Re: tramp (2.6.0-pre master/b30b33ed9b3cdacecebef73ad1131f03c635de7a); tramp over MFA/totp
Michael Albinus <[email protected]>
| Newsgroups | gmane.emacs.tramp |
|---|---|
| Message-ID | <[email protected]> |
Randy Yates <[email protected]> writes: Hi Randy, > My organization has recently enabled MFA/totp over ssh on all our linux > systems. We are using JumpCloud and it was apparently configured by > JumpCloud automatically when they turned MFA on. > > I am able to ssh from one linux box (ubuntu 18.04) to another using the > command-line ssh (openssh). The transaction looks like this: > > <username>@Lubuntu-22259:/<cwd>$ ssh -YC <username>@<dest-host> > Password: > Verification code: xxxxxxxxxxxx [...] > I found that when I use tramp, it prompts me for the password as usual, > but after entering the correct password, it prompts me again for the > password instead of the verification code. [...] > Finally, note that before these security updates, tramp was working > fine. I am using emacs version > > GNU Emacs 29.0.50 (build 2, x86_64-pc-linux-gnu, GTK+ Version 3.22.30, cairo version 1.15.10) of 2022-06-16. > > Is it possible to update tramp so that it operates correctly with this > configuration? Well, my first reaction was to ask you to add the "verification code" prompt to password-word-equivalents. This is what Tramp uses for password prompts. However, one-time passwords are different. So I've assembled the appended patch, could you pls test? It is on top of the emacs-29 branch in git, I hope it applies to your more-than-a-year-old Emacs 29 version. If not, you could install the recent Tramp 2.6.1.2 from GNU ELPA, and apply the patch on this. Note that there is a problem in installing Tramp from GNU ELPA with Emacs 29.1, see <https://elpa.gnu.org/packages/tramp.html>. > Thanks for your help, and let me know if there is anything else you > need. > > Randy Yates Best regards, Michael.
(unnamed)
(text/x-patch, 2.5 KB)
diff --git a/lisp/tramp-sh.el b/lisp/tramp-sh.el
index 5a1e73aa..59d5c005 100644
--- a/lisp/tramp-sh.el
+++ b/lisp/tramp-sh.el
@@ -535,6 +535,7 @@ shell from reading its init file."
(defconst tramp-actions-before-shell
'((tramp-login-prompt-regexp tramp-action-login)
(tramp-password-prompt-regexp tramp-action-password)
+ (tramp-otp-password-prompt-regexp tramp-action-otp-password)
(tramp-wrong-passwd-regexp tramp-action-permission-denied)
(shell-prompt-pattern tramp-action-succeed)
(tramp-shell-prompt-pattern tramp-action-succeed)
@@ -558,6 +559,7 @@ corresponding PATTERN matches, the ACTION function is called.")
(defconst tramp-actions-copy-out-of-band
'((tramp-password-prompt-regexp tramp-action-password)
+ (tramp-otp-password-prompt-regexp tramp-action-otp-password)
(tramp-wrong-passwd-regexp tramp-action-permission-denied)
(tramp-copy-failed-regexp tramp-action-permission-denied)
(tramp-security-key-confirm-regexp tramp-action-show-and-confirm-message)
diff --git a/lisp/tramp.el b/lisp/tramp.el
index d10f93b3..83610193 100644
--- a/lisp/tramp.el
+++ b/lisp/tramp.el
@@ -679,6 +679,17 @@ The `sudo' program appears to insert a `^@' character into the prompt."
:version "29.1"
:type 'regexp)
+(defcustom tramp-otp-password-prompt-regexp
+ (tramp-compat-rx
+ bol (* nonl)
+ ;; JumpCloud.
+ (group (| "Verification code"))
+ (* nonl) (any ":：៖") (* blank))
+ "Regexp matching one-time password prompts.
+The regexp should match at end of buffer."
+ :version "29.2"
+ :type 'regexp)
+
(defcustom tramp-wrong-passwd-regexp
(rx bol (* nonl)
(| "Permission denied"
@@ -5538,6 +5549,25 @@ of."
(narrow-to-region (point-max) (point-max))))
t)
+(defun tramp-action-otp-password (proc vec)
+ "Query the user for a one-time password."
+ (with-current-buffer (process-buffer proc)
+ (let ((case-fold-search t)
+ prompt)
+ (goto-char (point-min))
+ (tramp-check-for-regexp proc tramp-process-action-regexp)
+ (setq prompt (concat (match-string 1) " "))
+ (tramp-message vec 3 "Sending %s" (match-string 1))
+ ;; We don't call `tramp-send-string' in order to hide the
+ ;; password from the debug buffer and the traces.
+ (process-send-string
+ proc
+ (concat
+ (tramp-read-passwd-without-cache proc prompt) tramp-local-end-of-line))
+ ;; Hide password prompt.
+ (narrow-to-region (point-max) (point-max))))
+ t)
+
(defun tramp-action-succeed (_proc _vec)
"Signal success in finding shell prompt."
(throw 'tramp-action 'ok))