Re: configure password prompt in SSH

From: Darren Tucker (dtucker_at_zip.com.au)
Date: 10/25/05

  • Next message: Manuel López-Ibáñez: "Re: configure password prompt in SSH" 
    Date: Tue, 25 Oct 2005 11:57:45 +1000
To: secureshell@securityfocus.com

    Manuel López-Ibáñez wrote:
    > Hi,
    > I get "Password: " prompts when a ssh into linux machines and "user (at)
    > hostname's password: " when I log into OpenBSD. The OpenBSD machine has
    > OpenSSH_4.1 and GNU/Linux has OpenSSH_3.9, so maybe this was introduced
    > between those versions. I really think it is nice that it tells the
    > hostname.
    >
    > So the question is, is it possible to configure the prompt for password
    > of SSH? If so, how it is done?

    Kind of. The reason you're seeing different prompts is that they're
    using different authentication methods within the ssh protocol. Your
    OpenBSD machine is using "password" authentication, whereas your Linux
    system is using "keyboard-interactive" authentication.

    In "keyboard-interactive", the prompt is supplied by the server (via
    PAM, in your case). In "password" authentication, the prompt is
    generated by the client.

    As long as the server supports it, the easy way to get it to do what you
    want is is to tell your client to try "password" authentication first
    (see PreferredAuthentications in ssh_config(5).

    Future versions of OpenSSH will probably include a host identifier of
    some description with keyboard-interactive prompts.

    > If not, won't it be better that the password prompt of OpenSSH in
    > GNU/Linux is the same that the one in OpenBSD ?
    >
    > I have searched the openssh web, read the man pages of ssh_config and
    > sshd_config. The only reference [1] I found to something similar does
    > not clarify anything at all.

    Maybe there should be an FAQ entry for this. 

    -- 
Darren Tucker (dtucker at zip.com.au)
GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4  37C9 C982 80C7 8FF4 FA69
     Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.
  • Next message: Manuel López-Ibáñez: "Re: configure password prompt in SSH"

    Relevant Pages

    • Re: How to deny access to domain shares from a workgroup computer
      ... If I take the example of Internet Explorer pass-through authentication: ... the authentication process is identical whether I am prompted and enter credentials, or whether my logged in credentials are passed-through ... It is just an authentication based on username and password; and authentication protocol designed to make it hard to intercept or decipher the authentication in transit; and a convenience mechanism for passing through under certain circumstances without an explicit prompt. ... By adding a prefix he is really saying "this version rather than that version of my account". ...
      (microsoft.public.windows.server.security)
    • Re: How to deny access to domain shares from a workgroup computer
      ... It makes sense to me, now that you clearly state it, that there is no need to trust the machine where the authentication is coming from. ... If he truly knew nothing about the domain, it is somewhat unlikely for him to have a local account whose name matches that of a domain account, although this is possible. ... user name and password sufficient credentials, ... It is just an authentication based on username and password; and authentication protocol designed to make it hard to intercept or decipher the authentication in transit; and a convenience mechanism for passing through under certain circumstances without an explicit prompt. ...
      (microsoft.public.windows.server.security)
    • Re: How to deny access to domain shares from a workgroup computer
      ... sufficient credentials, then it's fine. ... There isn't really any level of trust involved. ... If I take the example of Internet Explorer pass-through authentication: ... I think what you are describing is some changes in Prompt behaviour. ...
      (microsoft.public.windows.server.security)
    • RE: Proxy Authentication
      ... Both the old and new server have only one NIC and we only ... >> trouble getting authentication to work like in Proxy 2.0. ... >> allowed to browse through the proxy server. ... I would also like this prompt to be able to handle an expired ...
      (microsoft.public.isa.clients)
    • RE: Name mapping : 1 certificate, multiple user accounts
      ... If you have Basic Authentication disabled in IIS, ... Integrated authentication will prompt if the prerequisites for transparent ...
      (microsoft.public.inetserver.iis.security)