <-- YOUR PASSWORD

    def getGenericAnswers(self, name, instruction, prompts):
        #interactive password authentication
        print "INTERACTIVE AUTH"
        response = ['']*len(prompts)
        for i, p in enumerate(prompts):
            try:
                if('password' in p[0].lower()):
                    response[i] = '*****' # <-- YOUR PASSWORD
            except:
                pass
        #The response is always a sequence, and the length of it is always
        #identical to the length of prompts
        return defer.succeed(response)

Enabling Logging in Twisted was helpful for debugging what Conch was doing under the hood as well.

from twisted.python import log
log.msg('Started Logging for A Conch Program')
log.startLogging(sys.stdout)

twisted conch, overriding authentication

2 Answers2