Java

SSH Keyboard-Interactive Authentication

Demonstrates keyboard-interactive authentication with an SSH server. StartKeyboardAuth returns XML describing the server's prompts, and ContinueKeyboardAuth submits each response. Authentication is complete when the returned XML contains either a success or an error node.

Background: Keyboard-interactive is SSH's flexible, prompt-driven method: rather than assuming a single password, the server asks one or more questions — a password, a one-time code, a security question — and the client answers each. This is how SSH supports two-factor and other challenge-response schemes. The prompt XML also indicates whether each response should be echoed, so a client knows when to mask input. A server may issue several rounds, so a robust implementation loops until it sees success or error rather than assuming one exchange is enough.

Chilkat Java Downloads

Download Chilkat for Java

Chilkat2 Java

import com.chilkatsoft.chilkat2.ChilkatException;
import com.chilkatsoft.chilkat2.Ssh;
import com.chilkatsoft.chilkat2.Xml;

public class ChilkatExample {

    public static void main(String[] args) {
        // This example requires the Chilkat API to have been previously unlocked.
        // See Global Unlock Sample for sample code.

        // Demonstrates keyboard-interactive authentication with an SSH server.  The server sends one or
        // more prompts as XML, and the application answers each with ContinueKeyboardAuth.

        Ssh ssh = new Ssh();

        ssh.setConnectTimeoutMs(5000);
        ssh.setReadTimeoutMs(15000);

        String hostname = "ssh.example.com";
        int port = 22;
        String xmlResponse;
        try {
            ssh.connect(hostname, port);

            // Begin keyboard-interactive authentication.  The returned XML describes the server's prompts.
            xmlResponse = ssh.startKeyboardAuth("mySshLogin");
        } catch (ChilkatException e) {
            System.out.println(e.getLastErrorText());
            return;
        }

        // If the server sent a user authentication banner, an application may display it before
        // prompting.
        System.out.println("UserAuthBanner: " + ssh.getUserAuthBanner());

        Xml xml = new Xml();
        try {
            xml.loadXml(xmlResponse);
        } catch (ChilkatException e) {
            System.out.println(e.getLastErrorText());
            return;
        }

        // Authentication is complete when the XML contains either a "success" or an "error" node.
        if (xml.hasChildWithTag("success")) {
            System.out.println("No password required, already authenticated.");
            return;
        }

        if (xml.hasChildWithTag("error")) {
            System.out.println("Authentication failed.");
            return;
        }

        // Normally you would not hard-code the password in source.  You should instead obtain it
        // from an interactive prompt, environment variable, or a secrets vault.
        String password = "mySshPassword";

        // Answer the prompt.  Typically one call is enough, but a server may issue several rounds of
        // prompts, so a robust client loops until it sees "success" or "error".
        try {
            xmlResponse = ssh.continueKeyboardAuth(password);

            xml.loadXml(xmlResponse);
        } catch (ChilkatException e) {
            System.out.println(e.getLastErrorText());
            return;
        }

        if (xml.hasChildWithTag("success")) {
            System.out.println("SSH keyboard-interactive authentication successful.");
            return;
        }

        if (xml.hasChildWithTag("error")) {
            System.out.println("Authentication failed.");
        }
    }
}