文档建议反馈控制台
首页
学习
活动
专区
圈层
工具
MCP广场
文章/答案/技术大牛
发布
首页
学习
活动
专区
圈层
工具
MCP广场
返回腾讯云官网
社区首页 >问答首页 >使用SSH.NET连接使用SSH密钥和双因素身份验证

问使用SSH.NET连接使用SSH密钥和双因素身份验证
EN

Stack Overflow用户
提问于 2022-08-26 13:56:31
回答 1查看 555关注 0票数 1

我试图在SSH.NET桌面应用程序上使用C#库(v2020.0.2 -最新版本)连接到远程Linux (Debian)服务器。

SSH服务器配置如下：

  • 在密码中使用SSH密钥(RSA)
  • 使用libpam-google-authenticator使用Google应用程序启用2FA
  • 关于sshd_config文件：
    • AuthenticationMethods publickey,keyboard-interactive
    • PasswordAuthentication no
    • ChallengeResponseAuthentication yes
    • UsePAM yes

这是我用来建立连接的代码：

代码语言：javascript
运行
复制
try
{
    PrivateKeyFile privateKey = new PrivateKeyFile(Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.UserProfile), ".ssh", "id_rsa"), "passphrase");
    SshClient sshClient = new SshClient("192.168.0.1", 22, "user", privateKey);
    sshClient.Connect(); // --> Exception
    SshCommand command = sshClient.CreateCommand("ls -la");
    command.Execute();
    string answer = command.Result;
}
catch (Exception)
{
    throw;
}

但它给了我以下的例外：

Renci.SshNet.Common.SshAuthenticationException：‘找不到合适的身份验证方法来完成身份验证(键盘-交互)。

根据SSH.NET README.md on GitHub的说法，它应该与2FA兼容，但我不确定真正的问题在哪里。

​

​

此外，我应该如何处理验证代码提示？

Note__：如果我使用来自同一台PC的ssh命令从Windows10命令提示符连接，它就能工作。它首先请求SSH密钥密码，然后请求验证代码。

2022-09-02更新

使用 SSH.NET的更新代码

代码语言：javascript
运行
复制
try
{
    PrivateKeyAuthenticationMethod privateKeyAuthentication = new PrivateKeyAuthenticationMethod("user", 
        new PrivateKeyFile(Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.UserProfile), ".ssh", "id_ecdsa"), "passphrase"));
    
    KeyboardInteractiveAuthenticationMethod keyboardAuthentication = new KeyboardInteractiveAuthenticationMethod("user");
    keyboardAuthentication.AuthenticationPrompt += KeyboardAuthentication_AuthenticationPrompt;
    
    ConnectionInfo connectionInfo = new ConnectionInfo("192.168.0.1", 22, "user", privateKeyAuthentication, keyboardAuthentication);
    SshClient sshClient = new SshClient(connectionInfo);
    sshClient.Connect();
    SshCommand command = sshClient.CreateCommand("ls -la");
    command.Execute();
    string answer = command.Result;
}
catch (Exception)
{
    throw;
}

private async void KeyboardAuthentication_AuthenticationPrompt(object sender, Renci.SshNet.Common.AuthenticationPromptEventArgs e)
{
    foreach (AuthenticationPrompt prompt in e.Prompts)
    {
        if (prompt.Request.StartsWith("Password"))
            prompt.Response = "password"; // Hard coded here just for the sample
        else if (prompt.Request.StartsWith("Verification"))
            prompt.Response = "..."; // Insert Verification code at runtime using here a Debugger breakpoint
    }
}

客户端连接ssh详细日志

代码语言：javascript
运行
复制
C:\Users\my.user>ssh -vvv admin@192.168.133.128 -i C:\Users\my.user\.ssh\id_ecdsa.pem
OpenSSH_for_Windows_8.1p1, LibreSSL 3.0.2
debug3: Failed to open file:C:/Users/my.user/.ssh/config error:2
debug3: Failed to open file:C:/ProgramData/ssh/ssh_config error:2
debug2: resolve_canonicalize: hostname 192.168.133.128 is address
debug2: ssh_connect_direct
debug1: Connecting to 192.168.133.128 [192.168.133.128] port 22.
debug1: Connection established.
debug3: Failed to open file:C:/Users/my.user/.ssh/id_ecdsa.pem.pub error:2
debug1: identity file C:\\Users\\my.user\\.ssh\\id_ecdsa.pem type -1
debug3: Failed to open file:C:/Users/my.user/.ssh/id_ecdsa.pem-cert error:2
debug3: Failed to open file:C:/Users/my.user/.ssh/id_ecdsa.pem-cert.pub error:2
debug1: identity file C:\\Users\\my.user\\.ssh\\id_ecdsa.pem-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_for_Windows_8.1
debug1: Remote protocol version 2.0, remote software version OpenSSH_8.4p1 Debian-5+deb11u1
debug1: match: OpenSSH_8.4p1 Debian-5+deb11u1 pat OpenSSH* compat 0x04000000
debug2: fd 3 setting O_NONBLOCK
debug1: Authenticating to 192.168.133.128:22 as 'admin'
debug3: hostkeys_foreach: reading file "C:\\Users\\my.user/.ssh/known_hosts"
debug3: record_hostkey: found key type ECDSA in file C:\\Users\\my.user/.ssh/known_hosts:1
debug3: load_hostkeys: loaded 1 keys from 192.168.133.128
debug3: Failed to open file:C:/Users/my.user/.ssh/known_hosts2 error:2
debug3: Failed to open file:C:/ProgramData/ssh/ssh_known_hosts error:2
debug3: Failed to open file:C:/ProgramData/ssh/ssh_known_hosts2 error:2
debug3: order_hostkeyalgs: prefer hostkeyalgs: ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521
debug3: send packet: type 20
debug1: SSH2_MSG_KEXINIT sent
debug3: receive packet: type 20
debug1: SSH2_MSG_KEXINIT received
debug2: local client KEXINIT proposal
debug2: KEX algorithms: curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,ext-info-c
debug2: host key algorithms: ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa
debug2: ciphers ctos: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com
debug2: ciphers stoc: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com
debug2: MACs ctos: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: MACs stoc: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: compression ctos: none,zlib@openssh.com,zlib
debug2: compression stoc: none,zlib@openssh.com,zlib
debug2: languages ctos:
debug2: languages stoc:
debug2: first_kex_follows 0
debug2: reserved 0
debug2: peer server KEXINIT proposal
debug2: KEX algorithms: curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256
debug2: host key algorithms: rsa-sha2-512,rsa-sha2-256,ssh-rsa,ecdsa-sha2-nistp256,ssh-ed25519
debug2: ciphers ctos: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com
debug2: ciphers stoc: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com
debug2: MACs ctos: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: MACs stoc: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: compression ctos: none,zlib@openssh.com
debug2: compression stoc: none,zlib@openssh.com
debug2: languages ctos:
debug2: languages stoc:
debug2: first_kex_follows 0
debug2: reserved 0
debug1: kex: algorithm: curve25519-sha256
debug1: kex: host key algorithm: ecdsa-sha2-nistp256
debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug3: send packet: type 30
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug3: receive packet: type 31
debug1: Server host key: ecdsa-sha2-nistp256 SHA256:--<OMITTED>--
debug3: hostkeys_foreach: reading file "C:\\Users\\my.user/.ssh/known_hosts"
debug3: record_hostkey: found key type ECDSA in file C:\\Users\\my.user/.ssh/known_hosts:1
debug3: load_hostkeys: loaded 1 keys from 192.168.133.128
debug3: Failed to open file:C:/Users/my.user/.ssh/known_hosts2 error:2
debug3: Failed to open file:C:/ProgramData/ssh/ssh_known_hosts error:2
debug3: Failed to open file:C:/ProgramData/ssh/ssh_known_hosts2 error:2
debug1: Host '192.168.133.128' is known and matches the ECDSA host key.
debug1: Found key in C:\\Users\\my.user/.ssh/known_hosts:1
debug3: send packet: type 21
debug2: set_newkeys: mode 1
debug1: rekey out after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug3: receive packet: type 21
debug1: SSH2_MSG_NEWKEYS received
debug2: set_newkeys: mode 0
debug1: rekey in after 134217728 blocks
debug3: unable to connect to pipe \\\\.\\pipe\\openssh-ssh-agent, error: 2
debug1: pubkey_prepare: ssh_get_authentication_socket: No such file or directory
debug1: Will attempt key: C:\\Users\\my.user\\.ssh\\id_ecdsa.pem  explicit
debug2: pubkey_prepare: done
debug3: send packet: type 5
debug3: receive packet: type 7
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=<ssh-ed25519,sk-ssh-ed25519@openssh.com,ssh-rsa,rsa-sha2-256,rsa-sha2-512,ssh-dss,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,sk-ecdsa-sha2-nistp256@openssh.com,webauthn-sk-ecdsa-sha2-nistp256@openssh.com>
debug3: receive packet: type 6
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug3: send packet: type 50
debug3: receive packet: type 51
debug1: Authentications that can continue: publickey
debug3: start over, passed a different list publickey
debug3: preferred publickey,keyboard-interactive,password
debug3: authmethod_lookup publickey
debug3: remaining preferred: keyboard-interactive,password
debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
debug1: Trying private key: C:\\Users\\my.user\\.ssh\\id_ecdsa.pem
debug3: failed to open file:C:/dev/tty error:3
debug1: read_passphrase: can't open /dev/tty: No such file or directory
Enter passphrase for key 'C:\Users\my.user\.ssh\id_ecdsa.pem':
debug3: sign_and_send_pubkey: ECDSA SHA256:--<OMITTED>--
debug3: sign_and_send_pubkey: signing using ecdsa-sha2-nistp521
debug3: send packet: type 50
debug2: we sent a publickey packet, wait for reply
debug3: receive packet: type 51
Authenticated with partial success.
debug1: Authentications that can continue: keyboard-interactive
debug3: start over, passed a different list keyboard-interactive
debug3: preferred publickey,keyboard-interactive,password
debug3: authmethod_lookup keyboard-interactive
debug3: remaining preferred: password
debug3: authmethod_is_enabled keyboard-interactive
debug1: Next authentication method: keyboard-interactive
debug2: userauth_kbdint
debug3: send packet: type 50
debug2: we sent a keyboard-interactive packet, wait for reply
debug3: receive packet: type 60
debug2: input_userauth_info_req
debug2: input_userauth_info_req: num_prompts 1
debug3: failed to open file:C:/dev/tty error:3
debug1: read_passphrase: can't open /dev/tty: No such file or directory
Verification code:
debug3: send packet: type 61
debug3: receive packet: type 60
debug2: input_userauth_info_req
debug2: input_userauth_info_req: num_prompts 0
debug3: send packet: type 61
debug3: receive packet: type 52
debug1: Authentication succeeded (keyboard-interactive).
Authenticated to 192.168.133.128 ([192.168.133.128]:22).
debug1: channel 0: new [client-session]
debug3: ssh_session2_open: channel_new: 0
debug2: channel 0: send open
debug3: send packet: type 90
debug1: Requesting no-more-sessions@openssh.com
debug3: send packet: type 80
debug1: Entering interactive session.
debug1: pledge: network
debug1: ENABLE_VIRTUAL_TERMINAL_INPUT is supported. Reading the VTSequence from console
debug3: This windows OS supports conpty
debug1: ENABLE_VIRTUAL_TERMINAL_PROCESSING is supported. Console supports the ansi parsing
debug3: Successfully set console output code page from:65001 to 65001
debug3: Successfully set console input code page from:850 to 65001
debug3: receive packet: type 80
debug1: client_input_global_request: rtype hostkeys-00@openssh.com want_reply 0
debug3: receive packet: type 4
debug1: Remote: /home/admin/.ssh/authorized_keys:3: key options: agent-forwarding port-forwarding pty user-rc x11-forwarding
debug3: receive packet: type 91
debug2: channel_input_open_confirmation: channel 0: callback start
debug2: fd 3 setting TCP_NODELAY
debug2: client_session2_setup: id 0
debug2: channel 0: request pty-req confirm 1
debug3: send packet: type 98
debug2: channel 0: request shell confirm 1
debug3: send packet: type 98
debug2: channel_input_open_confirmation: channel 0: callback done
debug2: channel 0: open confirm rwindow 0 rmax 32768
debug3: receive packet: type 99
debug2: channel_input_status_confirm: type 99 id 0
debug2: PTY allocation request accepted on channel 0
debug2: channel 0: rcvd adjust 2097152
debug3: receive packet: type 99
debug2: channel_input_status_confirm: type 99 id 0
debug2: shell request accepted on channel 0
The programs included are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Last login: Thu Sep  1 15:37:31 2022 from 192.168.133.1
┌─[admin@server]─[~]
└──╼ $

2022-09-13最新情况

在这里，我以详细的调试模式(-ddd选项)发布来自cmd.exe (OK)的日志文件，以及使用SSH.NET (NOT both )的应用程序发送的日志文件，它们都具有相同的用户凭据。

注意：__：我使用了PasteBin，因为日志太长了，无法在问题中粘贴到这里。

我注意到了一些不同之处：

SSH.NET

代码语言：javascript
运行
复制
debug1: Remote protocol version 2.0, remote software version Renci.SshNet.SshClient.0.0.1
---- What does it means 'no match'? ----
debug1: no match: Renci.SshNet.SshClient.0.0.1

...

debug3: PAM: sshpam_query entering
debug3: ssh_msg_recv entering
---- There is no do_pam_account here ----
debug3: PAM: Authentication failure
PAM: Authentication failure for admin from 192.168.133.1

cmd.exe

代码语言：javascript
运行
复制
debug1: Remote protocol version 2.0, remote software version OpenSSH_for_Windows_8.1
debug1: match: OpenSSH_for_Windows_8.1 pat OpenSSH compat 0x04000000

...

debug3: PAM: sshpam_query entering
debug3: ssh_msg_recv entering
debug1: do_pam_account: called
debug2: do_pam_account: auth information in SSH_AUTH_INFO_0
two-factor-authentication
ssh.net
c#
ssh
ssh-keys
EN

回答 1

Stack Overflow用户

发布于 2022-08-26 14:26:06

在ChallengeResponseAuthentication中，我假设libpam-google-authenticator是通过键盘交互身份验证实现的.要了解这一点，请参见SSH.NET -找不到合适的身份验证方法。

要将其与私钥因素结合起来，请执行以下操作：

代码语言：javascript
运行
复制
var privateKeyAuth = new PrivateKeyAuthenticationMethod(username, privateKey);

var keybAuth = new KeyboardInteractiveAuthenticationMethod(username);
keybAuth.AuthenticationPrompt +=
    delegate (object sender, AuthenticationPromptEventArgs e)
    {
        // Your implementation of the prompt. Something like this:
        if ((e.Prompts.Count() != 1) ||
            (e.Prompts.First().Request != "Verification code:"))
        {
            throw new InvalidOperationException("Unexpected auth prompt");
        }
        e.Prompts.First().Response = "verification code";
    };

var connectionInfo = new ConnectionInfo(host, username, privateKeyAuth, keybAuth);

var sshClient = new SshClient(connectionInfo);
票数 2
EN
页面原文内容由Stack Overflow提供。腾讯云小微IT领域专用引擎提供翻译支持
原文链接：

https://stackoverflow.com/questions/73502156

复制
相关文章

相似问题

领券

腾讯云开发者

扫码关注腾讯云开发者

扫码关注腾讯云开发者

领取腾讯云代金券

热门产品

热门推荐

更多推荐

Copyright © 2013 - 2025 Tencent Cloud. All Rights Reserved. 腾讯云 版权所有 

深圳市腾讯计算机系统有限公司 ICP备案/许可证号：粤B2-20090059 深公网安备号 44030502008569

腾讯云计算（北京）有限责任公司 京ICP证150476号 |  京ICP备11018762号 | 京公网安备号11010802020287

问题归档专栏文章快讯文章归档关键词归档开发者手册归档开发者手册 Section 归档