Lua

SSH Keyboard-Interactive Authentication

Demonstrates keyboard-interactive authentication with an SSH server. StartKeyboardAuth returns XML describing the server's prompts, and ContinueKeyboardAuth submits each response. Authentication is complete when the returned XML contains either a success or an error node.

Background: Keyboard-interactive is SSH's flexible, prompt-driven method: rather than assuming a single password, the server asks one or more questions — a password, a one-time code, a security question — and the client answers each. This is how SSH supports two-factor and other challenge-response schemes. The prompt XML also indicates whether each response should be echoed, so a client knows when to mask input. A server may issue several rounds, so a robust implementation loops until it sees success or error rather than assuming one exchange is enough.

Chilkat Lua Downloads

Download Chilkat for Lua

Lua

local chilkat = require("chilkat")

-- This example requires the Chilkat API to have been previously unlocked.
-- See Global Unlock Sample for sample code.

-- Demonstrates keyboard-interactive authentication with an SSH server.  The server sends one or
-- more prompts as XML, and the application answers each with ContinueKeyboardAuth.

local ssh = chilkat.Ssh.new()

ssh.connect_timeout_ms = 5000
ssh.read_timeout_ms = 15000

local hostname = "ssh.example.com"
local port = 22
local success = ssh:connect(hostname, port)
if not success then
    print(ssh.last_error_text)
    return
end

-- Begin keyboard-interactive authentication.  The returned XML describes the server's prompts.
local xmlResponse = ssh:start_keyboard_auth("mySshLogin")
if not ssh.last_method_success then
    print(ssh.last_error_text)
    return
end

-- If the server sent a user authentication banner, an application may display it before
-- prompting.
print("UserAuthBanner: " .. ssh.user_auth_banner)

local xml = chilkat.Xml.new()
success = xml:load_xml(xmlResponse)
if not success then
    print(xml.last_error_text)
    return
end

-- Authentication is complete when the XML contains either a "success" or an "error" node.
if xml:has_child_with_tag("success") then
    print("No password required, already authenticated.")
    return
end

if xml:has_child_with_tag("error") then
    print("Authentication failed.")
    return
end

-- Normally you would not hard-code the password in source.  You should instead obtain it
-- from an interactive prompt, environment variable, or a secrets vault.
local password = "mySshPassword"

-- Answer the prompt.  Typically one call is enough, but a server may issue several rounds of
-- prompts, so a robust client loops until it sees "success" or "error".
xmlResponse = ssh:continue_keyboard_auth(password)
if not ssh.last_method_success then
    print(ssh.last_error_text)
    return
end

success = xml:load_xml(xmlResponse)
if not success then
    print(xml.last_error_text)
    return
end

if xml:has_child_with_tag("success") then
    print("SSH keyboard-interactive authentication successful.")
    return
end

if xml:has_child_with_tag("error") then
    print("Authentication failed.")
end