PowerShell / PowerShell/Win32-OpenSSH
sshd offers by default unsupported method keyboard-interactive
Nobody has claimed this yet.
- Dominant language
- No language data
- Stars
- 8.3k
- Forks
- 819
- PR merge metrics
- No merged PRs in 30d
Description
"OpenSSH for Windows" version
7.7.2.2
Server OperatingSystem
Windows Server 2019 Datacenter
Client OperatingSystem
Linux or other OS with client that attempts multiple public keys and keyboard-interactive authentication
What is failing
Windows sshd debug output shows it offers by default publickey,password,keyboard-interactive methods and if client has keyboard-interactive (ChallengeResponseAuthentication) enabled attempt will fail and waste authentication attempts as this is not currently supported in Windows sshd. Client may ultimately fail to connect with "Too many authentication failures." for example if it tries 5 public keys first or attempts keyboard-interactive multiple times.
Expected output
Until keyboard-interactive submethod password is implemented, change the default configuration to disable keyboard-interactive authentication so that sshd offers only publickey and password.
In C:\ProgramData\ssh\sshd_config
ChallengeResponseAuthentication no
sshd debug
debug3: userauth_finish: failure partial=0 next methods="publickey,password" [preauth]
Actual output
sshd debug
debug3: userauth_finish: failure partial=0 next methods="publickey,password,keyboard-interactive" [preauth]
debug1: userauth-request for user USERNAME service ssh-connection method keyboard-interactive [preauth]
debug1: attempt 6 failures 5 [preauth]
debug2: input_userauth_request: try method keyboard-interactive [preauth]
debug1: keyboard-interactive devs [preauth]
debug1: auth2_challenge: user=USERNAME devs= [preauth]
debug1: kbdint_alloc: devices '' [preauth]
debug2: auth2_challenge_start: devices [preauth]
maximum authentication attempts exceeded for USERNAME from CLIENT_IP port PORT ssh2 [preauth]
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the source or template that generates the default C:\ProgramData\ssh\sshd_config, then inspect how ChallengeResponseAuthentication is set. Reproduce the authentication-method list with the shown sshd debug scenario. Done means a fresh default configuration disables keyboard-interactive authentication and advertises only publickey and password.
Written by the indexing model from the issue text.
Assessment
- Domain
- authentication, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 45/100