From 4dd9a94ec532aa2512dc220ab9d2f4929264c741 Mon Sep 17 00:00:00 2001 From: Thomas Wolf Date: Fri, 1 Apr 2022 16:56:05 +0200 Subject: [sshd] Better user feedback on authentication failure When authentication fails, JGit produces an exception with an error message telling the user that it could not log in (including the host name). The causal chain has an SshException from Apache MINA sshd with message "No more authentication methods available". This is not very helpful. The user was left without any indication why authentication failed. Include in the exception message a log of all attempted authentications. That way, the user can see which keys were tried, in which order and with which signature algorithms. The log also reports authentication attempts for gssapi-with-mic or password authentication. For keyboard-interactive Apache MINA sshd is lacking a callback interface. The way Apache MINA sshd loads keys from files, the file names are lost in higher layers. Add a mechanism to record on the session for each key fingerprint the file it was loaded from, if any. That way the exception message can refer to keys by file name, which is easier to understand by users than the rather cryptic key fingerprints. Bug: 571390 Change-Id: Ic4b6ce6b99f307d5e798fcc91b16b9ffd995d224 Signed-off-by: Thomas Wolf --- .../jgit/internal/transport/sshd/SshdText.properties | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) (limited to 'org.eclipse.jgit.ssh.apache/resources') diff --git a/org.eclipse.jgit.ssh.apache/resources/org/eclipse/jgit/internal/transport/sshd/SshdText.properties b/org.eclipse.jgit.ssh.apache/resources/org/eclipse/jgit/internal/transport/sshd/SshdText.properties index 4f735bab34..c676221800 100644 --- a/org.eclipse.jgit.ssh.apache/resources/org/eclipse/jgit/internal/transport/sshd/SshdText.properties +++ b/org.eclipse.jgit.ssh.apache/resources/org/eclipse/jgit/internal/transport/sshd/SshdText.properties @@ -1,5 +1,22 @@ authenticationCanceled=SSH authentication canceled: no password given authenticationOnClosedSession=Authentication canceled: session is already closing or closed +authGssApiAttempt={0}: trying mechanism OID {1} +authGssApiExhausted={0}: no more mechanisms to try +authGssApiFailure={0}: server refused authentication; mechanism {1} +authGssApiNotTried={0}: not tried +authGssApiPartialSuccess={0}: partial success with mechanism OID {1}, continue with authentication methods {2} +authPasswordAttempt={0}: attempt {1} +authPasswordChangeAttempt={0}: attempt {1} with password change +authPasswordExhausted={0}: no more attempts +authPasswordFailure={0}: server refused (wrong password) +authPasswordNotTried={0}: not tried +authPasswordPartialSuccess={0}: partial success, continue with authentication methods {1} +authPubkeyAttempt={0}: trying {1} key {2} with signature type {3} +authPubkeyAttemptAgent={0}: trying {1} key {2} from SSH agent with signature type {3} +authPubkeyExhausted={0}: no more keys to try +authPubkeyFailure={0}: server refused {1} key {2} +authPubkeyNoKeys={0}: no keys to try +authPubkeyPartialSuccess={0}: partial success for {1} key {2}, continue with authentication methods {3} cannotReadPublicKey=Cannot read public key from file {0} closeListenerFailed=Ssh session close listener failed configInvalidPath=Invalid path in ssh config key {0}: {1} -- cgit v1.2.3