rfc.nroff

OpenSSL Source code for SFTP, SSH, and many others

additions are not visible at the protocol level.  Supporting this
authentication method is optional but recommended.
.IP "7 SSH_SMSG_AUTH_RSA_CHALLENGE"
.TS
;
l l.
mp-int	encrypted challenge
.TE
Presents an RSA authentication challenge to the client.  The challenge
is a 256-bit random value encrypted as described elsewhere in this
document.  The client must decrypt the challenge using the RSA private
key, compute MD5 of the challenge plus session id, and send back the
resulting 16 bytes using SSH_CMSG_AUTH_RSA_RESPONSE.
.IP "8 SSH_CMSG_AUTH_RSA_RESPONSE"
.TS
;
l l.
16 bytes	MD5 of decrypted challenge
.TE
This message is sent by the client in response to an RSA challenge.
The MD5 checksum is returned instead of the decrypted challenge to
deter known-plaintext attacks against the RSA key.  The server
responds to this message with either SSH_SMSG_SUCCESS or
SSH_SMSG_FAILURE.
.IP "9 SSH_CMSG_AUTH_PASSWORD"
.TS
;
l l.
string	plain text password
.TE
Requests password authentication using the given password.  Note that
even though the password is plain text inside the packet, the whole
packet is normally encrypted by the packet layer.  It would not be
possible for the client to perform password encryption/hashing,
because it cannot know which kind of encryption/hashing, if any, the
server uses.  The server responds to this message with
SSH_SMSG_SUCCESS or SSH_SMSG_FAILURE.
.IP "10 SSH_CMSG_REQUEST_PTY"
.TS
;
l l.
string	TERM environment variable value (e.g. vt100)
32-bit int	terminal height, rows (e.g., 24)
32-bit int	terminal width, columns (e.g., 80)
32-bit int	terminal width, pixels (0 if no graphics) (e.g., 480)
32-bit int	terminal height, pixels (0 if no graphics) (e.g., 640)
n bytes	tty modes encoded in binary
.TE
Requests a pseudo-terminal to be allocated for this command.  This
message can be used regardless of whether the session will later
execute the shell or a command.  If a pty has been requested with this
message, the shell or command will run on a pty.  Otherwise it will
communicate with the server using pipes, sockets or some other similar
mechanism.

The terminal type gives the type of the user's terminal.  In the UNIX
environment it is passed to the shell or command in the TERM
environment variable.

The width and height values give the initial size of the user's
terminal or window.  All values can be zero if not supported by the
operating system.  The server will pass these values to the kernel if
supported.

Terminal modes are encoded into a byte stream in a portable format.
The exact format is described later in this document.

The server responds to the request with either SSH_SMSG_SUCCESS or
SSH_SMSG_FAILURE.  If the server does not have the concept of pseudo
terminals, it should return success if it is possible to execute a
shell or a command so that it looks to the client as if it was running
on a pseudo terminal.
.IP "11 SSH_CMSG_WINDOW_SIZE"
.TS
;
l l.
32-bit int	terminal height, rows
32-bit int	terminal width, columns
32-bit int	terminal width, pixels
32-bit int	terminal height, pixels
.TE
This message can only be sent by the client during the interactive
session.  This indicates that the size of the user's window has
changed, and provides the new size.  The server will update the
kernel's notion of the window size, and a SIGWINCH signal or
equivalent will be sent to the shell or command (if supported by the
operating system).
.IP "12 SSH_CMSG_EXEC_SHELL"

(no arguments)

Starts a shell (command interpreter), and enters interactive session
mode.
.IP "13 SSH_CMSG_EXEC_CMD"
.TS
;
l l.
string	command to execute
.TE
Starts executing the given command, and enters interactive session
mode.  On UNIX, the command is run as "<shell> -c <command>", where
<shell> is the user's login shell.
.IP "14 SSH_SMSG_SUCCESS"

(no arguments)

This message is sent by the server in response to the session key, a
successful authentication request, and a successfully completed
preparatory operation.
.IP "15 SSH_SMSG_FAILURE"

(no arguments)

This message is sent by the server in response to a failed
authentication operation to indicate that the user has not yet been
successfully authenticated, and in response to a failed preparatory
operation.  This is also sent in response to an authentication or
preparatory operation request that is not recognized or supported.
.IP "16 SSH_CMSG_STDIN_DATA"
.TS
;
l l.
string	data
.TE
Delivers data from the client to be supplied as input to the shell or
program running on the server side.  This message can only be used in
the interactive session mode.  No acknowledgement is sent for this
message.
.IP "17 SSH_SMSG_STDOUT_DATA"
.TS
;
l l.
string	data
.TE
Delivers data from the server that was read from the standard output of
the shell or program running on the server side.  This message can
only be used in the interactive session mode.  No acknowledgement is
sent for this message.
.IP "18 SSH_SMSG_STDERR_DATA"
.TS
;
l l.
string	data
.TE
Delivers data from the server that was read from the standard error of
the shell or program running on the server side.  This message can
only be used in the interactive session mode.  No acknowledgement is
sent for this message.
.IP "19 SSH_CMSG_EOF"

(no arguments)

This message is sent by the client to indicate that EOF has been
reached on the input.  Upon receiving this message, and after all
buffered input data has been sent to the shell or program, the server
will close the input file descriptor to the program.  This message can
only be used in the interactive session mode.  No acknowledgement is
sent for this message.
.IP "20 SSH_SMSG_EXITSTATUS"
.TS
;
l l.
32-bit int	exit status of the command
.TE
Returns the exit status of the shell or program after it has exited.
The client should respond with SSH_CMSG_EXIT_CONFIRMATION when it has
received this message.  This will be the last message sent by the
server.  If the program being executed dies with a signal instead of
exiting normally, the server should terminate the session with
SSH_MSG_DISCONNECT (which can be used to pass a human-readable string
indicating that the program died due to a signal) instead of using
this message.
.IP "21 SSH_MSG_CHANNEL_OPEN_CONFIRMATION"
.TS
;
l l.
32-bit int	remote_channel
32-bit int	local_channel
.TE
This is sent in response to any channel open request if the channel
has been successfully opened.  Remote_channel is the channel number
received in the initial open request; local_channel is the channel
number the side sending this message has allocated for the channel.
Data can be transmitted on the channel after this message.
.IP "22 SSH_MSG_CHANNEL_OPEN_FAILURE"
.TS
;
l l.
32-bit int	remote_channel
.TE
This message indicates that an earlier channel open request by the
other side has failed or has been denied.  Remote_channel is the
channel number given in the original request.
.IP "23 SSH_MSG_CHANNEL_DATA"
.TS
;
l l.
32-bit int	remote_channel
string	data
.TE
Data is transmitted in a channel in these messages.  A channel is
bidirectional, and both sides can send these messages.  There is no
acknowledgement for these messages.  It is possible that either side
receives these messages after it has sent SSH_MSG_CHANNEL_CLOSE for
the channel.  These messages cannot be received after the party has
sent or received SSH_MSG_CHANNEL_CLOSE_CONFIRMATION.
.IP "24 SSH_MSG_CHANNEL_CLOSE"
.TS
;
l l.
32-bit int	remote_channel
.TE
When a channel is closed at one end of the connection, that side sends
this message.  Upon receiving this message, the channel should be
closed.  When this message is received, if the channel is already
closed (the receiving side has sent this message for the same channel
earlier), the channel is freed and no further action is taken;
otherwise the channel is freed and SSH_MSG_CHANNEL_CLOSE_CONFIRMATION
is sent in response.  (It is possible that the channel is closed
simultaneously at both ends.)
.IP "25 SSH_MSG_CHANNEL_CLOSE_CONFIRMATION"
.TS
;
l l.
32-bit int	remote_channel
.TE
This message is sent in response to SSH_MSG_CHANNEL_CLOSE unless the
channel was already closed.  When this message is sent or received,
the channel is freed.
.IP "26 (OBSOLETED; was unix-domain X11 forwarding)
.IP "27 SSH_SMSG_X11_OPEN"
.TS
;
l l.
32-bit int	local_channel
string	originator_string (see below)
.TE
This message can be sent by the server during the interactive session
mode to indicate that a client has connected the fake X server.
Local_channel is the channel number that the server has allocated for
the connection.  The client should try to open a connection to the
real X server, and respond with SSH_MSG_CHANNEL_OPEN_CONFIRMATION or
SSH_MSG_CHANNEL_OPEN_FAILURE.

The field originator_string is present if both sides
specified SSH_PROTOFLAG_HOST_IN_FWD_OPEN in the protocol flags.  It
contains a description of the host originating the connection.
.IP "28 SSH_CMSG_PORT_FORWARD_REQUEST"
.TS
;
l l.
32-bit int	server_port
string	host_to_connect
32-bit int	port_to_connect
.TE
Sent by the client in the preparatory phase, this message requests
that server_port on the server machine be forwarded over the secure
channel to the client machine, and from there to the specified host
and port.  The server should start listening on the port, and send
SSH_MSG_PORT_OPEN whenever a connection is made to it.  Supporting
this message is optional, and the server is free to reject any forward
request.  For example, it is highly recommended that unless the user
has been authenticated as root, forwarding any privileged port numbers
(below 1024) is denied.
.IP "29 SSH_MSG_PORT_OPEN"
.TS
;
l l.
32-bit int	local_channel
string	host_name
32-bit int	port
string	originator_string (see below)
.TE
Sent by either party in interactive session mode, this message
indicates that a connection has been opened to a forwarded TCP/IP
port.  Local_channel is the channel number that the sending party has
allocated for the connection.  Host_name is the host the connection
should be be forwarded to, and the port is the port on that host to
connect.  The receiving party should open the connection, and respond
with SSH_MSG_CHANNEL_OPEN_CONFIRMATION or
SSH_MSG_CHANNEL_OPEN_FAILURE.  It is recommended that the receiving
side check the host_name and port for validity to avoid compromising
local security by compromised remote side software.  Particularly, it
is recommended that the client permit connections only to those ports
for which it has requested forwarding with SSH_CMSG_PORT_FORWARD_REQUEST.

The field originator_string is present if both sides
specified SSH_PROTOFLAG_HOST_IN_FWD_OPEN in the protocol flags.  It
contains a description of the host originating the connection.
.IP "30 SSH_CMSG_AGENT_REQUEST_FORWARDING"

(no arguments)

Requests that the connection to the authentication agent be forwarded
over the secure channel.  The method used by clients to contact the
authentication agent within each machine is implementation and machine
dependent.  If the server accepts this request, it should arrange that
any clients run from this session will actually contact the server
program when they try to contact the authentication agent.  The server
should then send a SSH_SMSG_AGENT_OPEN to open a channel to the agent,
and the client should forward the connection to the real
authentication agent.  Supporting this message is optional.
.IP "31 SSH_SMSG_AGENT_OPEN"
.TS
;
l l.
32-bit int	local_channel
.TE
Sent by the server in interactive session mode, this message requests
opening a channel to the authentication agent.  The client should open
a channel, and respond with either SSH_MSG_CHANNEL_OPEN_CONFIRMATION
or SSH_MSG_CHANNEL_OPEN_FAILURE.
.IP "32 SSH_MSG_IGNORE"
.TS
;
l l.
string	data
.TE