sftp server does not accept pubkey auth

[gdt]

The docs suggest that one can put a public key in the ftp accounts file, but the same docs file says this is not yet implemented. Having to configure and enter a password makes it harder to do a full fuse mount automatically.

This is related to #1353.

[davidsarah]

<tarcieri>: is the sftp server gonna support pubkey auth any time soon?

<warner>: tarcieri: patches welcome :)

<warner>: to be honest, I forget how large or small a project that one is

<davidsarah>: I suspect that twisted conch does support client pubkey auth, we're just not exposing that

<warner>: yeah, I vaguely remember it being in there, just a bit hard to reach

<davidsarah>: so, convince us this is a really useful thing to add (shouldn't be hard since we hate passwords)

[warner]

Looks like the easy half is done: frontends/auth.py parses the pubkey lines from the account file and stashes them in the right place.

The hard half will involve code from twisted/conch/checkers.py, probably from SSHPublicKeyDatabase._cbRequestAvatarId, specifically this bit:

pubKey = keys.Key.fromString(credentials.blob)
if pubKey.verify(credentials.signature, credentials.sigData):
    return credentials.username

plus some code to make sure we're using the right key for the requested username.

[davidsarah]

Yes, it does look easy. There's a full example at ​http://www.devshed.com/c/a/Python/SSH-with-Twisted/2/. (I don't know why that example has the server knowing the client's private key. It doesn't need it; that's the whole point of public key auth! I think you can just omit the sshFactory.privateKeys = ... line.)

[pyhedgehog]

sftp-auth-key-1411.patch​ contains diff for src/allmydata/frontends/auth.py and enables to setup several keys each with it's own rootcap.

[zooko]

Needs test before further review.

[descention]

I am trying to test this and it's not working for me. I have my private/accounts file with the following

<username> ssh-rsa <public key> <uri>

and have setup the .ssh/config on my client to be

Host tahoe
  HostName localhost
  User <username>
  Port 8022
  IdentityFile ~/.ssh/tahoe.key
  PasswordAuthentication no

Every time I use "ssh tahoe" I get a login failure. Without the "PasswordAuthentication? no" I'll be asked to enter a password. Is there something else that I need to configure first?

[descention]

Found the issue. Line 61 in auth.py needs to be "credentials.username" not just "username". This is now working on my machine.

allmydata-tahoe: 1.10.0.post91.dev0 [master: 488cfb939f1f06ffbdf0f3cb78f76398aad08fea-dirty]
foolscap: 0.6.4
pycryptopp: 0.6.0.1206569328141510525648634803928199668821045408958
zfec: 1.4.5
Twisted: 12.0.0
Nevow: 0.10.0
zope.interface: unknown
python: 2.7.3
platform: Linux-debian_7.5-x86_64-64bit
pyOpenSSL: 0.13
simplejson: 2.5.2
pycrypto: 2.6
pyasn1: unknown
mock: 0.8.0
setuptools: 0.6c16dev4

[zooko]

exarkun posted a pull request: ​https://github.com/tahoe-lafs/tahoe-lafs/pull/134

[daira]

Will review at Nuts and Bolts today.

[daira]

+1 modulo ​https://github.com/exarkun/tahoe-lafs/commit/38aee94a3eb3c007cc6cb1d7cb5b04b66f5d8f99#commitcomment-9172496

[daira]

Fixed in 5 patches ending with [6c756ba3e9f32804802ce1a0c0835db5483f3ad2/trunk].

[daira]

Documentation added in [0d935e858964b646c4ccbca5b2a1c0be97addf34/trunk].

[daira]

Filed #2359 to add integration tests.