Skip to content

sshd offers by default unsupported method keyboard-interactive #1554

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
suvila opened this issue Feb 13, 2020 · 0 comments
Open

sshd offers by default unsupported method keyboard-interactive #1554

suvila opened this issue Feb 13, 2020 · 0 comments

Comments

@suvila
Copy link

suvila commented Feb 13, 2020

"OpenSSH for Windows" version
7.7.2.2

Server OperatingSystem
Windows Server 2019 Datacenter

Client OperatingSystem
Linux or other OS with client that attempts multiple public keys and keyboard-interactive authentication

What is failing
Windows sshd debug output shows it offers by default publickey,password,keyboard-interactive methods and if client has keyboard-interactive (ChallengeResponseAuthentication) enabled attempt will fail and waste authentication attempts as this is not currently supported in Windows sshd. Client may ultimately fail to connect with "Too many authentication failures." for example if it tries 5 public keys first or attempts keyboard-interactive multiple times.

Expected output
Until keyboard-interactive submethod password is implemented, change the default configuration to disable keyboard-interactive authentication so that sshd offers only publickey and password.

In C:\ProgramData\ssh\sshd_config
ChallengeResponseAuthentication no

sshd debug
debug3: userauth_finish: failure partial=0 next methods="publickey,password" [preauth]

Actual output
sshd debug
debug3: userauth_finish: failure partial=0 next methods="publickey,password,keyboard-interactive" [preauth]
debug1: userauth-request for user USERNAME service ssh-connection method keyboard-interactive [preauth]
debug1: attempt 6 failures 5 [preauth]
debug2: input_userauth_request: try method keyboard-interactive [preauth]
debug1: keyboard-interactive devs [preauth]
debug1: auth2_challenge: user=USERNAME devs= [preauth]
debug1: kbdint_alloc: devices '' [preauth]
debug2: auth2_challenge_start: devices [preauth]
maximum authentication attempts exceeded for USERNAME from CLIENT_IP port PORT ssh2 [preauth]

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant