Subject: Whither USERAUTH_BANNER?

From: Simon Tatham <[email-masked]>
Date: Thu, 15 Mar 2001 16:04:56 +0000

According to the latest userauth draft, the SSH server can send a
USERAUTH_BANNER at any time. Presumably, since the purpose of a
banner is to be displayed before authentication, it's likely to send
the banner as the very first packet of the userauth protocol, right?

This presents a problem.

I'm currently trying to code banner support into PuTTY. Unlike Unix
ssh clients, PuTTY will prompt the user for a username if there
isn't one already supplied in the configuration. Of course this must
be done _before_ sending the first USERAUTH attempt. But I'd like to
print the banner before printing the username prompt.

If I were to _know_ the server would send a banner, I could start
the userauth protocol by waiting for a banner packet, printing the
banner, and then giving the username prompt. But I don't; it's
entirely allowable for the server not to send any banner. So if I
start by waiting for a packet, I'll block for ever.

So what I have to do instead is send a USERAUTH_REQUEST, and _then_
wait for a packet. If the packet is a banner, I print the banner,
and then wait for _another_ packet which is the response to the
request.

Unfortunately, in order to send a USERAUTH_REQUEST, I have to have
already prompted for a username. So I'm forced to the conclusion
that I MUST show my username prompt _before_ I print the remote
banner.

(I suppose I could send a USERAUTH_REQUEST type `none' attempting to
authenticate as a spurious user, just in order to receive the
banner; but then I'd have to switch usernames in the middle of the
authentication, and the server is allowed to disconnect if I do
that.)

Should there be something I can do about this? What I'd like is
something like an SSH_MSG_PING, which I can send and then wait for a
reply, so that I could then receive the USERAUTH_BANNER while
waiting for the PING_REPLY. If you see what I mean.

Also, while I'm here ... is there a policy on line-ending
conventions within the banner message? Should I be translating \n
into my local line end, or should the server be translating its
local line end into \r\n, or what?

Cheers,
Simon
-- 
Simon Tatham         These are my opinions. There are many
<[email-masked]>   like them but these ones are mine.

---

From: Simon Tatham <[email-masked]>
Date: Fri, 16 Mar 2001 09:04:26 +0000

> waiting for the PING_REPLY. If you see what I mean.

I've now thought of a concrete proposal for this. It involves a new
message, SSH_MSG_USERAUTH_SEND_BANNER.

 - The client MAY send USERAUTH_SEND_BANNER after starting the
   userauth protocol but before sending any USERAUTH_REQUESTs.

 - The server MUST respond to USERAUTH_SEND_BANNER with either
   USERAUTH_FAILURE or USERAUTH_BANNER.

 - Older servers will respond to USERAUTH_SEND_BANNER with
   MSG_UNIMPLEMENTED but otherwise ignore it.

Hence, the possibilities are:

 - New server with no banner. Client sends USERAUTH_SEND_BANNER;
   server sends USERAUTH_FAILURE (`I have no banner').

 - New server with banner. Client sends USERAUTH_SEND_BANNER; server
   sends USERAUTH_BANNER.

 - Old server with no banner. Client sends USERAUTH_SEND_BANNER;
   server sends MSG_UNIMPLEMENTED.

 - Old server with banner. Client sends USERAUTH_SEND_BANNER; server
   had already sent USERAUTH_BANNER. Client receives and prints
   banner. Subsequently, client sends first USERAUTH_REQUEST. When
   it reads replies to this, the first thing it receives is
   MSG_UNIMPLEMENTED with the sequence number of the SEND_BANNER
   packet. It ignores this and reads another packet, which is the
   response to USERAUTH_REQUEST. Authentication proceeds as normal.

So unless there's a server out there which fails to behave correctly
with respect to unimplemented messages, this method should be
completely backwards compatible.

Cheers,
Simon
-- 
Simon Tatham         "loop, infinite _see_ infinite loop"
<[email-masked]>     - Index, Borland Pascal Language Guide

---

From: [email-masked] (Niels M�ller)
Date: 16 Mar 2001 10:19:52 +0100

Simon Tatham <[email-masked]> writes:

> banner;

USERAUTH_REQUEST "none" is used as kind of ping for other purposes,
like getting the list of suggested userauth methods.

> but then I'd have to switch usernames in the middle of the

Hmm, why do you think the server will disconnect?

> local line end into \r\n, or what?

I don't think there's any policy. If there were, the policy should
probably say that lines are terminated with \r\n (not that I
particularly like that outdated convention, but that is what is used
in the only other place in the protocol that talks about lines, and
consistency is important). I think that treating \n as end of line and
ignoring all \r-characters should work.

/Niels