[GUACAMOLE-141] Complete support for keyboard interactive authentication

• Type: Improvement
• Status: Open
• Priority: Minor
• Resolution: Unresolved
• Component/s: SSH
• Labels: features security
• Environment: guacamole: all; SSH server: google-authenticator-libpam 1.03
• External issue URL: https://glyptodon.org/jira/browse/GUAC-836
• Assignee: Unassigned
• Reporter: Roleo Hibachi
• Created: 14/Dec/16 18:10
• Updated: 09/Dec/22 01:17

Description

SSH servers using two-factor or two-step authentication generally require multiple keyboard-interactive prompts. An example is the google-authenticator-libpam PAM module; others exist as well. Although Guacamole supports keyboard-interactive password authentication for SSH, only the first prompt is handled (which is assumed to be the prompt for a password).

Full support for keyboard interactive must be added for two factor SSH authentication to work.

This had been successfully patched previously (GUAC-836 in the old JIRA, circa version 0.9.2), but the patch was not implemented in the master branch, and so was not maintained. Using the patch on 0.9.10-incubating or 0.9.9 results in no change in functionality.

Issue Links

• is duplicated by: GUACAMOLE-1237 SSH login with OTP not working through Guacamole
• is duplicated by: GUACAMOLE-1707 Unable to connect to SSH client using TOTP (Google Authenticator)