rushh authentication with public keys

[grandmasponge]

i was confused with how this project works with authenticating the clients publickey i see that there is a method called auth_publickey but i want to know how to use this function or if theres a external folder that the server pulls without my knowlege in .ssh

[Eugeny]

Russh is a protocol implementation, how you want to check the key is up to you.

auth_xxx methods are called when a client tries to authenticate, and that's where you make your decision.

[grandmasponge]

i was mainly asking when this is called and how this is meant to be authenticated, you get the public key and the username, if i remeber correctly ssh auth is when a server sends a random message to client the client encrypts with priv key and server decrypts with public key , but in the auth_public key method you only get the username and the public key, where is this public key pulled from a file on the host computer and you dont get given a session to send data to the client. could you further classify or give an example of this with your auth_publickey method

[Eugeny]

The public key is provided by the client, not pulled from a file. Russh verifies the key ownership and then you decide whether you want to authenticate this key or not.

[grandmasponge]

so russh does the main bit of making sure the key actually works with the provided public key and then i juss check after that in a db that its actually allowed

[FelixKLG]

Sorry I gotta chime in here because I too am confused by this, from what I understand Russh validates the validity of the keypair that the client wants to use and from there with the callback function you can then further decide wether or not to grant access?

From what I'm reading from your responses the client sends the public key they wish to match against and then proves it by signing a token or whatever, then Russh validates that it matches and passes the key off to the handler function; am I correct? Then from the handler function I can perform my application logic to determine wether or not to grant access to the resource.

[Eugeny]

Sorry for the delay - you're correct, russh handles checking whether the client actually has the matching private key (authentication). You then decide whether you want to allow this client to connect (authorize) with this key. See the description for https://docs.rs/russh/latest/russh/server/trait.Handler.html#method.auth_publickey

You also refuse the key early in https://docs.rs/russh/latest/russh/server/trait.Handler.html#method.auth_publickey_offered , skipping the validation