java - Apache VFS - setPreferredAuthentications - 可能的值是什么

Question

我正在研究将 VFS 用于 sftp Java 文件。在以下文档中 setPreferredAuthentications它提到 preferredAuthentications - 身份验证顺序 - 可能的值是什么？无法在线找到答案

Answer 1

setPreferredAuthentications 等同于SSH 配置选项PreferredAuthentications，它指定客户端尝试身份验证方法的顺序。

可能的值是 ssh 身份验证方法的列表:

SftpFileSystemConfigBuilder.getInstance()
    .setPreferredAuthentications(opts,"gssapi-with-mic,hostbased,publickey");

//or
SftpFileSystemConfigBuilder.getInstance()
    .setPreferredAuthentications(opts,"password,keyboard-interactive");

OpenSSH 视角:

详见 OpenSSH Manual :

The methods available for authentication are: GSSAPI-based authentication, host-based authentication, public key authentication, challenge-response authentication, and password authentication. Authentication methods are tried in the order specified above, though PreferredAuthentications can be used to change the default order.

这允许客户端更喜欢一种方法(例如键盘交互)而不是另一种方法(例如密码)。

例如:gssapi-with-mic,hostbased,publickey,keyboard-interactive,password

OpenSSH可用的认证方式有:

• gssapi-with-mic
• 基于主机
• 键盘交互
• none(用于在启用 Cm PermitEmptyPassword 时访问无密码帐户)
• 密码
• 公钥

Apache VSF 视角:

Apache VFS 项目使用 Jsch库作为底层 sftp 提供程序，您可以找到 jsch 的详细配置选项 in its api doc here .

User Authentication methods (UserAuth)

Here the user sends a list of methods, and we have a list of methods in the option PreferredAuthentications (in preference order). We take the first of our methods which is supported by the server, get the userauth.method variable to load the implementing class, and try to authenticate. This will repeat until we are authenticated or no more methods left.

The following ones are built in:

userauth.nonemainly for getting the list of methods the server supports.userauth.passwordusual password authentication.

userauth.keyboard-interactiveUsing the generic message exchange authentication mechanism, as defined in RFC 4256.

userauth.publickeypublic key authentication, using an Identity.

userauth.gssapi-with-micUsing the GSS-API (see below) as defined in RFC 4462, section 3.For the GSS-API mechanism we need an implementation of GSSContext to refer to, which will be chosen by the configuration option gssapi-with-mic.method, the method being chosen from a list given by the server. For now, we (hardcoded) only support the krb5 method, resulting in:

gssapi-with-mic.krb5Kerberos 5 authentication.