phpseclib - Can I connect using username, key and password (not a key passphrase)

Question

Apologies if I have missed this in the documentation but is it possible to connect to an SFTP server with a private key and a password (not a passphrase for my private key).

The examples show username/password, username/key and username/key/key passphrase authentication types.

When connecting via the command line I would get this prompt for my password...

user@x.x.x.x's password:

Hopefully this library can handle this?

Otherwise are there any other PHP based solutions that might support username/key and server password authentication? I'm quite flexible here and can install modules if need be.

EDIT

Thanks for the help so far... I had tried what you mentioned Neubert but this didn't seem to work. And to verify what is necessary to connect to the server I tested this on the command line.
sftp key user@ip - Prompted for password as expected
sftp user@ip - Prompted for password but when entered correctly told I am "authenticated with partial success".

I think the permission on directories and keys should be fine if I can get in using key and then password.

I am starting to think this library doesn't support what I need.

It'd still be interesting to see the first x characters of the private key, right up until the base64-encoded blob. Also, it'd be interesting to see the phpseclib logs. Like is it the SSH server that's saying "authenticated with partial success" or the client? You can get them by doing what's described at http://phpseclib.sourceforge.net/ssh/examples.html#logging . Note the define() and the $ssh->getLog() calls. — neubert, Dec 11 '12 at 17:57

score 3 · Answer 1 · edited Mar 31 '17 at 20:58

3

phpseclib supports multi factor authentication. Here's an example of how to do it:

<?php
include('Net/SSH2.php');
include('Crypt/RSA.php')

$rsa = new Crypt_RSA();
$rsa->loadKey(file_get_contents('/path/to/key.pem'));

$ssh = new Net_SSH2('www.domain.tld');
if (!$ssh->login('username', 'pass1', $rsa)) {
    exit('Login failed');
}
// this does the same thing as the above
//if (!$ssh->login($username, 'pass1') && !$ssh->login('username', $rsa)) {
//    exit('Login failed');
//}

echo $ssh->exec('pwd');
echo $ssh->exec('ls -la');
?>

Something to keep in mind, however: a lot of people confuse password protected private keys as being multi factor (password and public key) when in fact it is not. At least not in-so-far as SSH is concerned.

edited Mar 31 '17 at 20:58

Martin Prikryl

188,800
56
490
992

answered Dec 10 '12 at 21:17

neubert

15,947
24
120
212

I think the problem is that the multi-factor authentication method requires BOTH a password AND a key. Doing the above code will only authenticate you client-side (providing you with two separate "partical success" errors), not on the remote SFTP server. – Mike Dec 11 '12 at 19:48
I'm not even sure what authenticating client side means lol. Looking at the source doing login() twice, once for a password and once for the key, will result in two NET_SSH2_MSG_USERAUTH_REQUESTs being sent to the server. Did you try it out? I'm thinking it'll work. – neubert Dec 11 '12 at 20:07
What I meant by authenticating only on the client side is that if the `login()` method makes a new connection to the server every time it is called, you will have two separate connections both with "partical success". On the client-side we know that the password and the key are good because they both partially authenticated, but not on the server because they were sent in separate connections. I could be completely wrong if it does not create a new connection and you can easily just send the password as you have it, but as I tried to leave up to the OP in my question it requires coding. – Mike Dec 11 '12 at 20:56
And to answer your other question, no I didn't try it out as I don't have a server configured like this to test it on. – Mike Dec 11 '12 at 21:02
1

The connection is created in the constructor - not in the login() method. login() just re-uses the same connection. – neubert Dec 11 '12 at 21:04

score 2 · Answer 2 · edited May 23 '17 at 11:54

Disclaimer by @MartinPrikryl: This solution is obsolete, now that phpseclib supports multi-factor authentication natively - See also the answer by @BoukeVersteegh and @neubert.

I ran across the same problem for one of my projects using phpseclib. I tried several of the suggestions to no avail, and finally did some research into the library code myself. I ended up modifying it, though not alot.

In the SSH2.php private method '_privatekey_login' (called from the login method when there is a key), there is code at the end of the method to handle authentication failure.

extract(unpack('Ctype', $this->_string_shift($response, 1)));

switch ($type) {
   case NET_SSH2_MSG_USERAUTH_FAILURE:
      // either the login is bad or the server employs multi-factor authentication
      return false;
   case NET_SSH2_MSG_USERAUTH_SUCCESS:
      $this->bitmap |= NET_SSH2_MASK_LOGIN;
      return true;
}

After putting in some logs, I found that the response I was getting back from the server was indeed "password,keyboard-interactive".

I modified all of the login methods (both in the SFTP AND SSH2 classes) to take a second password, passing it all the way to the '_privatekey_login' method. I then changed the above section to the following:

extract(unpack('Ctype', $this->_string_shift($response, 1)));

switch ($type) {
   case NET_SSH2_MSG_USERAUTH_FAILURE:
      // Possible multi-factor authentication.
      if ($password && $this->_keyboard_interactive_login($username, $password)) {
         $this->bitmap |= NET_SSH2_MASK_LOGIN;
         return true;
      }
      // the login is bad.
      return false;
   case NET_SSH2_MSG_USERAUTH_SUCCESS:
      $this->bitmap |= NET_SSH2_MASK_LOGIN;
      return true;
}

I copied the keyboard interactive call from another portion of the code, so some of that might not be completely necessary. While it might not apply to all servers, it worked beautifully in my case.

score 1 · Answer 3 · answered Nov 23 '16 at 12:58

1

Short simple answer: first login with user+key, then login with user+pass.

$host = 'ftp.example.com';
$username = 'username';
$password = 'secret';
$key = new RSA();
$key->load(file_get_contents('~/.ssh/private_key.pem'));

$sftp = new SFTP($host);

if ($sftp->login($username, $key) || $sftp->login($username, $secret)) {
    // success
} else {
    // failed
}

Yes, this was mentioned already, but long notes made it obscure and look complicated.

answered Nov 23 '16 at 12:58

Bouke Versteegh

4,097
1
39
35

Reference: https://phpseclib.com/docs/auth#multi-factor – Actually I'd say that the `$sftp->login($username, $key, $secret)` syntax makes it more obvious, what's going on. +1 anyway. *(comment re-posted with an updated link, originally posted in March 2017)* – Martin Prikryl Nov 18 '22 at 08:01

Mike · Answer 4 · 2012-12-11T19:25:34.360

I decided to delete my other answer because it turns out I was wrong; you can do multi-factored logins with SSH, just not in a standard way. None of these authentication methods are native or built-in to openssh and therefore there is no standard way to go about it. Most use Google Authenticator to provide a one-time password, but there are differences. According to what this site recommends, it looks like it is done by invoking a command AFTER the user has been authenticated by the SSH server. Looking at the phpseclib source code in Net/SSH2.php in the login() method it has the following code:

case NET_SSH2_MSG_USERAUTH_FAILURE:
    // can we use keyboard-interactive authentication?  if not then either the login is bad or the server employees
    // multi-factor authentication
    [...]
    return false;

Even the phpseclib devs realized that multi-factor authentication is possible, but due to lack of standards, they didn't bother coding it. Googling your error code

authenticated with partial success

shows that this is how the server you are trying to connect to is set up. If you would like to code multi-factor authentication specific to your server's set-up, I don't see why it's not possible. This is the file that you would need to edit in order to do it.

Try this: !$sftp->login() && !$sftp->login(). If multi-factor authentication is being used and password authentication returns false that's ok just so long as one authentication method returns true. I've updated my orig post. — neubert, Dec 11 '12 at 19:36

score -2 · Answer 5 · answered Dec 10 '12 at 18:17

-2

You can use the SSH2 bindings in PECL. It supports all of the authentication mechanisms you mentioned and works quite well.

answered Dec 10 '12 at 18:17

Louis-Philippe Huberdeau

5,341
1
19
22

phpseclib - Can I connect using username, key and password (not a key passphrase)

5 Answers5

Linked

Related