|
| static int | nasl_ssh_close_hook (int sock) |
| | Hook to close a socket associated with an ssh connection.
|
| static void | g_string_comma_str (GString *gstr, const char *str) |
| static int | next_session_id (void) |
| static unsigned short | get_ssh_port (lex_ctxt *lexic) |
| tree_cell * | nasl_ssh_connect (lex_ctxt *lexic) |
| | Connect to the target host via TCP and setup an ssh connection.
|
| static int | verify_session_id (int session_id, const char *funcname, int *r_slot, lex_ctxt *lexic) |
| static void | do_nasl_ssh_disconnect (int tbl_slot) |
| tree_cell * | nasl_ssh_disconnect (lex_ctxt *lexic) |
| | Disconnect an ssh connection.
|
| tree_cell * | nasl_ssh_session_id_from_sock (lex_ctxt *lexic) |
| | Given a socket, return the corresponding session id.
|
| tree_cell * | nasl_ssh_get_sock (lex_ctxt *lexic) |
| | Given a session id, return the corresponding socket.
|
| static int | get_authmethods (int tbl_slot) |
| tree_cell * | nasl_ssh_set_login (lex_ctxt *lexic) |
| | Set the login name for the authentication.
|
| tree_cell * | nasl_ssh_userauth (lex_ctxt *lexic) |
| | Authenticate a user on an ssh connection.
|
| tree_cell * | nasl_ssh_login_interactive (lex_ctxt *lexic) |
| | Authenticate a user on an ssh connection.
|
| tree_cell * | nasl_ssh_login_interactive_pass (lex_ctxt *lexic) |
| | Authenticate a user on an ssh connection.
|
| static void | exec_ssh_cmd_alarm (int signal) |
| static int | exec_ssh_cmd (ssh_session session, char *cmd, int verbose, int compat_mode, int to_stdout, int to_stderr, GString *response, GString *compat_buf) |
| | Execute an ssh command.
|
| tree_cell * | nasl_ssh_request_exec (lex_ctxt *lexic) |
| | Run a command via ssh.
|
| tree_cell * | nasl_ssh_get_issue_banner (lex_ctxt *lexic) |
| | Get the issue banner.
|
| tree_cell * | nasl_ssh_get_server_banner (lex_ctxt *lexic) |
| | Get the server banner.
|
| tree_cell * | nasl_ssh_get_host_key (lex_ctxt *lexic) |
| | Get the host key.
|
| tree_cell * | nasl_ssh_get_auth_methods (lex_ctxt *lexic) |
| | Get the list of authmethods.
|
| static void | request_ssh_shell_alarm (int signal) |
| static int | request_ssh_shell (ssh_channel channel, int pty) |
| | Open a shell on an ssh channel.
|
| tree_cell * | nasl_ssh_shell_open (lex_ctxt *lexic) |
| | Request an ssh shell.
|
| static int | read_ssh_blocking (ssh_channel channel, GString *response, int timeout) |
| | read from an ssh channel until timeouts or there is no bytes left to read.
|
| static int | read_ssh_nonblocking (ssh_channel channel, GString *response) |
| | read from an ssh channel without blocking.
|
| tree_cell * | nasl_ssh_shell_read (lex_ctxt *lexic) |
| | Read the output of an ssh shell.
|
| tree_cell * | nasl_ssh_shell_write (lex_ctxt *lexic) |
| | Write string to ssh shell.
|
| tree_cell * | nasl_ssh_shell_close (lex_ctxt *lexic) |
| | Close an ssh shell.
|
| tree_cell * | nasl_sftp_enabled_check (lex_ctxt *lexic) |
| | Check if the SFTP subsystem is enabled on the remote SSH server.
|
| tree_cell * | nasl_ssh_execute_netconf_subsystem (lex_ctxt *lexic) |
| | Excecute the NETCONF subsystem on the the ssh channel.
|
Implementation of an API for SSH functions.
This file contains the implementation of the Secure Shell related NASL builtin functions. They are only available if build with libssh support.
Connect to the target host via TCP and setup an ssh connection.
- NASL Function: ssh_connect\n
If the named argument "socket" is given, that socket will be used instead of a creating a new TCP connection. If socket is not given or 0, the port is looked up in the preferences and the KB unless overridden by the named parameter "port".
On success an ssh session to the host has been established; the caller may then run an authentication function. If the connection is no longer needed, ssh_disconnect may be used to disconnect and close the socket.
- NASL Named Parameters:\n
- socket If given, this socket will be used instead of creating a new connection.
- port A non-standard port to connect to. This is only used if socket is not given or 0.
- keytype List of the preferred server host key types. Example: "ssh-rsa,ssh-dss"
- csciphers SSH client-to-server ciphers.
- scciphers SSH server-to-client ciphers.
- timeout Set a timeout for the connection in seconds. Defaults to 10 seconds (defined by libssh internally) if not given.
- NASL Returns:\n An integer to identify the ssh session. Zero on error.
- Parameters
-
| [in] | lexic | Lexical context of NASL interpreter. |
- Returns
- On success the function returns a tree-cell with a non-zero integer identifying that ssh session; zero is returned on a connection error. In case of an internal error NULL is returned.
Run a command via ssh.
- NASL Function: ssh_request_exec\n
The function opens a channel to the remote end and ask it to execute a command. The output of the command is then returned as a data block. The first unnamed argument is the session id. The command itself is expected as string in the named argument "cmd".
Regarding the handling of the stderr and stdout stream, this function may be used in different modes.
If either the named arguments stdout or stderr are given and that one is set to 1, only the output of the specified stream is returned.
If stdout and stderr are both given and set to 1, the output of both is returned interleaved. NOTE: The following feature has not yet been implemented: The output is guaranteed not to switch between stderr and stdout within a line.
If stdout and stderr are both given but set to 0, a special backward compatibility mode is used: First all output to stderr is collected up until any output to stdout is received. Then all output to stdout is returned while ignoring all further stderr output; at EOF the initial collected data from stderr is returned.
If the named parameters stdout and stderr are not given, the function acts exactly as if only stdout has been set to 1.
- NASL Unnamed Parameters:\n
- NASL Named Parameters:\n
- cmd A string with the command to execute.
- stdout An integer with value 0 or 1; see above for a full description.
- stderr An integer with value 0 or 1; see above for a full description.
- NASL Returns:\n A data block on success or NULL on error.
- Parameters
-
| [in] | lexic | Lexical context of NASL interpreter. |
- Returns
- A data/string is returned on success. NULL indicates an error.
Set the login name for the authentication.
- NASL Function: ssh_set_login\n
This is an optional function and usuallay not required. However, if you want to get the banner before starting the authentication, you need to tell libssh the user because it is often not possible to change the user after the first call to an authentication methods - getting the banner uses an authentication function.
The named argument "login" is used for the login name; it defaults the KB entry "Secret/SSH/login". It should contain the user name to login. Given that many servers don't allow changing the login for an established connection, the "login" parameter is silently ignored on all further calls.
- NASL Unnamed Parameters:\n
- NASL Named Parameters:\n
- login A string with the login name (optional).
- NASL Returns:\n None
- Parameters
-
| [in] | lexic | Lexical context of NASL interpreter. |
- Returns
- none.
Authenticate a user on an ssh connection.
- NASL Function: ssh_userauth\n
The function expects the session id as its first unnamed argument. The first time this function is called for a session id, the named argument "login" is also expected; it defaults the KB entry "Secret/SSH/login". It should contain the user name to login. Given that many servers don't allow changing the login for an established connection, the "login" parameter is silently ignored on all further calls.
To perform a password based authentication, the named argument "password" must contain a password.
To perform a public key based authentication, the named argument "privatekey" must contain a base64 encoded private key in ssh native or in PKCS#8 format.
If both, "password" and "privatekey" are given as named arguments only "password" is used. If neither are given the values are taken from the KB ("Secret/SSH/password" and "Secret/SSH/privatekey") and tried in the order {password, privatekey}. Note well, that if one of the named arguments are given, only those are used and the KB is not consulted.
If the private key is protected, its passphrase is taken from the named argument "passphrase" or, if not given, taken from the KB ("Secret/SSH/passphrase").
Note that the named argument "publickey" and the KB item ("Secret/SSH/publickey") are ignored - they are not longer required because they can be derived from the private key.
- NASL Unnamed Parameters:\n
- NASL Named Parameters:\n
- login A string with the login name.
- password A string with the password.
- privatekey A base64 encoded private key in ssh native or in pkcs#8 format. This parameter is ignored if password is given.
- passphrase A string with the passphrase used to unprotect privatekey.
- NASL Returns:\n An integer as status value; 0 indicates success.
- Parameters
-
| [in] | lexic | Lexical context of NASL interpreter. |
- Returns
- 0 is returned on success. Any other value indicates an error.