apache / apache/mina-sshd

Implement ext-info-in-auth@openssh.com extension

Open
#562 0 comments 0 reactions 0 assignees View on GitHub
feature request
Dominant language
Java
Stars
1.1k
Forks
400
Avg merge
5d 1h
Merged PRs (30d)
1

Description

### Description

See https://github.com/openssh/openssh-portable/blob/V_9_8/PROTOCOL#L167-L184

> This protocol extension allows the SSH2_MSG_EXT_INFO to be sent
> during user authentication. RFC8308 does allow a second
> SSH2_MSG_EXT_INFO notification, but it may only be sent at the end
> of user authentication and this is too late to signal per-user
> server signature algorithms.
>
> Support for receiving the SSH2_MSG_EXT_INFO message during user
> authentication is signalled by the client including a
> "ext-info-in-auth@openssh.com" key via its initial SSH2_MSG_EXT_INFO
> set after the SSH2_MSG_NEWKEYS message.
>
> A server that supports this extension MAY send a second
> SSH2_MSG_EXT_INFO message any time after the client's first
> SSH2_MSG_USERAUTH_REQUEST, regardless of whether it succeed or fails.
> The client SHOULD be prepared to update the server-sig-algs that
> it received during an earlier SSH2_MSG_EXT_INFO with the later one.
>

### Motivation

Even without implementing per-user server signature algorithms, supporting this extension on the server side would bring better support when connecting to OpenSSH servers.

### Alternatives considered

_No response_

### Additional context

_No response_

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.