PHP

SSH Keyboard-Interactive Authentication

Demonstrates keyboard-interactive authentication with an SSH server. StartKeyboardAuth returns XML describing the server's prompts, and ContinueKeyboardAuth submits each response. Authentication is complete when the returned XML contains either a success or an error node.

Background: Keyboard-interactive is SSH's flexible, prompt-driven method: rather than assuming a single password, the server asks one or more questions — a password, a one-time code, a security question — and the client answers each. This is how SSH supports two-factor and other challenge-response schemes. The prompt XML also indicates whether each response should be echoed, so a client knows when to mask input. A server may issue several rounds, so a robust implementation loops until it sees success or error rather than assuming one exchange is enough.

Chilkat PHP Downloads

Download Chilkat for PHP

Chilkat2 PHP

<?php

use Chilkat2\Ssh;
use Chilkat2\Xml;

// This example requires the Chilkat API to have been previously unlocked.
// See Global Unlock Sample for sample code.

// Demonstrates keyboard-interactive authentication with an SSH server.  The server sends one or
// more prompts as XML, and the application answers each with ContinueKeyboardAuth.

$ssh = new Ssh();

$ssh->ConnectTimeoutMs = 5000;
$ssh->ReadTimeoutMs = 15000;

$hostname = 'ssh.example.com';
$port = 22;
try {
    $ssh->Connect($hostname, $port);

    // Begin keyboard-interactive authentication.  The returned XML describes the server's prompts.
    $xmlResponse = $ssh->StartKeyboardAuth('mySshLogin');
} catch (\Chilkat2\Exception $e) {
    echo $e->getMessage(), "\n";
    exit;
}

// If the server sent a user authentication banner, an application may display it before
// prompting.
echo 'UserAuthBanner: ', $ssh->UserAuthBanner, "\n";

$xml = new Xml();
try {
    $xml->LoadXml($xmlResponse);
} catch (\Chilkat2\Exception $e) {
    echo $e->getMessage(), "\n";
    exit;
}

// Authentication is complete when the XML contains either a "success" or an "error" node.
if ($xml->HasChildWithTag('success')) {
    echo "No password required, already authenticated.\n";
    exit;
}

if ($xml->HasChildWithTag('error')) {
    echo "Authentication failed.\n";
    exit;
}

// Normally you would not hard-code the password in source.  You should instead obtain it
// from an interactive prompt, environment variable, or a secrets vault.
$password = 'mySshPassword';

// Answer the prompt.  Typically one call is enough, but a server may issue several rounds of
// prompts, so a robust client loops until it sees "success" or "error".
try {
    $xmlResponse = $ssh->ContinueKeyboardAuth($password);

    $xml->LoadXml($xmlResponse);
} catch (\Chilkat2\Exception $e) {
    echo $e->getMessage(), "\n";
    exit;
}

if ($xml->HasChildWithTag('success')) {
    echo "SSH keyboard-interactive authentication successful.\n";
    exit;
}

if ($xml->HasChildWithTag('error')) {
    echo "Authentication failed.\n";
}