2FA support with Google Authenticator (keyboard-interactive doesn't work)

[bylli79]

Hi,
First of all, thank you for this great project!

I'm trying to connect to an SSH server that has two-factor authentication (2FA) enabled, using Google Authenticator. The server is configured to require password + OTP (TOTP), which works correctly with OpenSSH or other standard clients using keyboard-interactive authentication.

I’ve tested dartssh2 with the onUserInfoRequest handler, but it seems that the library does not proceed correctly after the password prompt, and I never get the expected prompt to enter the OTP code.
So far, I couldn't get the connection to work when 2FA is enabled on the server.

Is there a recommended way to handle this kind of flow with dartssh2? Or could it be a limitation in the current implementation of keyboard-interactive?

Any help or suggestions would be greatly appreciated.
Thanks!

[eespitiarea]

@bylli79 since you are not providing a sample of your code I'll make the following assumptions:

...
onPasswordRequest: () => password,
onUserInfoRequest: (request) async {
    // You might have put this part or not
    if (request.prompts.isEmpty) {
        return null;
    }
    // You return the same number of responses as prompts
    return request.prompts.map((prompt) => functionToGetOTP()).toList();
}
...

You run this and can see the password succeeds but then the interactive flow, despite looking good, that is, you know the OTP code is correct and is being used to respond to its corresponding prompt(s) and adheres to the order of said prompt(s) fails as if you didn't respond adequately or at all. Reason could be, as specified in here:

In the case that the server sends a `0' num-prompts field in the
request message, the client MUST send a response message with a `0'
num-responses field to complete the exchange.

That your server is sending a second SSH_MSG_USERAUTH_INFO_REQUEST with no prompt(s) and you are not responding to it, a simple way to test this out is:

...
// This is going to help you see the entire flow
printDebug: (i) => print('DEBUG: $i'),
// Additional details, the more the merrier, right?
printTrace: (i) => print('TRACE: $i'),
onPasswordRequest: () => password,
onUserInfoRequest: (request) async {
    if (request.prompts.isEmpty) {
        // Return an empty list instead of a null, so it translates to a response message with 
        // a `0` num-responses field and you successfully complete the exchange
        return [];
    }
    return request.prompts.map((prompt) => functionToGetOTP()).toList();
}
...

Hope this helps!