draft-ietf-secsh-userauth-18.2.ps
来自「OTP是开放电信平台的简称」· PS 代码 · 共 1,882 行 · 第 1/4 页
PS
1,882 行
(Copyright Notice) s5 327 M( Copyright \(C\) The Internet Society \(2002\). All Rights Reserved.) s5 305 M(Abstract) s5 283 M( SSH is a protocol for secure remote login and other secure network) s5 272 M( services over an insecure network. This document describes the SSH) s5 261 M( authentication protocol framework and public key, password, and) s5 250 M( host-based client authentication methods. Additional authentication) s5 239 M( methods are described in separate documents. The SSH authentication) s5 228 M( protocol runs on top of the SSH transport layer protocol and provides) s5 217 M( a single authenticated tunnel for the SSH connection protocol.) s5 129 M(Ylonen & Moffat Expires March 2, 2003 [Page 1]) s_RSPStoPSsaved restoreuserdict/PStoPSsaved save putPStoPSmatrix setmatrix595.000000 421.271378 translate90 rotate0.706651 dup scaleuserdict/PStoPSmatrix matrix currentmatrix putuserdict/PStoPSclip{0 0 moveto 595.000000 0 rlineto 0 842.000000 rlineto -595.000000 0 rlineto closepath}put initclipPStoPSxform concat%%BeginPageSetup_S75 0 translate/pagenum 2 def/fname () def/fdir () def/ftail () def/user_header_p false def%%EndPageSetup5 723 M(Internet-Draft SSH Authentication Protocol September 2002) s5 690 M(Table of Contents) s5 668 M( 1. Contributors . . . . . . . . . . . . . . . . . . . . . . . . 3) s5 657 M( 2. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3) s5 646 M( 3. Conventions Used in This Document . . . . . . . . . . . . . 3) s5 635 M( 3.1 The Authentication Protocol Framework . . . . . . . . . . . 3) s5 624 M( 3.1.1 Authentication Requests . . . . . . . . . . . . . . . . . . 4) s5 613 M( 3.1.2 Responses to Authentication Requests . . . . . . . . . . . . 5) s5 602 M( 3.1.3 The "none" Authentication Request . . . . . . . . . . . . . 6) s5 591 M( 3.1.4 Completion of User Authentication . . . . . . . . . . . . . 6) s5 580 M( 3.1.5 Banner Message . . . . . . . . . . . . . . . . . . . . . . . 7) s5 569 M( 3.2 Authentication Protocol Message Numbers . . . . . . . . . . 7) s5 558 M( 3.3 Public Key Authentication Method: publickey . . . . . . . . 8) s5 547 M( 3.4 Password Authentication Method: password . . . . . . . . . . 10) s5 536 M( 3.5 Host-Based Authentication: hostbased . . . . . . . . . . . . 11) s5 525 M( 4. Security Considerations . . . . . . . . . . . . . . . . . . 12) s5 514 M( Normative . . . . . . . . . . . . . . . . . . . . . . . . . 13) s5 503 M( Informative . . . . . . . . . . . . . . . . . . . . . . . . 13) s5 492 M( Authors' Addresses . . . . . . . . . . . . . . . . . . . . . 14) s5 481 M( Intellectual Property and Copyright Statements . . . . . . . 15) s5 129 M(Ylonen & Moffat Expires March 2, 2003 [Page 2]) s_RSPStoPSsaved restore%%Page: (2,3) 2userdict/PStoPSsaved save putPStoPSmatrix setmatrix595.000000 0.271378 translate90 rotate0.706651 dup scaleuserdict/PStoPSmatrix matrix currentmatrix putuserdict/PStoPSclip{0 0 moveto 595.000000 0 rlineto 0 842.000000 rlineto -595.000000 0 rlineto closepath}put initclip/showpage{}def/copypage{}def/erasepage{}defPStoPSxform concat%%BeginPageSetup_S75 0 translate/pagenum 3 def/fname () def/fdir () def/ftail () def/user_header_p false def%%EndPageSetup5 723 M(Internet-Draft SSH Authentication Protocol September 2002) s5 690 M(1. Contributors) s5 668 M( The major original contributors of this document were: Tatu Ylonen,) s5 657 M( Tero Kivinen, Timo J. Rinne, Sami Lehtinen \(all of SSH Communications) s5 646 M( Security Corp\), and Markku-Juhani O. Saarinen \(University of) s5 635 M( Jyvaskyla\)) s5 613 M( The document editor is: Darren.Moffat@Sun.COM. Comments on this) s5 602 M( internet draft should be sent to the IETF SECSH working group,) s5 591 M( details at: http://ietf.org/html.charters/secsh-charter.html) s5 569 M(2. Introduction) s5 547 M( The SSH authentication protocol is a general-purpose user) s5 536 M( authentication protocol. It is intended to be run over the SSH) s5 525 M( transport layer protocol [SSH-TRANS]. This protocol assumes that the) s5 514 M( underlying protocols provide integrity and confidentiality) s5 503 M( protection.) s5 481 M( This document should be read only after reading the SSH architecture) s5 470 M( document [SSH-ARCH]. This document freely uses terminology and) s5 459 M( notation from the architecture document without reference or further) s5 448 M( explanation.) s5 426 M( The service name for this protocol is "ssh-userauth".) s5 404 M( When this protocol starts, it receives the session identifier from) s5 393 M( the lower-level protocol \(this is the exchange hash H from the first) s5 382 M( key exchange\). The session identifier uniquely identifies this) s5 371 M( session and is suitable for signing in order to prove ownership of a) s5 360 M( private key. This protocol also needs to know whether the lower-level) s5 349 M( protocol provides confidentiality protection.) s5 327 M(3. Conventions Used in This Document) s5 305 M( The keywords "MUST", "MUST NOT", "REQUIRED", "SHOULD", "SHOULD NOT",) s5 294 M( and "MAY" that appear in this document are to be interpreted as) s5 283 M( described in [RFC2119]) s5 261 M( The used data types and terminology are specified in the architecture) s5 250 M( document [SSH-ARCH]) s5 228 M( The architecture document also discusses the algorithm naming) s5 217 M( conventions that MUST be used with the SSH protocols.) s5 195 M(3.1 The Authentication Protocol Framework) s5 173 M( The server drives the authentication by telling the client which) s5 129 M(Ylonen & Moffat Expires March 2, 2003 [Page 3]) s_RSPStoPSsaved restoreuserdict/PStoPSsaved save putPStoPSmatrix setmatrix595.000000 421.271378 translate90 rotate0.706651 dup scaleuserdict/PStoPSmatrix matrix currentmatrix putuserdict/PStoPSclip{0 0 moveto 595.000000 0 rlineto 0 842.000000 rlineto -595.000000 0 rlineto closepath}put initclipPStoPSxform concat%%BeginPageSetup_S75 0 translate/pagenum 4 def/fname () def/fdir () def/ftail () def/user_header_p false def%%EndPageSetup5 723 M(Internet-Draft SSH Authentication Protocol September 2002) s5 690 M( authentication methods can be used to continue the exchange at any) s5 679 M( given time. The client has the freedom to try the methods listed by) s5 668 M( the server in any order. This gives the server complete control over) s5 657 M( the authentication process if desired, but also gives enough) s5 646 M( flexibility for the client to use the methods it supports or that are) s5 635 M( most convenient for the user, when multiple methods are offered by) s5 624 M( the server.) s5 602 M( Authentication methods are identified by their name, as defined in) s5 591 M( [SSH-ARCH]. The "none" method is reserved, and MUST NOT be listed as) s5 580 M( supported. However, it MAY be sent by the client. The server MUST) s5 569 M( always reject this request, unless the client is to be allowed in) s5 558 M( without any authentication, in which case the server MUST accept this) s5 547 M( request. The main purpose of sending this request is to get the list) s5 536 M( of supported methods from the server.) s5 514 M( The server SHOULD have a timeout for authentication, and disconnect) s5 503 M( if the authentication has not been accepted within the timeout) s5 492 M( period. The RECOMMENDED timeout period is 10 minutes. Additionally,) s5 481 M( the implementation SHOULD limit the number of failed authentication) s5 470 M( attempts a client may perform in a single session \(the RECOMMENDED) s5 459 M( limit is 20 attempts\). If the threshold is exceeded, the server) s5 448 M( SHOULD disconnect.) s5 426 M(3.1.1 Authentication Requests) s5 404 M( All authentication requests MUST use the following message format.) s5 393 M( Only the first few fields are defined; the remaining fields depend on) s5 382 M( the authentication method.) s5 360 M( byte SSH_MSG_USERAUTH_REQUEST) s5 349 M( string user name \(in ISO-10646 UTF-8 encoding [RFC2279]\)) s5 338 M( string service name \(in US-ASCII\)) s5 327 M( string method name \(US-ASCII\)) s5 316 M( The rest of the packet is method-specific.) s5 294 M( The user name and service are repeated in every new authentication) s5 283 M( attempt, and MAY change. The server implementation MUST carefully) s5 272 M( check them in every message, and MUST flush any accumulated) s5 261 M( authentication states if they change. If it is unable to flush some) s5 250 M( authentication state, it MUST disconnect if the user or service name) s5 239 M( changes.) s5 217 M( The service name specifies the service to start after authentication.) s5 206 M( There may be several different authenticated services provided. If) s5 195 M( the requested service is not available, the server MAY disconnect) s5 184 M( immediately or at any later time. Sending a proper disconnect) s5 173 M( message is RECOMMENDED. In any case, if the service does not exist,) s5 129 M(Ylonen & Moffat Expires March 2, 2003 [Page 4]) s_RSPStoPSsaved restore%%Page: (4,5) 3userdict/PStoPSsaved save putPStoPSmatrix setmatrix595.000000 0.271378 translate90 rotate0.706651 dup scaleuserdict/PStoPSmatrix matrix currentmatrix putuserdict/PStoPSclip{0 0 moveto 595.000000 0 rlineto 0 842.000000 rlineto -595.000000 0 rlineto closepath}put initclip/showpage{}def/copypage{}def/erasepage{}defPStoPSxform concat%%BeginPageSetup_S75 0 translate/pagenum 5 def/fname () def/fdir () def/ftail () def/user_header_p false def%%EndPageSetup5 723 M(Internet-Draft SSH Authentication Protocol September 2002) s5 690 M( authentication MUST NOT be accepted.) s5 668 M( If the requested user does not exist, the server MAY disconnect, or) s5 657 M( MAY send a bogus list of acceptable authentication methods, but never) s5 646 M( accept any. This makes it possible for the server to avoid) s5 635 M( disclosing information on which accounts exist. In any case, if the) s5 624 M( user does not exist, the authentication request MUST NOT be accepted.) s5 602 M( While there is usually little point for clients to send requests that) s5 591 M( the server does not list as acceptable, sending such requests is not) s5 580 M( an error, and the server SHOULD simply reject requests that it does) s5 569 M( not recognize.) s5 547 M( An authentication request MAY result in a further exchange of) s5 536 M( messages. All such messages depend on the authentication method) s5 525 M( used, and the client MAY at any time continue with a new) s5 514 M( SSH_MSG_USERAUTH_REQUEST message, in which case the server MUST) s5 503 M( abandon the previous authentication attempt and continue with the new) s5 492 M( one.) s5 470 M(3.1.2 Responses to Authentication Requests) s5 448 M( If the server rejects the authentication request, it MUST respond) s5 437 M( with the following:) s5 415 M( byte SSH_MSG_USERAUTH_FAILURE) s5 404 M( string authentications that can continue) s5 393 M( boolean partial success) s5 371 M( "Authentications that can continue" is a comma-separated list of) s5 360 M( authentication method names that may productively continue the) s5 349 M( authentication dialog.) s5 327 M( It is RECOMMENDED that servers only include those methods in the list) s5 316 M( that are actually useful. However, it is not illegal to include) s5 305 M( methods that cannot be used to authenticate the user.) s5 283 M( Already successfully completed authentications SHOULD NOT be included) s5 272 M( in the list, unless they really should be performed again for some) s5 261 M( reason.) s5 239 M( "Partial success" MUST be TRUE if the authentication request to which) s5 228 M( this is a response was successful. It MUST be FALSE if the request) s5 217 M( was not successfully processed.) s5 195 M( When the server accepts authentication, it MUST respond with the) s5 184 M( following:) s5 129 M(Ylonen & Moffat Expires March 2, 2003 [Page 5]) s_RSPStoPSsaved restoreuserdict/PStoPSsaved save putPStoPSmatrix setmatrix595.000000 421.271378 translate90 rotate0.706651 dup scaleuserdict/PStoPSmatrix matrix currentmatrix putuserdict/PStoPSclip{0 0 moveto 595.000000 0 rlineto 0 842.000000 rlineto -595.000000 0 rlineto closepath}put initclipPStoPSxform concat%%BeginPageSetup_S75 0 translate/pagenum 6 def/fname () def/fdir () def/ftail () def/user_header_p false def%%EndPageSetup5 723 M(Internet-Draft SSH Authentication Protocol September 2002) s5 690 M( byte SSH_MSG_USERAUTH_SUCCESS) s5 668 M( Note that this is not sent after each step in a multi-method) s5 657 M( authentication sequence, but only when the authentication is) s5 646 M( complete.) s5 624 M( The client MAY send several authentication requests without waiting) s5 613 M( for responses from previous requests. The server MUST process each) s5 602 M( request completely and acknowledge any failed requests with a) s5 591 M( SSH_MSG_USERAUTH_FAILURE message before processing the next request.) s5 569 M( A request that results in further exchange of messages will be) s5 558 M( aborted by a second request. It is not possible to send a second) s5 547 M( request without waiting for a response from the server, if the first) s5 536 M( request will result in further exchange of messages. No) s5 525 M( SSH_MSG_USERAUTH_FAILURE message will be sent for the aborted method.) s5 503 M( SSH_MSG_USERAUTH_SUCCESS MUST be sent only once. When) s5 492 M( SSH_MSG_USERAUTH_SUCCESS has been sent, any further authentication) s5 481 M( requests received after that SHOULD be silently ignored.) s5 459 M( Any non-authentication messages sent by the client after the request) s5 448 M( that resulted in SSH_MSG_USERAUTH_SUCCESS being sent MUST be passed) s5 437 M( to the service being run on top of this protocol. Such messages can) s5 426 M( be identified by their message numbers \(see Section Message Numbers) s5 415 M( \(Section 3.2\)\).) s5 393 M(3.1.3 The "none" Authentication Request) s5 371 M( A client may request a list of authentication methods that may) s5 360 M( continue by using the "none" authentication method.) s5 338 M( If no authentication at all is needed for the user, the server MUST) s5 327 M( return SSH_MSG_USERAUTH_SUCCESS. Otherwise, the server MUST return) s5 316 M( SSH_MSG_USERAUTH_FAILURE and MAY return with it a list of) s5 305 M( authentication methods that can continue.) s⌨️ 快捷键说明
复制代码Ctrl + C
搜索代码Ctrl + F
全屏模式F11
增大字号Ctrl + =
减小字号Ctrl + -
显示快捷键?