openssh unix dev - Dec 2015 - Support for ChallengeResponseAuthentication in Match section

Hi,

I'm using 2-factor authentication (pubkey+googe_authenticator) and
have an issue with rsync. It's configured to use pubkey to
authenticate to server so when google_authentication is bypassed by
not creating .google_authenticator file for particular user (thanks to
nullok option in PAM) it still sends to stderr "Authenticated with
partial success." message although it succeeded.

So idea is simple: disable 2-factor authentication for particular user/network.

Regards,
Alexander

On Fri, Dec 11, 2015 at 3:13 AM, Alexander Afonyashin
<a.afonyashin at madnet-team.ru> wrote:
> Hi,
>
> I'm using 2-factor authentication (pubkey+googe_authenticator) and
> have an issue with rsync. It's configured to use pubkey to
> authenticate to server so when google_authentication is bypassed by
> not creating .google_authenticator file for particular user (thanks to
> nullok option in PAM) it still sends to stderr "Authenticated with
> partial success." message although it succeeded.
>
> So idea is simple: disable 2-factor authentication for particular
user/network.
>
> Regards,
> Alexander
Put that access on a different port, with a different SSH daemon, is
the fastest solution.

Hi Nico,

Thanks for the idea.

Regards,
Alexander

On Sat, Dec 12, 2015 at 7:37 AM, Nico Kadel-Garcia <nkadel at gmail.com>
wrote:
> On Fri, Dec 11, 2015 at 3:13 AM, Alexander Afonyashin
> <a.afonyashin at madnet-team.ru> wrote:
>> Hi,
>>
>> I'm using 2-factor authentication (pubkey+googe_authenticator) and
>> have an issue with rsync. It's configured to use pubkey to
>> authenticate to server so when google_authentication is bypassed by
>> not creating .google_authenticator file for particular user (thanks to
>> nullok option in PAM) it still sends to stderr "Authenticated with
>> partial success." message although it succeeded.
>>
>> So idea is simple: disable 2-factor authentication for particular
user/network.
>>
>> Regards,
>> Alexander
>
> Put that access on a different port, with a different SSH daemon, is
> the fastest solution.

On Fri, Dec 11, 2015 at 11:13:59 +0300, Alexander Afonyashin
wrote:
> Hi,
> 
> I'm using 2-factor authentication (pubkey+googe_authenticator) and
> have an issue with rsync. It's configured to use pubkey to
> authenticate to server so when google_authentication is bypassed by
> not creating .google_authenticator file for particular user (thanks to
> nullok option in PAM) it still sends to stderr "Authenticated with
> partial success." message although it succeeded.
> 
> So idea is simple: disable 2-factor authentication for particular
user/network.
> 
Try KbdInteractiveAuthentication (which is supported in Match blocks)
instead of ChallengeResponseAuthentication.

-- 
Iain Morgan

Hi Iain,

Unfortunately it leads to "no authentication methods enabled" when is
used.

ChallengeResponseAuthentication yes
AuthenticationMethods publickey,keyboard-interactive
Match User backup
  KbdInteractiveAuthentication no

Ssh-ing to this config under user root:

debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey
debug1: Next authentication method: publickey
debug1: Offering RSA public key: key at work
debug1: Server accepts key: pkalg ssh-rsa blen 277
Authenticated with partial success.
debug1: Authentications that can continue: keyboard-interactive
debug1: Next authentication method: keyboard-interactive
Verification code:

Ssh-ing to this config under user backup:

debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
Received disconnect from X.X.X.X: 2: no authentication methods enabled

Regards,
Alexander

On Mon, Dec 14, 2015 at 10:44 PM, Iain Morgan <imorgan at nas.nasa.gov>
wrote:
> On Fri, Dec 11, 2015 at 11:13:59 +0300, Alexander Afonyashin wrote:
>> Hi,
>>
>> I'm using 2-factor authentication (pubkey+googe_authenticator) and
>> have an issue with rsync. It's configured to use pubkey to
>> authenticate to server so when google_authentication is bypassed by
>> not creating .google_authenticator file for particular user (thanks to
>> nullok option in PAM) it still sends to stderr "Authenticated with
>> partial success." message although it succeeded.
>>
>> So idea is simple: disable 2-factor authentication for particular
user/network.
>>
>
> Try KbdInteractiveAuthentication (which is supported in Match blocks)
> instead of ChallengeResponseAuthentication.
>
> --
> Iain Morgan