mirror of
https://github.com/shazow/ssh-chat.git
synced 2025-04-12 07:10:05 +03:00
7413539965
* Move password authentication handling into sshd/auth (fixes #394). Password authentication is now completely handeled in Auth. The normal keyboard-interactive handler checks if passwords are supported and asks for them, removing the need to override the callbacks. Brute force throttling is removed; I'd like to base it on IP address banning, which requires changes to the checks. I'm not sure, but I think timing attacks against the password are fixed: - The hashing of the real password happens only at startup. - The hashing of a provided password is something an attacker can do themselves; It doesn't leak anything about the real password. - The hash comparison is constant-time. * refactor checks, IP-ban incorrect passphrases, renames - s/assword/assphrase/, typo fixes - bans are checked separately from public keys - an incorrect passphrase results in a one-minute IP ban - whitelists no longer override bans (i.e. you can get banned if you're whitelisted) * (hopefully) final changes
55 lines
1.0 KiB
Go
55 lines
1.0 KiB
Go
package sshd
|
|
|
|
import (
|
|
"errors"
|
|
"net"
|
|
"testing"
|
|
"time"
|
|
|
|
"golang.org/x/crypto/ssh"
|
|
)
|
|
|
|
var errRejectAuth = errors.New("not welcome here")
|
|
|
|
type RejectAuth struct{}
|
|
|
|
func (a RejectAuth) AllowAnonymous() bool {
|
|
return false
|
|
}
|
|
func (a RejectAuth) AcceptPassphrase() bool {
|
|
return false
|
|
}
|
|
func (a RejectAuth) CheckBans(addr net.Addr, key ssh.PublicKey, clientVersion string) error {
|
|
return errRejectAuth
|
|
}
|
|
func (a RejectAuth) CheckPublicKey(ssh.PublicKey) error {
|
|
return errRejectAuth
|
|
}
|
|
func (a RejectAuth) CheckPassphrase(string) error {
|
|
return errRejectAuth
|
|
}
|
|
func (a RejectAuth) BanAddr(net.Addr, time.Duration) {}
|
|
|
|
func TestClientReject(t *testing.T) {
|
|
signer, err := NewRandomSigner(512)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
config := MakeAuth(RejectAuth{})
|
|
config.AddHostKey(signer)
|
|
|
|
s, err := ListenSSH("localhost:0", config)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
defer s.Close()
|
|
|
|
go s.Serve()
|
|
|
|
conn, err := ssh.Dial("tcp", s.Addr().String(), NewClientConfig("foo"))
|
|
if err == nil {
|
|
defer conn.Close()
|
|
t.Error("Failed to reject conncetion")
|
|
}
|
|
}
|