PuTTY wish authentication-plugin

Home | FAQ | Feedback | Licence | Updates | Mirrors | Keys | Links | Team
Download: Stable · Snapshot | Docs | Changes | Wishlist

The keyboard-interactive protocol can be used for a lot of different authentication systems, from simple password authentication to OTP or two-factor systems.

As the name suggests, the protocol was originally intended to be used interactively, in the sense that the human user responds to the questions asked by the server.

However, if a two-factor system can be automated, it's annoying to make the user manually re-type or paste the right response from some other source like a web browser. It would be easier if the response could be filled in automatically.

So we've implemented a system where PuTTY can invoke a separate program as a subprocess, and allow it to help with keyboard-interactive authentication by filling in the responses automatically.

The plugin is run in a pair of pipes by PuTTY, and is expected to speak a protocol over those pipes that we designed specially for the purpose. The protocol is described in an appendix of the PuTTY manual. There's an example Python implementation of a plugin in the PuTTY source tree, at contrib/authplugin-example.py.

Examples of authentication systems which could use this:

• Systems where the authentication response is obtained via an HTTPS transaction, perhaps based on prior authentication with a website in a browser.
• Systems where a one-time password is constructed by hashing a master secret with some kind of challenge or nonce that's different every time.
• Systems where the response is obtained from a hardware second factor such as a security token, assuming that token can be accessed directly from the host (e.g. via USB).