draft-ietf-secsh-userauth-18.2.ps
来自「OTP是开放电信平台的简称」· PS 代码 · 共 1,882 行 · 第 1/4 页
PS
1,882 行
5 283 M( This method MUST NOT be listed as supported by the server.) s5 261 M(3.1.4 Completion of User Authentication) s5 239 M( Authentication is complete when the server has responded with) s5 228 M( SSH_MSG_USERAUTH_SUCCESS; all authentication related messages) s5 217 M( received after sending this message SHOULD be silently ignored.) s5 195 M( After sending SSH_MSG_USERAUTH_SUCCESS, the server starts the) s5 184 M( requested service.) s5 129 M(Ylonen & Moffat Expires March 2, 2003 [Page 6]) s_RSPStoPSsaved restore%%Page: (6,7) 4userdict/PStoPSsaved save putPStoPSmatrix setmatrix595.000000 0.271378 translate90 rotate0.706651 dup scaleuserdict/PStoPSmatrix matrix currentmatrix putuserdict/PStoPSclip{0 0 moveto 595.000000 0 rlineto 0 842.000000 rlineto -595.000000 0 rlineto closepath}put initclip/showpage{}def/copypage{}def/erasepage{}defPStoPSxform concat%%BeginPageSetup_S75 0 translate/pagenum 7 def/fname () def/fdir () def/ftail () def/user_header_p false def%%EndPageSetup5 723 M(Internet-Draft SSH Authentication Protocol September 2002) s5 690 M(3.1.5 Banner Message) s5 668 M( In some jurisdictions, sending a warning message before) s5 657 M( authentication may be relevant for getting legal protection. Many) s5 646 M( UNIX machines, for example, normally display text from `/etc/issue',) s5 635 M( or use "tcp wrappers" or similar software to display a banner before) s5 624 M( issuing a login prompt.) s5 602 M( The SSH server may send a SSH_MSG_USERAUTH_BANNER message at any time) s5 591 M( before authentication is successful. This message contains text to) s5 580 M( be displayed to the client user before authentication is attempted.) s5 569 M( The format is as follows:) s5 547 M( byte SSH_MSG_USERAUTH_BANNER) s5 536 M( string message \(ISO-10646 UTF-8\)) s5 525 M( string language tag \(as defined in [RFC3066]\)) s5 503 M( The client SHOULD by default display the message on the screen.) s5 492 M( However, since the message is likely to be sent for every login) s5 481 M( attempt, and since some client software will need to open a separate) s5 470 M( window for this warning, the client software may allow the user to) s5 459 M( explicitly disable the display of banners from the server. The) s5 448 M( message may consist of multiple lines.) s5 426 M( If the message string is displayed, control character filtering) s5 415 M( discussed in [SSH-ARCH] SHOULD be used to avoid attacks by sending) s5 404 M( terminal control characters.) s5 382 M(3.2 Authentication Protocol Message Numbers) s5 360 M( All message numbers used by this authentication protocol are in the) s5 349 M( range from 50 to 79, which is part of the range reserved for) s5 338 M( protocols running on top of the SSH transport layer protocol.) s5 316 M( Message numbers of 80 and higher are reserved for protocols running) s5 305 M( after this authentication protocol, so receiving one of them before) s5 294 M( authentication is complete is an error, to which the server MUST) s5 283 M( respond by disconnecting \(preferably with a proper disconnect message) s5 272 M( sent first to ease troubleshooting\).) s5 250 M( After successful authentication, such messages are passed to the) s5 239 M( higher-level service.) s5 217 M( These are the general authentication message codes:) s5 195 M( #define SSH_MSG_USERAUTH_REQUEST 50) s5 184 M( #define SSH_MSG_USERAUTH_FAILURE 51) s5 173 M( #define SSH_MSG_USERAUTH_SUCCESS 52) s5 129 M(Ylonen & Moffat Expires March 2, 2003 [Page 7]) s_RSPStoPSsaved restoreuserdict/PStoPSsaved save putPStoPSmatrix setmatrix595.000000 421.271378 translate90 rotate0.706651 dup scaleuserdict/PStoPSmatrix matrix currentmatrix putuserdict/PStoPSclip{0 0 moveto 595.000000 0 rlineto 0 842.000000 rlineto -595.000000 0 rlineto closepath}put initclipPStoPSxform concat%%BeginPageSetup_S75 0 translate/pagenum 8 def/fname () def/fdir () def/ftail () def/user_header_p false def%%EndPageSetup5 723 M(Internet-Draft SSH Authentication Protocol September 2002) s5 690 M( #define SSH_MSG_USERAUTH_BANNER 53) s5 668 M( In addition to the above, there is a range of message numbers) s5 657 M( \(60..79\) reserved for method-specific messages. These messages are) s5 646 M( only sent by the server \(client sends only SSH_MSG_USERAUTH_REQUEST) s5 635 M( messages\). Different authentication methods reuse the same message) s5 624 M( numbers.) s5 602 M(3.3 Public Key Authentication Method: publickey) s5 580 M( The only REQUIRED authentication method is public key authentication.) s5 569 M( All implementations MUST support this method; however, not all users) s5 558 M( need to have public keys, and most local policies are not likely to) s5 547 M( require public key authentication for all users in the near future.) s5 525 M( With this method, the possession of a private key serves as) s5 514 M( authentication. This method works by sending a signature created) s5 503 M( with a private key of the user. The server MUST check that the key) s5 492 M( is a valid authenticator for the user, and MUST check that the) s5 481 M( signature is valid. If both hold, the authentication request MUST be) s5 470 M( accepted; otherwise it MUST be rejected. \(Note that the server MAY) s5 459 M( require additional authentications after successful authentication.\)) s5 437 M( Private keys are often stored in an encrypted form at the client) s5 426 M( host, and the user must supply a passphrase before the signature can) s5 415 M( be generated. Even if they are not, the signing operation involves) s5 404 M( some expensive computation. To avoid unnecessary processing and user) s5 393 M( interaction, the following message is provided for querying whether) s5 382 M( authentication using the key would be acceptable.) s5 360 M( byte SSH_MSG_USERAUTH_REQUEST) s5 349 M( string user name) s5 338 M( string service) s5 327 M( string "publickey") s5 316 M( boolean FALSE) s5 305 M( string public key algorithm name) s5 294 M( string public key blob) s5 272 M( Public key algorithms are defined in the transport layer) s5 261 M( specification [SSH-TRANS]. The public key blob may contain) s5 250 M( certificates.) s5 228 M( Any public key algorithm may be offered for use in authentication.) s5 217 M( In particular, the list is not constrained by what was negotiated) s5 206 M( during key exchange. If the server does not support some algorithm,) s5 195 M( it MUST simply reject the request.) s5 173 M( The server MUST respond to this message with either) s5 129 M(Ylonen & Moffat Expires March 2, 2003 [Page 8]) s_RSPStoPSsaved restore%%Page: (8,9) 5userdict/PStoPSsaved save putPStoPSmatrix setmatrix595.000000 0.271378 translate90 rotate0.706651 dup scaleuserdict/PStoPSmatrix matrix currentmatrix putuserdict/PStoPSclip{0 0 moveto 595.000000 0 rlineto 0 842.000000 rlineto -595.000000 0 rlineto closepath}put initclip/showpage{}def/copypage{}def/erasepage{}defPStoPSxform concat%%BeginPageSetup_S75 0 translate/pagenum 9 def/fname () def/fdir () def/ftail () def/user_header_p false def%%EndPageSetup5 723 M(Internet-Draft SSH Authentication Protocol September 2002) s5 690 M( SSH_MSG_USERAUTH_FAILURE or with the following:) s5 668 M( byte SSH_MSG_USERAUTH_PK_OK) s5 657 M( string public key algorithm name from the request) s5 646 M( string public key blob from the request) s5 624 M( To perform actual authentication, the client MAY then send a) s5 613 M( signature generated using the private key. The client MAY send the) s5 602 M( signature directly without first verifying whether the key is) s5 591 M( acceptable. The signature is sent using the following packet:) s5 569 M( byte SSH_MSG_USERAUTH_REQUEST) s5 558 M( string user name) s5 547 M( string service) s5 536 M( string "publickey") s5 525 M( boolean TRUE) s5 514 M( string public key algorithm name) s5 503 M( string public key to be used for authentication) s5 492 M( string signature) s5 470 M( Signature is a signature by the corresponding private key over the) s5 459 M( following data, in the following order:) s5 437 M( string session identifier) s5 426 M( byte SSH_MSG_USERAUTH_REQUEST) s5 415 M( string user name) s5 404 M( string service) s5 393 M( string "publickey") s5 382 M( boolean TRUE) s5 371 M( string public key algorithm name) s5 360 M( string public key to be used for authentication) s5 338 M( When the server receives this message, it MUST check whether the) s5 327 M( supplied key is acceptable for authentication, and if so, it MUST) s5 316 M( check whether the signature is correct.) s5 294 M( If both checks succeed, this method is successful. Note that the) s5 283 M( server may require additional authentications. The server MUST) s5 272 M( respond with SSH_MSG_USERAUTH_SUCCESS \(if no more authentications are) s5 261 M( needed\), or SSH_MSG_USERAUTH_FAILURE \(if the request failed, or more) s5 250 M( authentications are needed\).) s5 228 M( The following method-specific message numbers are used by the) s5 217 M( publickey authentication method.) s5 195 M( /* Key-based */) s5 184 M( #define SSH_MSG_USERAUTH_PK_OK 60) s5 129 M(Ylonen & Moffat Expires March 2, 2003 [Page 9]) s_RSPStoPSsaved restoreuserdict/PStoPSsaved save putPStoPSmatrix setmatrix595.000000 421.271378 translate90 rotate0.706651 dup scaleuserdict/PStoPSmatrix matrix currentmatrix putuserdict/PStoPSclip{0 0 moveto 595.000000 0 rlineto 0 842.000000 rlineto -595.000000 0 rlineto closepath}put initclipPStoPSxform concat%%BeginPageSetup_S75 0 translate/pagenum 10 def/fname () def/fdir () def/ftail () def/user_header_p false def%%EndPageSetup5 723 M(Internet-Draft SSH Authentication Protocol September 2002) s5 690 M(3.4 Password Authentication Method: password) s5 668 M( Password authentication uses the following packets. Note that a) s5 657 M( server MAY request the user to change the password. All) s5 646 M( implementations SHOULD support password authentication.) s5 624 M( byte SSH_MSG_USERAUTH_REQUEST) s5 613 M( string user name) s5 602 M( string service) s5 591 M( string "password") s5 580 M( boolean FALSE) s5 569 M( string plaintext password \(ISO-10646 UTF-8\)) s5 547 M( Note that the password is encoded in ISO-10646 UTF-8. It is up to) s5 536 M( the server how it interprets the password and validates it against) s5 525 M( the password database. However, if the client reads the password in) s5 514 M( some other encoding \(e.g., ISO 8859-1 \(ISO Latin1\)\), it MUST convert) s5 503 M( the password to ISO-10646 UTF-8 before transmitting, and the server) s5 492 M( MUST convert the password to the encoding used on that system for) s5 481 M( passwords.) s5 459 M( Note that even though the cleartext password is transmitted in the) s5 448 M( packet, the entire packet is encrypted by the transport layer. Both) s5 437 M( the server and the client should check whether the underlying) s5 426 M( transport layer provides confidentiality \(i.e., if encryption is) s5 415 M( being used\). If no confidentiality is provided \(none cipher\),) s5 404 M( password authentication SHOULD be disabled. If there is no) s5 393 M( confidentiality or no MAC, password change SHOULD be disabled.) s5 371 M( Normally, the server responds to this message with success or) s5 360 M( failure. However, if the password has expired the server SHOULD) s5 349 M( indicate this by responding with SSH_MSG_USERAUTH_PASSWD_CHANGEREQ.) s5 338 M( In anycase the server MUST NOT allow an expired password to be used) s5 327 M( for authentication.) s5 305 M( byte SSH_MSG_USERAUTH_PASSWD_CHANGEREQ) s5 294 M( string prompt \(ISO-10646 UTF-8\)) s5 283 M( string language tag \(as defined in [RFC3066]\)) s5 261 M( In this case, the client MAY continue with a different authentication) s5 250 M( method, or request a new password from the user and retry password) s5 239 M( authentication using the following message. The client MAY also send) s5 228 M( this message instead of the normal password authentication request) s5 217 M( without the server asking for it.) s5 195 M( byte SSH_MSG_USERAUTH_REQUEST) s5 184 M( string user name) s5 173 M( string service) s5 129 M(Ylonen & Moffat Expires March 2, 2003 [Page 10]) s_RSPStoPSsaved restore%%Page: (10,11) 6userdict/PStoPSsaved save putPStoPSmatrix setmatrix595.000000 0.271378 translate90 rotate0.706651 dup scaleuserdict/PStoPSmatrix matrix currentmatrix putuserdict/PStoPSclip{0 0 moveto 595.000000 0 rlineto 0 842.000000 rlineto -595.000000 0 rlineto closepath}put initclip/showpage{}def/copypage{}def/erasepage{}defPStoPSxform concat%%BeginPageSetup_S75 0 translate/pagenum 11 def/fname () def/fdir () def/ftail () def/user_header_p false def%%EndPageSetup5 723 M(Internet-Draft SSH Authentication Protocol September 2002) s5 690 M( string "password") s5 679 M( boolean TRUE) s5 668 M( string plaintext old password \(ISO-10646 UTF-8\)) s5 657 M( string plaintext new password \(ISO-10646 UTF-8\)) s5 635 M( The server must reply to request message with) s5 624 M( SSH_MSG_USERAUTH_SUCCESS, SSH_MSG_USERAUTH_FAILURE, or another) s5 613 M⌨️ 快捷键说明
复制代码Ctrl + C
搜索代码Ctrl + F
全屏模式F11
增大字号Ctrl + =
减小字号Ctrl + -
显示快捷键?