{"action":"created","issue":{"url":"https://api.github.com/repos/paramiko/paramiko/issues/754","repository_url":"https://api.github.com/repos/paramiko/paramiko","labels_url":"https://api.github.com/repos/paramiko/paramiko/issues/754/labels{/name}","comments_url":"https://api.github.com/repos/paramiko/paramiko/issues/754/comments","events_url":"https://api.github.com/repos/paramiko/paramiko/issues/754/events","html_url":"https://github.com/paramiko/paramiko/pull/754","id":156113211,"number":754,"title":"Implement RFC 4252 public key query (Huawei CloudEngine series support)","user":{"login":"AlexanderChernikov","id":9662514,"avatar_url":"https://avatars.githubusercontent.com/u/9662514?v=3","gravatar_id":"","url":"https://api.github.com/users/AlexanderChernikov","html_url":"https://github.com/AlexanderChernikov","followers_url":"https://api.github.com/users/AlexanderChernikov/followers","following_url":"https://api.github.com/users/AlexanderChernikov/following{/other_user}","gists_url":"https://api.github.com/users/AlexanderChernikov/gists{/gist_id}","starred_url":"https://api.github.com/users/AlexanderChernikov/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/AlexanderChernikov/subscriptions","organizations_url":"https://api.github.com/users/AlexanderChernikov/orgs","repos_url":"https://api.github.com/users/AlexanderChernikov/repos","events_url":"https://api.github.com/users/AlexanderChernikov/events{/privacy}","received_events_url":"https://api.github.com/users/AlexanderChernikov/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2016-05-21T17:37:06Z","updated_at":"2016-05-21T18:58:44Z","closed_at":"2016-05-21T18:56:06Z","pull_request":{"url":"https://api.github.com/repos/paramiko/paramiko/pulls/754","html_url":"https://github.com/paramiko/paramiko/pull/754","diff_url":"https://github.com/paramiko/paramiko/pull/754.diff","patch_url":"https://github.com/paramiko/paramiko/pull/754.patch"},"body":"[RFC 4252](https://tools.ietf.org/html/rfc4252#section-7) section 7 describes 2 ways of performing \"pubkey\" auth.\r\n\r\n1. sending publickey with signed data immediately.\r\n2.  _querying whether authentication using the \"publickey\" method would be acceptable._ for the particular key prior to actually try to send signed data.\r\n\r\nparamiko implements the former, while openssh implements the latter.\r\nHuawei VRP software (powers all [CloudEngine series](http://e.huawei.com/en/products/enterprise-networking/switches/data-center-switches) switches) works fine with openssh but fails with paramiko:\r\n>\r\nDEBUG:paramiko.transport:Trying SSH agent key 56104577c38ecfca2c38a885a68a9648\r\nDEBUG:paramiko.transport:userauth is OK\r\nINFO:paramiko.transport:Disconnect (code 2): The connection is closed by SSH Server\r\n\r\nWhile vendor implementation behavior doesn't seem to be valid (so I'll submit a bug to them), it may be worth adding support for this key query scenario. Again, openssh uses it by default for non-encrypted keys (see [sshconnect2.c:userauth_pubkey()](https://github.com/openssh/openssh-portable/blob/master/sshconnect2.c#L1438)).\r\n\r\nThis patch makes the change optional (and off by default) by providing check_keys parameter to both .connect() methond and SSHClient constructor.\r\n"},"comment":{"url":"https://api.github.com/repos/paramiko/paramiko/issues/comments/220794682","html_url":"https://github.com/paramiko/paramiko/pull/754#issuecomment-220794682","issue_url":"https://api.github.com/repos/paramiko/paramiko/issues/754","id":220794682,"user":{"login":"AlexanderChernikov","id":9662514,"avatar_url":"https://avatars.githubusercontent.com/u/9662514?v=3","gravatar_id":"","url":"https://api.github.com/users/AlexanderChernikov","html_url":"https://github.com/AlexanderChernikov","followers_url":"https://api.github.com/users/AlexanderChernikov/followers","following_url":"https://api.github.com/users/AlexanderChernikov/following{/other_user}","gists_url":"https://api.github.com/users/AlexanderChernikov/gists{/gist_id}","starred_url":"https://api.github.com/users/AlexanderChernikov/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/AlexanderChernikov/subscriptions","organizations_url":"https://api.github.com/users/AlexanderChernikov/orgs","repos_url":"https://api.github.com/users/AlexanderChernikov/repos","events_url":"https://api.github.com/users/AlexanderChernikov/events{/privacy}","received_events_url":"https://api.github.com/users/AlexanderChernikov/received_events","type":"User","site_admin":false},"created_at":"2016-05-21T18:58:44Z","updated_at":"2016-05-21T18:58:44Z","body":"The situation is a bit more interesting: openssh is able to login to the box without performing given pubkey query, so the real problem lies elsewhere. Despite the fact that this patch fixes login issue w/ Huawei SW, this looks like not the best way to fix the problem. Will investigate further and reopen."}}
{"actor":{"display_login":"AlexanderChernikov"}}