Server SSH

Server-side settings for SSH connections. More...

Collaboration diagram for Server SSH:

Typedefs
typedef int(*	nc_server_ssh_interactive_auth_clb) (const struct nc_session *session, ssh_session ssh_sess, ssh_message msg, void *user_data)
	Keyboard interactive authentication callback.

Functions
int	nc_server_ssh_kbdint_get_nanswers (const struct nc_session *session, ssh_session libssh_session)
	Get the number of answers to Keyboard interactive authentication prompts.
int	nc_server_ssh_set_authkey_path_format (const char *path)
	Set the format of the path to authorized_keys files.
void	nc_server_ssh_set_interactive_auth_clb (nc_server_ssh_interactive_auth_clb auth_clb, void *user_data, void(*free_user_data)(void *user_data))
	Set the callback for SSH interactive authentication.
int	nc_server_ssh_set_pam_conf_filename (const char *filename)
	Set the name of the PAM configuration file.
int	nc_server_ssh_set_protocol_string (const char *prefix)
	Set the SSH protocol identification string.

Detailed Description

Server-side settings for SSH connections.

Typedef Documentation

nc_server_ssh_interactive_auth_clb

typedef int(* nc_server_ssh_interactive_auth_clb) (const struct nc_session *session, ssh_session ssh_sess, ssh_message msg, void *user_data)

Keyboard interactive authentication callback.

The callback has to handle sending interactive challenges and receiving responses by itself. The exact workflow depends on the libssh version the library was compiled with.

libssh older than 0.12 (message-based workflow): The callback is invoked exactly once per authentication attempt, with the initial keyboard-interactive request message. Prepare all prompts for the user and send them via ssh_message_auth_interactive_request(). Get the answers either by calling ssh_message_get() or nc_server_ssh_kbdint_get_nanswers(), and then ssh_userauth_kbdint_getanswer() for each of them. Multiple challenge-response rounds can be performed within this single invocation.

libssh 0.12 and newer (callback-based workflow): Authentication is driven by libssh server callbacks, so this callback is invoked separately for every stage of the keyboard-interactive exchange and each invocation must return promptly (blocking helpers such as ssh_message_get() or nc_server_ssh_kbdint_get_nanswers() must not be used). Determine the current stage with ssh_message_auth_kbdint_is_response():

• not a response: send a challenge via ssh_message_auth_interactive_request() and return SSH_AUTH_INFO;
• a response: retrieve the answers with ssh_userauth_kbdint_getnanswers() and ssh_userauth_kbdint_getanswer() and return the authentication result, or send another challenge and return SSH_AUTH_INFO to start the next round.

Parameters

[in]	session	NETCONF session.
[in]	ssh_sess	libssh session.
[in]	msg	SSH message with the interactive request (a response message with libssh 0.12+).
[in]	user_data	Arbitrary user data.

Returns

0 for successful authentication, non-zero to deny the user; with libssh 0.12+ SSH_AUTH_INFO may be returned when a challenge was sent and the client's response is expected (the callback is then invoked again once it arrives). With libssh 0.12+, SSH_AUTH_PARTIAL may also be returned if the method succeeded but more authentication methods are required based on the server configuration; if none are required, the authentication completes instead of returning a partial success.

Definition at line 570 of file session_server.h.

Function Documentation

nc_server_ssh_set_authkey_path_format()

int nc_server_ssh_set_authkey_path_format

(

const char *

path

)

Set the format of the path to authorized_keys files.

This path format will be set globally for all clients wishing to authenticate via the SSH Public Key system authentication.

Parameters

[in]

path

Path to authorized_keys files. The path may contain the following tokens: u - replaced by the username of the user trying to authenticate, h - replaced by the home directory of the user trying to authenticate, U - replaced by the UID of the user trying to authenticate, %% - a literal ''.

Returns

0 on success, 1 on error.

nc_server_ssh_set_interactive_auth_clb()

void nc_server_ssh_set_interactive_auth_clb	(	nc_server_ssh_interactive_auth_clb	auth_clb,
		void *	user_data,
		void(*)(void *user_data)	free_user_data
	)

Set the callback for SSH interactive authentication.

Parameters

[in]	auth_clb	Keyboard interactive authentication callback. Called once per authentication (libssh < 0.12) or once per stage (libssh >= 0.12).
[in]	user_data	Optional arbitrary user data that will be passed to auth_clb.
[in]	free_user_data	Optional callback that will be called during cleanup to free any user_data.

nc_server_ssh_kbdint_get_nanswers()

int nc_server_ssh_kbdint_get_nanswers	(	const struct nc_session *	session,
		ssh_session	libssh_session
	)

Get the number of answers to Keyboard interactive authentication prompts.

The actual answers can later be retrieved by calling ssh_userauth_kbdint_getanswer() on the libssh_session.

Parameters

[in]	session	NETCONF session.
[in]	libssh_session	libssh session.

Returns

Non-negative number of answers on success, -1 on configurable authentication timeout, disconnect or other error.

nc_server_ssh_set_pam_conf_filename()

int nc_server_ssh_set_pam_conf_filename

(

const char *

filename

)

Set the name of the PAM configuration file.

This filename will be set globally for all clients wishing to authenticate via the SSH Keyboard Interactive authentication method.

Parameters

[in]

filename

Name of the PAM configuration file. The file needs to be located in the default PAM directory (usually /etc/pam.d/).

Returns

0 on success, 1 on error.

nc_server_ssh_set_protocol_string()

int nc_server_ssh_set_protocol_string

(

const char *

prefix

)

Set the SSH protocol identification string.

Creates an SSH identification string (per RFC 4253 Section 4.2) in the format: <prefix>-libnetconf2_<version>-libssh_<version>

For example: "NETCONF-libnetconf2_5.3.3-libssh_0.9.6"

Maximum length of the resulting string is 245 characters.

If not set, the default identification string is "libnetconf2_\<version\>-libssh_\<version\>".

Parameters

[in]

prefix

Prefix string to use at the beginning of the identification string.

Returns

0 on success, 1 on error.