Re: sftp using both ssh key and password authentication

Hello Jay,

Am 05.09.2024 um 16:44 schrieb Jay Vaughn <jeffersonvaughn@xxxxxxxxx>:

that's what I thought Patrick... and this customer has MANY vendors they work with in the product and every vendor is either SSH Key validated OR password... but now they have a vendor that requires both.

So yes, both authentication methods have to happen.

I'm not aware that is is even possible. To my current knowledge, ssh authentication does not "stack". Once one method succeeds, the rest is skipped.

Is that possible, from the IBM i client side.

I guess this is not a special IBM i thing but a generic OpenSSH topic. Maybe this helps you searching for clues?

for password auth I utilize the EXPECT script.... But really we don't need
to muddy the picture with that... Just need to know when we spawn the
sftp.. is there a way to tell the process we should authenticate both keys
and password?

Are you 100% sure you're talking about Key- and Password authentication taking place? Or are you perhaps using a password protected private key file?

The key is encrypted with the password hash and to be used it must be first decrypted. All of this is a purely local procedure. You can even use ssh-keygen to remove the passphrase, so you can use the unencrypted key for authentication. Once that keyfile is copied by unauthorized thirds, bad things may happen. But I guess you're aware of that?

Search for "ssh-keygen manpage" on the internet to see how to change the password or remove it with the -p parameter.

:wq! PoC