static int _sftp_connect(const char *uri) {
char *scheme = NULL;
char *user = NULL;
char *passwd = NULL;
char *host = NULL;
unsigned int port = 0;
char *path = NULL;
unsigned char *hash = NULL;
int hlen;
int rc = -1;
int state = SSH_SERVER_ERROR;
int timeout = 10;
int method;
char *verbosity;
if (_connected) {
return 0;
}
rc = c_parse_uri(uri, &scheme, &user, &passwd, &host, &port, &path);
if (rc < 0) {
goto out;
}
DEBUG_SFTP(("csync_sftp - conntecting to: %s\n", host));
/* create the session */
_ssh_session = ssh_new();
if (_ssh_session == NULL) {
fprintf(stderr, "csync_sftp - error creating new connection: %s\n",
strerror(errno));
rc = -1;
goto out;
}
rc = ssh_options_set(_ssh_session, SSH_OPTIONS_TIMEOUT, &timeout);
if (rc < 0) {
fprintf(stderr, "csync_sftp - error setting options: %s\n",
strerror(errno));
goto out;
}
rc = ssh_options_set(_ssh_session, SSH_OPTIONS_COMPRESSION_C_S, "none");
if (rc < 0) {
fprintf(stderr, "csync_sftp - error setting options: %s\n",
strerror(errno));
goto out;
}
rc = ssh_options_set(_ssh_session, SSH_OPTIONS_COMPRESSION_S_C, "none");
if (rc < 0) {
fprintf(stderr, "csync_sftp - error setting options: %s\n",
strerror(errno));
goto out;
}
ssh_options_set(_ssh_session, SSH_OPTIONS_HOST, host);
if (rc < 0) {
fprintf(stderr, "csync_sftp - error setting options: %s\n",
strerror(errno));
goto out;
}
if (port) {
ssh_options_set(_ssh_session, SSH_OPTIONS_PORT, &port);
if (rc < 0) {
fprintf(stderr, "csync_sftp - error setting options: %s\n",
strerror(errno));
goto out;
}
DEBUG_SFTP(("csync_sftp - port set to: %d\n", port));
}
if (user && *user) {
ssh_options_set(_ssh_session, SSH_OPTIONS_USER, user);
if (rc < 0) {
fprintf(stderr, "csync_sftp - error setting options: %s\n",
strerror(errno));
goto out;
}
DEBUG_SFTP(("csync_sftp - username set to: %s\n", user));
}
verbosity = getenv("CSYNC_SFTP_LOG_VERBOSITY");
if (verbosity) {
rc = ssh_options_set(_ssh_session, SSH_OPTIONS_LOG_VERBOSITY_STR, verbosity);
if (rc < 0) {
goto out;
}
}
/* read ~/.ssh/config */
rc = ssh_options_parse_config(_ssh_session, NULL);
if (rc < 0) {
goto out;
}
_ssh_callbacks = (ssh_callbacks) c_malloc(sizeof(struct ssh_callbacks_struct));
if (_ssh_callbacks == NULL) {
rc = -1;
goto out;
}
ZERO_STRUCTP(_ssh_callbacks);
_ssh_callbacks->userdata = _userdata;
_ssh_callbacks->auth_function = _ssh_auth_callback;
ssh_callbacks_init(_ssh_callbacks);
ssh_set_callbacks(_ssh_session, _ssh_callbacks);
rc = ssh_connect(_ssh_session);
if (rc < 0) {
fprintf(stderr, "csync_sftp - error connecting to the server: %s\n", ssh_get_error(_ssh_session));
ssh_disconnect(_ssh_session);
_ssh_session = NULL;
ssh_finalize();
goto out;
}
hlen = ssh_get_pubkey_hash(_ssh_session, &hash);
if (hlen < 0) {
fprintf(stderr, "csync_sftp - error connecting to the server: %s\n",
ssh_get_error(_ssh_session));
ssh_disconnect(_ssh_session);
_ssh_session = NULL;
ssh_finalize();
goto out;
}
/* check the server public key hash */
state = ssh_is_server_known(_ssh_session);
switch (state) {
case SSH_SERVER_KNOWN_OK:
break;
case SSH_SERVER_KNOWN_CHANGED:
fprintf(stderr, "csync_sftp - The host key for this server was "
"not found, but another type of key exists.\n"
"An attacker might change the default server key to confuse your "
"client into thinking the key does not exist.\n"
"Please contact your system administrator.\n"
"%s\n", ssh_get_error(_ssh_session));
ssh_print_hexa("csync_sftp - public key hash", hash, hlen);
ssh_disconnect(_ssh_session);
_ssh_session = NULL;
ssh_finalize();
rc = -1;
goto out;
break;
case SSH_SERVER_FOUND_OTHER:
fprintf(stderr, "csync_sftp - the host key for this server was not "
"found but an other type of key exists.\n");
fprintf(stderr, "csync_sftp - an attacker might change the default "
"server key to confuse your client into thinking the key does not "
"exist\n");
fprintf(stderr, "The host key for the server %s has changed.\n"
"This could either mean that DNS SPOOFING is happening or the IP "
"address for the host and its host key have changed at the same time.\n"
"The fingerprint for the key sent by the remote host is:\n", host);
ssh_print_hexa("", hash, hlen);
fprintf(stderr, "Please contact your system administrator.\n"
"%s\n", ssh_get_error(_ssh_session));
ssh_disconnect(_ssh_session);
_ssh_session = NULL;
ssh_finalize();
rc = -1;
goto out;
break;
case SSH_SERVER_NOT_KNOWN:
if (_authcb) {
char *hexa;
char *prompt;
char buf[4] = {0};
hexa = ssh_get_hexa(hash, hlen);
if (hexa == NULL) {
ssh_disconnect(_ssh_session);
_ssh_session = NULL;
ssh_finalize();
rc = -1;
goto out;
}
if (asprintf(&prompt,
"The authenticity of host '%s' can't be established.\n"
"RSA key fingerprint is %s.\n"
"Are you sure you want to continue connecting (yes/no)?",
host, hexa) < 0 ) {
free(hexa);
ssh_disconnect(_ssh_session);
_ssh_session = NULL;
ssh_finalize();
rc = -1;
goto out;
}
free(hexa);
if ((*_authcb)(prompt, buf, sizeof(buf), 1, 0, _userdata) < 0) {
free(prompt);
ssh_disconnect(_ssh_session);
_ssh_session = NULL;
ssh_finalize();
rc = -1;
goto out;
}
free(prompt);
if (strncasecmp(buf, "yes", 3) != 0) {
ssh_disconnect(_ssh_session);
_ssh_session = NULL;
ssh_finalize();
rc = -1;
goto out;
}
if (ssh_write_knownhost(_ssh_session) < 0) {
ssh_disconnect(_ssh_session);
_ssh_session = NULL;
ssh_finalize();
rc = -1;
goto out;
}
} else {
fprintf(stderr,"csync_sftp - the server is unknown. Connect manually to "
"the host to retrieve the public key hash, then try again.\n");
}
ssh_disconnect(_ssh_session);
_ssh_session = NULL;
ssh_finalize();
rc = -1;
goto out;
break;
case SSH_SERVER_ERROR:
fprintf(stderr, "%s\n", ssh_get_error(_ssh_session));
ssh_disconnect(_ssh_session);
_ssh_session = NULL;
ssh_finalize();
rc = -1;
goto out;
break;
default:
break;
}
/* Try to authenticate */
rc = ssh_userauth_none(_ssh_session, NULL);
if (rc == SSH_AUTH_ERROR) {
ssh_disconnect(_ssh_session);
_ssh_session = NULL;
ssh_finalize();
rc = -1;
goto out;
}
#if 0
/* authenticate with the server */
if (passwd && *passwd) {
DEBUG_SFTP(("csync_sftp - authenticating with user/password\n"));
/*
* This is tunneled cleartext password authentication and possibly needs
* to be allowed by the ssh server. Set 'PasswordAuthentication yes'
*/
auth = ssh_userauth_password(_ssh_session, user, passwd);
} else {
DEBUG_SFTP(("csync_sftp - authenticating with pubkey\n"));
auth = ssh_userauth_autopubkey(_ssh_session, NULL);
}
if (auth == SSH_AUTH_ERROR) {
fprintf(stderr, "csync_sftp - authenticating with pubkey: %s\n",
ssh_get_error(_ssh_session));
ssh_disconnect(_ssh_session);
_ssh_session = NULL;
ssh_finalize();
rc = -1;
goto out;
}
if (auth != SSH_AUTH_SUCCESS) {
if (_authcb != NULL) {
auth = auth_kbdint(_ssh_session);
if (auth == SSH_AUTH_ERROR) {
fprintf(stderr,"csync_sftp - authentication failed: %s\n",
ssh_get_error(_ssh_session));
ssh_disconnect(_ssh_session);
_ssh_session = NULL;
ssh_finalize();
rc = -1;
goto out;
}
} else {
ssh_disconnect(_ssh_session);
_ssh_session = NULL;
ssh_finalize();
rc = -1;
goto out;
}
}
#endif
method = ssh_auth_list(_ssh_session);
while (rc != SSH_AUTH_SUCCESS) {
/* Try to authenticate with public key first */
if (method & SSH_AUTH_METHOD_PUBLICKEY) {
rc = ssh_userauth_autopubkey(_ssh_session, NULL);
if (rc == SSH_AUTH_ERROR) {
ssh_disconnect(_ssh_session);
_ssh_session = NULL;
ssh_finalize();
rc = -1;
goto out;
} else if (rc == SSH_AUTH_SUCCESS) {
break;
}
}
/* Try to authenticate with keyboard interactive */
if (method & SSH_AUTH_METHOD_INTERACTIVE) {
rc = auth_kbdint(_ssh_session, user, passwd);
if (rc == SSH_AUTH_ERROR) {
ssh_disconnect(_ssh_session);
_ssh_session = NULL;
ssh_finalize();
rc = -1;
goto out;
} else if (rc == SSH_AUTH_SUCCESS) {
break;
}
}
/* Try to authenticate with password */
if ((method & SSH_AUTH_METHOD_PASSWORD) && passwd && *passwd) {
rc = ssh_userauth_password(_ssh_session, user, passwd);
if (rc == SSH_AUTH_ERROR) {
ssh_disconnect(_ssh_session);
_ssh_session = NULL;
ssh_finalize();
rc = -1;
goto out;
} else if (rc == SSH_AUTH_SUCCESS) {
break;
}
}
}
DEBUG_SFTP(("csync_sftp - creating sftp channel...\n"));
/* start the sftp session */
_sftp_session = sftp_new(_ssh_session);
if (_sftp_session == NULL) {
fprintf(stderr, "csync_sftp - sftp error initialising channel: %s\n", ssh_get_error(_ssh_session));
rc = -1;
goto out;
}
rc = sftp_init(_sftp_session);
if (rc < 0) {
fprintf(stderr, "csync_sftp - error initialising sftp: %s\n", ssh_get_error(_ssh_session));
goto out;
}
DEBUG_SFTP(("csync_sftp - connection established...\n"));
_connected = 1;
rc = 0;
out:
SAFE_FREE(scheme);
SAFE_FREE(user);
SAFE_FREE(passwd);
SAFE_FREE(host);
SAFE_FREE(path);
SAFE_FREE(hash);
return rc;
}
int main(int argc, char **argv){
SSH_SESSION *session;
SSH_OPTIONS *options;
int auth=0;
char *password;
char *banner;
int state;
char buf[10];
unsigned char hash[MD5_DIGEST_LEN];
options=ssh_options_new();
if(ssh_options_getopt(options,&argc, argv))
usage();
opts(argc,argv);
signal(SIGTERM,do_exit);
if(user)
ssh_options_set_username(options,user);
ssh_options_set_host(options,host);
session=ssh_new();
ssh_set_options(session,options);
if(ssh_connect(session)){
fprintf(stderr,"Connection failed : %s\n",ssh_get_error(session));
ssh_disconnect(session);
ssh_finalize();
return 1;
}
state=ssh_is_server_known(session);
switch(state){
case SSH_SERVER_KNOWN_OK:
break; /* ok */
case SSH_SERVER_KNOWN_CHANGED:
fprintf(stderr,"Host key for server changed : server's one is now :\n");
ssh_get_pubkey_hash(session,hash);
ssh_print_hexa("Public key hash",hash,MD5_DIGEST_LEN);
fprintf(stderr,"For security reason, connection will be stopped\n");
ssh_disconnect(session);
ssh_finalize();
exit(-1);
case SSH_SERVER_FOUND_OTHER:
fprintf(stderr,"The host key for this server was not found but an other type of key exists.\n");
fprintf(stderr,"An attacker might change the default server key to confuse your client"
"into thinking the key does not exist\n"
"We advise you to rerun the client with -d or -r for more safety.\n");
ssh_disconnect(session);
ssh_finalize();
exit(-1);
case SSH_SERVER_NOT_KNOWN:
fprintf(stderr,"The server is unknown. Do you trust the host key ?\n");
ssh_get_pubkey_hash(session,hash);
ssh_print_hexa("Public key hash",hash,MD5_DIGEST_LEN);
fgets(buf,sizeof(buf),stdin);
if(strncasecmp(buf,"yes",3)!=0){
ssh_disconnect(session);
exit(-1);
}
fprintf(stderr,"This new key will be written on disk for further usage. do you agree ?\n");
fgets(buf,sizeof(buf),stdin);
if(strncasecmp(buf,"yes",3)==0){
if(ssh_write_knownhost(session))
fprintf(stderr,"error %s\n",ssh_get_error(session));
}
break;
case SSH_SERVER_ERROR:
fprintf(stderr,"%s",ssh_get_error(session));
ssh_disconnect(session);
ssh_finalize();
exit(-1);
}
/* no ? you should :) */
auth=ssh_userauth_autopubkey(session);
if(auth==SSH_AUTH_ERROR){
fprintf(stderr,"Authenticating with pubkey: %s\n",ssh_get_error(session));
ssh_finalize();
return -1;
}
banner=ssh_get_issue_banner(session);
if(banner){
printf("%s\n",banner);
free(banner);
}
if(auth!=SSH_AUTH_SUCCESS){
auth=auth_kbdint(session);
if(auth==SSH_AUTH_ERROR){
fprintf(stderr,"authenticating with keyb-interactive: %s\n",
ssh_get_error(session));
ssh_finalize();
return -1;
}
}
if(auth!=SSH_AUTH_SUCCESS){
password=getpass("Password : "******"Authentication failed: %s\n",ssh_get_error(session));
ssh_disconnect(session);
ssh_finalize();
return -1;
}
memset(password,0,strlen(password));
}
ssh_say(1,"Authentication success\n");
printf("%s\n",argv[0]);
if(strstr(argv[0],"sftp")){
sftp=1;
ssh_say(1,"doing sftp instead\n");
}
if(!sftp){
if(!cmds[0])
shell(session);
else
batch_shell(session);
}
else
do_sftp(session);
if(!sftp && !cmds[0])
do_cleanup();
ssh_disconnect(session);
ssh_finalize();
return 0;
}