How does SSH prompt for user name and password on Linux

Question

I am creating an application that runs on multiple remote Linux devices and has a central administrator to manage the devices. I am adding a feature so the user can open a terminal window in the central administrator to a remote device. It works a lot like using an SSH client to remote into a server except I am using the existing communication channel between the central administrator and the device so I do not need to use the SSH protocol at all.

I have it mostly working. I create a pseudo terminal (pty) on the device and communicate the output/input between the pty and the terminal client running on the central administrator.

The one part that I can't figure out is how SSH prompts for a username and then password using a client like putty. Is this something that the shell in the pseudo terminal prompts for or is the client doing the prompting and passing that to the SSH server?

If the shell is prompting for user and/or password, what shell command does this? I have tried many things with su and sudo but have not figured it out.

If the client is prompting before the shell is created, how does the SSH server authenticate the user and password? What library calls are used to do this?

If anyone has suggestions about where to look for this information, please share them.

Answer 1

PuTTY implements SSH, and part of that is implementing the authentication exchange. For servers that allow password authentication, SSH will usually prompt for a password if an initial attempt using a key failed.

This is likely a feature of PuTTY's SSH implementation. In other words, to get that prompt to appear, you must expose a valid SSH service.

If you're running a plain-text TCP service you may want to do this to at least encrypt it.

Answer 2

In looking through the source code for OpenSSH ( https://github.com/openssh/openssh-portable ) there is code in there to prompt for user and password and then authenticate the credentials. The prompting is done through the terminal interface.

So I believe the answer to my question is that my server running on the remote Linux devices need to send terminal commands to the xterm client to prompt for credentials. Then authenticate those credentials and start the pseudo terminal in the user context.

This functionality is not built into the shell and it is not built into the terminal client.