How to check if the password is wrong or sshd server is not ready
1534854467 opened this issue · 11 comments
got "Permission denied(password)" when I use the wrong password or the sshd does not start.
how to check if the password is wrong or sshd server is not ready?
you can check sshpiperd logs for the reason of failed attempts
you can check sshpiperd logs for the reason of failed attempts
has any way check by the ssh return information?
eg: SSH connect refused/ SSH server not ready
for example, you will see dial tcp 127.0.0.1:23: connect: connection refused if remote is not available
ERRO[0019] cannot create upstream for 127.0.0.1:58014 (username [root]) with password auth: dial tcp 127.0.0.1:23: connect: connection refused
yes, i see this error message in the sshpiperd server when upstream connection refused
but ssh client still show "Permission denied (password)"
if i was a user, i don't know if my sshd server is running by terminal print
sshpiper will not know the upstream endpoint until the downstream (user) entered password.
and the upstream may be different if the password not the same.
also, there is no way to send an error/msg to downstream side during ssh password auth.
@tg123
please review this pr, i am try add some error message when network error
basically, should not touch any file in original crypto. all change should be limited to sshpiper.go
you should add hook in your case.
UpstreamAuthFailureCallback
but now there is now way to write back to client side
@tg123
I have a new pr, please review it again
IHMO, this introduces some security concern that downstream can detected if user is valid or not
however, i am happy if it can be customized via plugin
some changes in crypto in my mind
in authUpstream add a new DisconnectErr handler
if DisconnectErr { send DisconnectErr msg }
the DisconnectErr is returned by NextAuthMethods after UpstreamAuthFailureCallback noticed some special err
everything should be done in plugin
you can check failtoban to see if it is good enough for your case after new API added
thx for your reply! that's good if has a handle DisconnectErrHandler , and i am trying;
and another way,
i am try add healthcheck in NewConnectionCallback for kubernetes plugin, do net.Dial("tcp", upstream_addr) in NewConnectionCallback
but i can not got ssh user, because just got net.Conn in libplugin.ConnMetadata,
so i can not do upstream healthcheck in NewConnectionCallback
@tg123
Do you have any suggestions? thx
user name is only available after first handshake, you can do health check in PasswordCallback for exmaple, return err to disconnect