MarketSquare / MarketSquare/SSHLibrary

Authentication to a proxy server doesn't work with a proxy multi-stage auth.

Open
#466 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
167
Forks
145
PR merge metrics
No merged PRs in 30d

Description

Iam using SSHLibrary and particular Open Connection and Login keywords in robot to open a connection and login to a server.

```
Open Connection host=10.45.11.12 port=31022 timeout=5m
Login username=admin password=Test1234
```

Iam getting the following auth failure:

```
KEYWORD SSHLibrary . Open Connection host=10.45.11.12, port=31022, timeout=5m
Documentation:

Opens a new SSH connection to the given host and port.
Start / End / Elapsed: 20240904 14:31:29.097 / 20240904 14:31:29.097 / 00:00:00.000
14:31:29.097 TRACE Arguments: [ host='10.45.11.12' | port=31022 | timeout='5m' ]
14:31:29.097 TRACE Return: 1
00:00:00.811 KEYWORD SSHLibrary . Login username=admin, password=Test1234
Documentation:

Logs into the SSH server with the given username and password.
Start / End / Elapsed: 20240904 14:31:29.097 / 20240904 14:31:29.908 / 00:00:00.811
14:31:29.097 TRACE Arguments: [ username='admin' | password='Test1234' ]
14:31:29.097 INFO Logging into '10.45.11.12:31022' as 'admin'.
14:31:29.466 DEBUG Adding ssh-rsa host key for [10.45.11.12]:31022: b'e966a4d69b72205560fbd44b58e4a531'
14:31:29.905 FAIL Authentication failed for user 'admin'.
14:31:29.908 DEBUG Traceback (most recent call last):
File "/home/my-username/env/sats/lib/python3.10/site-packages/SSHLibrary/pythonclient.py", line 183, in _login
self.client.connect(self.config.host, self.config.port, username,
File "/home/my-username/env/sats/lib/python3.10/site-packages/paramiko/client.py", line 485, in connect
self._auth(
File "/home/my-username/env/sats/lib/python3.10/site-packages/paramiko/client.py", line 818, in _auth
raise saved_exception
File "/home/my-username/env/sats/lib/python3.10/site-packages/paramiko/client.py", line 805, in _auth
self._transport.auth_password(username, password)
File "/home/my-username/env/sats/lib/python3.10/site-packages/paramiko/transport.py", line 1603, in auth_password
return self.auth_handler.wait_for_response(my_event)
File "/home/my-username/env/sats/lib/python3.10/site-packages/paramiko/auth_handler.py", line 263, in wait_for_response
raise e
paramiko.ssh_exception.AuthenticationException: Authentication failed.

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "/home/my-username/env/sats/lib/python3.10/site-packages/SSHLibrary/pythonclient.py", line 197, in _login
transport.auth_password(username, password)
File "/home/my-username/env/sats/lib/python3.10/site-packages/paramiko/transport.py", line 1603, in auth_password
return self.auth_handler.wait_for_response(my_event)
File "/home/my-username/env/sats/lib/python3.10/site-packages/paramiko/auth_handler.py", line 263, in wait_for_response
raise e
paramiko.ssh_exception.AuthenticationException: Authentication failed.

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "/home/my-username/env/sats/lib/python3.10/site-packages/SSHLibrary/abstractclient.py", line 208, in login
self._login(username, password, allow_agent, look_for_keys, proxy_cmd, read_config,
File "/home/my-username/env/sats/lib/python3.10/site-packages/SSHLibrary/pythonclient.py", line 199, in _login
raise SSHClientException
SSHLibrary.abstractclient.SSHClientException

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "/home/my-username/env/sats/lib/python3.10/site-packages/SSHLibrary/library.py", line 1087, in _login
login_output = login_method(username, *args)
File "/home/my-username/env/sats/lib/python3.10/site-packages/SSHLibrary/abstractclient.py", line 212, in login
raise SSHClientException("Authentication failed for user '%s'."
SSHLibrary.abstractclient.SSHClientException: Authentication failed for user 'admin'.

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "/home/my-username/env/sats/lib/python3.10/site-packages/SSHLibrary/library.py", line 1007, in login
return self._login(self.current.login, username, password, is_truthy(allow_agent),
File "/home/my-username/env/sats/lib/python3.10/site-packages/SSHLibrary/library.py", line 1093, in _login
raise RuntimeError(e)
RuntimeError: Authentication failed for user 'admin'.
```

Note, that the username and password are right.

Also, from the server point of view that we want to login, after investigation we have the following details:
The "linux" device specification is not valid for use with proxy. After the Netmiko SSH client provides the user's password to proxy, it expects an SSH message indicating that the auth was successful. This isn't how proxy works. After the password is validated, proxy then enters a keyboard-interactive session where you choose the network element (and possibly credential category, etc.,). Only after you have entered this information and proxy has connected to the network element is the desired SSH auth message sent by proxy to the client, allowing you to open a shell channel and send/receive bytes (in the case of SSH Session) or execute a command (in the case of SSH Command).

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with SSHLibrary/pythonclient.py _login and compare its Paramiko authentication flow with the multi-stage proxy behavior described in the issue. Trace the calls through abstractclient.py and library.py; done should mean proxy authentication can complete its keyboard-interactive selection before the SSH session or command is opened.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
authentication, networking
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.