Tcl

SSH Keyboard-Interactive Authentication

Demonstrates keyboard-interactive authentication with an SSH server. StartKeyboardAuth returns XML describing the server's prompts, and ContinueKeyboardAuth submits each response. Authentication is complete when the returned XML contains either a success or an error node.

Background: Keyboard-interactive is SSH's flexible, prompt-driven method: rather than assuming a single password, the server asks one or more questions — a password, a one-time code, a security question — and the client answers each. This is how SSH supports two-factor and other challenge-response schemes. The prompt XML also indicates whether each response should be echoed, so a client knows when to mask input. A server may issue several rounds, so a robust implementation loops until it sees success or error rather than assuming one exchange is enough.

Chilkat Tcl Downloads

Download Chilkat for Tcl

Tcl


load ./chilkat.dll

set success 0

#  This example requires the Chilkat API to have been previously unlocked.
#  See Global Unlock Sample for sample code.

#  Demonstrates keyboard-interactive authentication with an SSH server.  The server sends one or
#  more prompts as XML, and the application answers each with ContinueKeyboardAuth.

set ssh [new_CkSsh]

CkSsh_put_ConnectTimeoutMs $ssh 5000
CkSsh_put_ReadTimeoutMs $ssh 15000

set hostname "ssh.example.com"
set port 22
set success [CkSsh_Connect $ssh $hostname $port]
if {$success == 0} then {
    puts [CkSsh_lastErrorText $ssh]
    delete_CkSsh $ssh
    exit
}

#  Begin keyboard-interactive authentication.  The returned XML describes the server's prompts.
set xmlResponse [CkSsh_startKeyboardAuth $ssh "mySshLogin"]
if {[CkSsh_get_LastMethodSuccess $ssh] == 0} then {
    puts [CkSsh_lastErrorText $ssh]
    delete_CkSsh $ssh
    exit
}

#  If the server sent a user authentication banner, an application may display it before
#  prompting.
puts "UserAuthBanner: [CkSsh_userAuthBanner $ssh]"

set xml [new_CkXml]

set success [CkXml_LoadXml $xml $xmlResponse]
if {$success == 0} then {
    puts [CkXml_lastErrorText $xml]
    delete_CkSsh $ssh
    delete_CkXml $xml
    exit
}

#  Authentication is complete when the XML contains either a "success" or an "error" node.
if {CkXml_HasChildWithTag $xml "success"} then {
    puts "No password required, already authenticated."
    delete_CkSsh $ssh
    delete_CkXml $xml
    exit
}

if {CkXml_HasChildWithTag $xml "error"} then {
    puts "Authentication failed."
    delete_CkSsh $ssh
    delete_CkXml $xml
    exit
}

#  Normally you would not hard-code the password in source.  You should instead obtain it
#  from an interactive prompt, environment variable, or a secrets vault.
set password "mySshPassword"

#  Answer the prompt.  Typically one call is enough, but a server may issue several rounds of
#  prompts, so a robust client loops until it sees "success" or "error".
set xmlResponse [CkSsh_continueKeyboardAuth $ssh $password]
if {[CkSsh_get_LastMethodSuccess $ssh] == 0} then {
    puts [CkSsh_lastErrorText $ssh]
    delete_CkSsh $ssh
    delete_CkXml $xml
    exit
}

set success [CkXml_LoadXml $xml $xmlResponse]
if {$success == 0} then {
    puts [CkXml_lastErrorText $xml]
    delete_CkSsh $ssh
    delete_CkXml $xml
    exit
}

if {CkXml_HasChildWithTag $xml "success"} then {
    puts "SSH keyboard-interactive authentication successful."
    delete_CkSsh $ssh
    delete_CkXml $xml
    exit
}

if {CkXml_HasChildWithTag $xml "error"} then {
    puts "Authentication failed."
}


delete_CkSsh $ssh
delete_CkXml $xml