openssh unix dev - Aug 2016 - Should partial success reset ->enabled

Hi folks,

I've been playing with SSH and was a little surprised by the OpenSSH's
client handling of partial
success. In particular, I tried writing a server that does the following:

- If none of the public keys offered by the client succeed, fall back
to keyboard-interactive
- During that session, we figure out if the user should have access to
the machine and if
  so, authorize their key for future accesses.

Now, I was expecting that returning a partial success message from the
second step would
have the client retry publickey authentication (and since the server
authorized the user's key
that should now succeed). However, this doesn't happen, since the
client has disabled all
further publickey authentication.

I was able to fix this with the following patch to input_userauth_failure:

    if (partial != 0) {
        logit("Authenticated with partial success.");
        /* reset state */
        pubkey_cleanup(authctxt);
        pubkey_prepare(authctxt);
+     authmethod_lookup("publickey")->enabled =
&options.pubkey_authentication;
    }

Is there a reason that something equivalent isn't there already, or is
that simply an oversight?

Thanks,
Keno

Any thoughts on this? I don't mind this problem too much, since the
workaround is quite
simple (just ask the user to reconnect), but hey, I'm a perfectionist ;).

On Tue, Aug 9, 2016 at 1:04 PM, Keno Fischer <keno at juliacomputing.com>
wrote:
>
> Hi folks,
>
> I've been playing with SSH and was a little surprised by the
OpenSSH's
> client handling of partial
> success. In particular, I tried writing a server that does the following:
>
> - If none of the public keys offered by the client succeed, fall back
> to keyboard-interactive
> - During that session, we figure out if the user should have access to
> the machine and if
>   so, authorize their key for future accesses.
>
> Now, I was expecting that returning a partial success message from the
> second step would
> have the client retry publickey authentication (and since the server
> authorized the user's key
> that should now succeed). However, this doesn't happen, since the
> client has disabled all
> further publickey authentication.
>
> I was able to fix this with the following patch to input_userauth_failure:
>
>     if (partial != 0) {
>         logit("Authenticated with partial success.");
>         /* reset state */
>         pubkey_cleanup(authctxt);
>         pubkey_prepare(authctxt);
> +     authmethod_lookup("publickey")->enabled =
&options.pubkey_authentication;
>     }
>
> Is there a reason that something equivalent isn't there already, or is
> that simply an oversight?
>
> Thanks,
> Keno