PowerShell / PowerShell/Win32-OpenSSH

sshd offers by default unsupported method keyboard-interactive

Open
#1,554 0 comments 2 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
No language data
Stars
8.3k
Forks
819
PR merge metrics
No merged PRs in 30d

Description

"OpenSSH for Windows" version
7.7.2.2

Server OperatingSystem
Windows Server 2019 Datacenter

Client OperatingSystem
Linux or other OS with client that attempts multiple public keys and keyboard-interactive authentication

What is failing
Windows sshd debug output shows it offers by default publickey,password,keyboard-interactive methods and if client has keyboard-interactive (ChallengeResponseAuthentication) enabled attempt will fail and waste authentication attempts as this is not currently supported in Windows sshd. Client may ultimately fail to connect with "Too many authentication failures." for example if it tries 5 public keys first or attempts keyboard-interactive multiple times.

Expected output
Until keyboard-interactive submethod password is implemented, change the default configuration to disable keyboard-interactive authentication so that sshd offers only publickey and password.

In C:\ProgramData\ssh\sshd_config
ChallengeResponseAuthentication no

sshd debug
debug3: userauth_finish: failure partial=0 next methods="publickey,password" [preauth]

Actual output
sshd debug
debug3: userauth_finish: failure partial=0 next methods="publickey,password,keyboard-interactive" [preauth]
debug1: userauth-request for user USERNAME service ssh-connection method keyboard-interactive [preauth]
debug1: attempt 6 failures 5 [preauth]
debug2: input_userauth_request: try method keyboard-interactive [preauth]
debug1: keyboard-interactive devs [preauth]
debug1: auth2_challenge: user=USERNAME devs= [preauth]
debug1: kbdint_alloc: devices '' [preauth]
debug2: auth2_challenge_start: devices [preauth]
maximum authentication attempts exceeded for USERNAME from CLIENT_IP port PORT ssh2 [preauth]

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by locating the source or template that generates the default C:\ProgramData\ssh\sshd_config, then inspect how ChallengeResponseAuthentication is set. Reproduce the authentication-method list with the shown sshd debug scenario. Done means a fresh default configuration disables keyboard-interactive authentication and advertises only publickey and password.

Written by the indexing model from the issue text.

Assessment

Domain
authentication, security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.