Description
Previous thread here: https://groups.google.com/forum/#!topic/golang-nuts/rxrYhntkQtI.
Currently the x/crypto/ssh
package uses callbacks in ServerConfig
to do the autentication. Supported callbacks including "password,publickey,keyboard-interactive", and the client authenticates successfully with any of the callbacks.
This makes it impossible to implement multi-step authentication correctly. An example multi-step authentication process is to do publickey
first, then keyboard-interactive
to verify OTP tokens. When a client attempts to login, the server must first respond with only publickey
available. When the client successfully completes the first stage, the server will respond with an authentication error with PartialSuccess
set, and with the next available method keyboard-interactive
. The client then knows it can continue with the second stage.
I'd propose to add a NextAuthMethodsCallback
to ssh.ServerConfig
. An example implementation is here: https://gist.github.com/thinxer/637acd43480174fede118704f27530a6#file-authmethods-patch.
If this change looks good, I will add tests and submit a patch for code review.