paramiko / paramiko/paramiko

Authentication Failed on devices where copyright banner is presented before password prompt (ADVA)

Open
#1,476 9 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Keys Nonstandard platforms Support
Dominant language
Python
Stars
9.9k
Forks
2.1k
PR merge metrics
No merged PRs in 30d

Description

I have two ADVA NIDs, one on an older version, 9.5, one on a newer version, 9.6. Per the vendor, one of the changes between these versions is when the copyright banner is presented during SSH authentication.

When logging in via terminal, here is the output on the 9.5 version:

---> ssh 10.0.10.100 -l root
Copyright (c) 2017 ADVA Optical Networking SE. All rights reserved.
root@10.0.10.100's password:
********************************************************************************
Authorized users only!!
********************************************************************************
NID1-->

Here is the 9.6 version:

---> ssh 10.0.10.102 -l root
root@10.0.10.102's password:
Copyright (c) 2018 ADVA Optical Networking SE. All rights reserved.
********************************************************************************
Authorized users only!!
********************************************************************************
NID2-->

When attempting to login to the device on version 9.5 with the following code, I get Authentication errors. Connecting to the device on version 9.6 using the same code (save for the ip of course) works perfectly fine.

Python 3.6.3 (default, Mar 20 2018, 13:50:41)
[GCC 4.8.5 20150623 (Red Hat 4.8.5-16)] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>>
>>> import paramiko
>>>
>>> ip = '10.0.10.100'
>>> username = 'root'
>>> password = 'password'
>>>
>>> con = paramiko.SSHClient()
>>> con.set_missing_host_key_policy(paramiko.AutoAddPolicy())
>>>
>>> con.connect(ip, username=username, password=password, look_for_keys=False, allow_agent=False)

Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/opt/dev/user/lib64/python3.6/site-packages/paramiko/client.py", line 425, in connect
    passphrase,
  File "/opt/dev/user/lib64/python3.6/site-packages/paramiko/client.py", line 718, in _auth
    raise saved_exception
  File "/opt/dev/user/lib64/python3.6/site-packages/paramiko/client.py", line 703, in _auth
    self._transport.auth_password(username, password)
  File "/opt/dev/user/lib64/python3.6/site-packages/paramiko/transport.py", line 1381, in auth_password
    return self.auth_handler.wait_for_response(my_event)
  File "/opt/dev/user/lib64/python3.6/site-packages/paramiko/auth_handler.py", line 231, in wait_for_response
    raise e
paramiko.ssh_exception.AuthenticationException: Authentication failed.

I believe this may be related #1177, hopefully these extra details can help.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with paramiko/client.py, transport.py, and auth_handler.py from the traceback, then reproduce the SSH authentication sequence against the ADVA 9.5 device described in the issue. Compare the behavior with ADVA 9.6 and related issue #1177. Done means password authentication succeeds when the server presents its copyright banner before the password prompt.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
networking
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.