@ -48,6 +48,13 @@ var (
sshVerboseLogging = envknob . RegisterBool ( "TS_DEBUG_SSH_VLOG" )
)
const (
// forcePasswordSuffix is the suffix at the end of a username that forces
// Tailscale SSH into password authentication mode to work around buggy SSH
// clients that get confused by successful replies to auth type "none".
forcePasswordSuffix = "+password"
)
// ipnLocalBackend is the subset of ipnlocal.LocalBackend that we use.
// It is used for testing.
type ipnLocalBackend interface {
@ -197,7 +204,10 @@ type conn struct {
idH string
connID string // ID that's shared with control
noPubKeyPolicyAuthError error // set by BannerCallback
// anyPasswordIsOkay is whether the client is authorized but has requested
// password-based auth to work around their buggy SSH client. When set, we
// accept any password in the PasswordHandler.
anyPasswordIsOkay bool // set by NoClientAuthCallback
action0 * tailcfg . SSHAction // set by doPolicyAuth; first matching action
currentAction * tailcfg . SSHAction // set by doPolicyAuth, updated by resolveNextAction
@ -273,7 +283,43 @@ func (c *conn) NoClientAuthCallback(ctx ssh.Context) error {
if err := c . doPolicyAuth ( ctx , nil /* no pub key */ ) ; err != nil {
return err
}
return c . isAuthorized ( ctx )
if err := c . isAuthorized ( ctx ) ; err != nil {
return err
}
// Let users specify a username ending in +password to force password auth.
// This exists for buggy SSH clients that get confused by success from
// "none" auth.
if strings . HasSuffix ( ctx . User ( ) , forcePasswordSuffix ) {
c . anyPasswordIsOkay = true
return errors . New ( "any password please" ) // not shown to users
}
return nil
}
func ( c * conn ) nextAuthMethodCallback ( cm gossh . ConnMetadata , prevErrors [ ] error ) ( nextMethod [ ] string ) {
switch {
case c . anyPasswordIsOkay :
nextMethod = append ( nextMethod , "password" )
case len ( prevErrors ) > 0 && prevErrors [ len ( prevErrors ) - 1 ] == errPubKeyRequired :
nextMethod = append ( nextMethod , "publickey" )
}
// The fake "tailscale" method is always appended to next so OpenSSH renders
// that in parens as the final failure. (It also shows up in "ssh -v", etc)
nextMethod = append ( nextMethod , "tailscale" )
return
}
// fakePasswordHandler is our implementation of the PasswordHandler hook that
// checks whether the user's password is correct. But we don't actually use
// passwords. This exists only for when the user's username ends in "+password"
// to signal that their SSH client is buggy and gets confused by auth type
// "none" succeeding and they want our SSH server to require a dummy password
// prompt instead. We then accept any password since we've already authenticated
// & authorized them.
func ( c * conn ) fakePasswordHandler ( ctx ssh . Context , password string ) bool {
return c . anyPasswordIsOkay
}
// PublicKeyHandler implements ssh.PublicKeyHandler is called by the
@ -345,9 +391,8 @@ func (c *conn) doPolicyAuth(ctx ssh.Context, pubKey ssh.PublicKey) error {
// ServerConfig implements ssh.ServerConfigCallback.
func ( c * conn ) ServerConfig ( ctx ssh . Context ) * gossh . ServerConfig {
return & gossh . ServerConfig {
// OpenSSH presents this on failure as `Permission denied (tailscale).`
ImplicitAuthMethod : "tailscale" ,
NoClientAuth : true , // required for the NoClientAuthCallback to run
NoClientAuth : true , // required for the NoClientAuthCallback to run
NextAuthMethodCallback : c . nextAuthMethodCallback ,
}
}
@ -370,6 +415,7 @@ func (srv *server) newConn() (*conn, error) {
NoClientAuthHandler : c . NoClientAuthCallback ,
PublicKeyHandler : c . PublicKeyHandler ,
PasswordHandler : c . fakePasswordHandler ,
Handler : c . handleSessionPostSSHAuth ,
LocalPortForwardingCallback : c . mayForwardLocalPortTo ,
@ -495,7 +541,7 @@ func (c *conn) setInfo(ctx ssh.Context) error {
return nil
}
ci := & sshConnInfo {
sshUser : . User ( ) ,
sshUser : strings. TrimSuffix ( ctx. User ( ) , forcePasswordSuffix ) ,
src : toIPPort ( ctx . RemoteAddr ( ) ) ,
dst : toIPPort ( ctx . LocalAddr ( ) ) ,
}
Brad Fitzpatrick
2 years ago
committed by