[jbosstools-issues] [JBoss JIRA] (JBIDE-12016) OpenShift Wizard should warn if domain exists but there's no ssh key on local machine (domain was created in web ui)

[ https://issues.jboss.org/browse/JBIDE-12016?page=com.atlassian.jira.plugi... ] Andre Dietisheim edited comment on JBIDE-12016 at 9/11/12 6:22 AM: ------------------------------------------------------------------- To warn of possible issues before the cloning happens, I tried to find a way to verify keys on the local machine before the cloning happens. The code in Apache Mina (http://mina.apache.org/) shows pretty well how the basic scheme works. The client signs a payload using the private key and sends it to the server. The server then verifies the signature with the public key: The client (UserAuthPublicKey#next (http://svn.apache.org/repos/asf/mina/sshd/trunk/sshd-core/src/main/java/o...) instantiates some providers (http://svn.apache.org/repos/asf/mina/sshd/trunk/sshd-core/src/main/java/o...) that internally use java.security.Signature: {code} Signature verif = NamedFactory.Utils.create(session.getFactoryManager().getSignatureFactories(), (key.getPublic() instanceof RSAPublicKey) ? KeyPairProvider.SSH_RSA : KeyPairProvider.SSH_DSS); {code} It then builds up a buffer with a payload that contains the public key: {code} Buffer bs = new Buffer(); bs.putString(session.getKex().getH()); bs.putCommand(SshConstants.Message.SSH_MSG_USERAUTH_REQUEST); bs.putString(username); bs.putString("ssh-connection"); bs.putString("publickey"); bs.putByte((byte) 1); bs.putString((key.getPublic() instanceof RSAPublicKey) ? KeyPairProvider.SSH_RSA : KeyPairProvider.SSH_DSS); bs.putPublicKey(key.getPublic()); {code} and then signs it... {code} bs.putBytes(verif.sign()); {code} Signing is done using the private key: http://svn.apache.org/repos/asf/mina/sshd/trunk/sshd-core/src/main/java/o... {code} signature.initSign(prvkey); {code} ...and sends it to the server {code} buffer.putBytes(bs.array(), bs.rpos(), bs.available()); session.writePacket(buffer); {code} The server (UserAuthPublicKey#next - http://svn.apache.org/repos/asf/mina/sshd/trunk/sshd-core/src/main/java/o...) initializes some signature providers... {code} Signature verif = NamedFactory.Utils.create(session.getFactoryManager().getSignatureFactories(), keyAlg); verif.init(key, null); ... {code} ...builds some payload... {code} Buffer buf = new Buffer(); buf.putString(session.getKex().getH()); buf.putCommand(SshConstants.Message.SSH_MSG_USERAUTH_REQUEST); buf.putString(username); buf.putString("ssh-connection"); buf.putString("publickey"); buf.putByte((byte) 1); buf.putString(keyAlg); buffer.rpos(oldPos); buffer.wpos(oldPos + 4 + len); buf.putBuffer(buffer); {code} ...and verifies the signature {code} if (!verif.verify(sig)) { throw new Exception("Key verification failed"); } {code} Verifying the signaure is done using the public key: http://svn.apache.org/repos/asf/mina/sshd/trunk/sshd-core/src/main/java/o... {code} signature.initVerify(pubkey); {code} was (Author: adietish): To warn of possible issues before the cloning happens, I tried to find a way to verify keys on the local machine before the cloning happens. The code in Apache Mina (http://mina.apache.org/) shows pretty well how the basic scheme works. The client signs a payload using the private key and sends it to the server. The server then verifies the signature with the public key: The client (UserAuthPublicKey#next (http://svn.apache.org/repos/asf/mina/sshd/trunk/sshd-core/src/main/java/o...) instantiates some providers (http://svn.apache.org/repos/asf/mina/sshd/trunk/sshd-core/src/main/java/o...) that internally use java.security.Signature: {code} Signature verif = NamedFactory.Utils.create(session.getFactoryManager().getSignatureFactories(), (key.getPublic() instanceof RSAPublicKey) ? KeyPairProvider.SSH_RSA : KeyPairProvider.SSH_DSS); {code} It then builds up a buffer with a payload that contains the public key: {code} Buffer bs = new Buffer(); bs.putString(session.getKex().getH()); bs.putCommand(SshConstants.Message.SSH_MSG_USERAUTH_REQUEST); bs.putString(username); bs.putString("ssh-connection"); bs.putString("publickey"); bs.putByte((byte) 1); bs.putString((key.getPublic() instanceof RSAPublicKey) ? KeyPairProvider.SSH_RSA : KeyPairProvider.SSH_DSS); bs.putPublicKey(key.getPublic()); {code} and then signs it... {code} bs.putBytes(verif.sign()); {code} ...and sends it to the server {code} buffer.putBytes(bs.array(), bs.rpos(), bs.available()); session.writePacket(buffer); {code} The server (UserAuthPublicKey#next - http://svn.apache.org/repos/asf/mina/sshd/trunk/sshd-core/src/main/java/o...) initializes some signature providers... {code} Signature verif = NamedFactory.Utils.create(session.getFactoryManager().getSignatureFactories(), keyAlg); verif.init(key, null); ... {code} ...builds some payload... {code} Buffer buf = new Buffer(); buf.putString(session.getKex().getH()); buf.putCommand(SshConstants.Message.SSH_MSG_USERAUTH_REQUEST); buf.putString(username); buf.putString("ssh-connection"); buf.putString("publickey"); buf.putByte((byte) 1); buf.putString(keyAlg); buffer.rpos(oldPos); buffer.wpos(oldPos + 4 + len); buf.putBuffer(buffer); {code} ...and verifies the signature {code} if (!verif.verify(sig)) { throw new Exception("Key verification failed"); } {code} -- This message is automatically generated by JIRA. If you think it was sent incorrectly, please contact your JIRA administrators For more information on JIRA, see: http://www.atlassian.com/software/jira