password authentication deadlocks

[salva]

Bug report by Troy Loveday:

I have found what I believe is a bug with password authentication in
the Net::SFTP::Foreign module. I have attached a minimal example
program to re-produce the bug.

Enviroment:

$ uname -srvmpio
 Linux 3.10.0-693.el7.x86_64 #1 SMP Thu Jul 6 19:56:57 EDT 2017 x86_64 x86_64 x86_64 GNU/Linux

 $ lsb_release -sir
 RedHatEnterpriseWorkstation 7.4

 $ perl -e 'printf "v%vd\n", $^V;'
 v5.14.2

 $ perl -MNet::SFTP::Foreign -e 'print "$Net::SFTP::Foreign::VERSION\n";'
 1.93

Bug Description:

If you specify a password, then by default, the code in
Net::SFTP::Foreign::Backend::Unix::_init_transport() adds the following
options to the ssh(1) command:

    -o NumberOfPasswordPrompts=1
    -o PreferredAuthentications=keyboard-interactive,password

It then sends the password to the ssh(1) process only once, since it has
specified only one password prompt. However, if 'keyboard-interactive'
authentication fails due to an INCORRECT PASSWORD, ssh(1) attempts
'password' authentication, issuing a second prompt.

This causes the perl(1) and ssh(1) processes to "hang" or deadlock.

The multiple prompts can be demonstrated by running ssh(1) itself,
and entering an incorrect password:

$ ssh -F /dev/null \
      -o NumberOfPasswordPrompts=1 \
      -o PreferredAuthentications=keyboard-interactive,password \
      [user@hostname](mailto:user@hostname)
Password:
[user@hostname](mailto:user@hostname)'s password:
Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password,keyboard-interactive,hostbased).

Likewise, the (desired) single password prompt is demonstrated by running:

$ ssh -F /dev/null \
       -o NumberOfPasswordPrompts=1 \
       -o PreferredAuthentications=password \
       [user@hostname](mailto:user@hostname)
 [user@hostname](mailto:user@hostname)'s password:
 Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password,keyboard-interactive,hostbased).

Workaround:

When specifying a password, specifying the following option to the
Net::SFTP::Foreign contstructor, to override the default value,
works around this bug.

more => [ qw( -o PreferredAuthentications=password ) ]

However, I believe the correct solution is to change the following
line in Net::SFTP::Foreign::Backend::Unix from:

push @preferred_authentications, ('keyboard-interactive', 'password');

to:

push @preferred_authentications, 'password';
Demonstration Program:

  $ perl/bin/Net-SFTP-Foreign.pl
  Usage: perl/bin/Net-SFTP-Foreign.pl [-auths password] source_path dest_host dest_path

  $ Net-SFTP-Foreign.pl test-file `hostname` test-file.new
  $Net::SFTP::Foreign::VERSION : 1.93

  (hangs)
  ^C

  $ Net-SFTP-Foreign.pl -auths password test-file `hostname` test-file.new
  $Net::SFTP::Foreign::VERSION : 1.93

  Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password,keyboard-interactive,hostbased).
  Connection to remote server is broken at Net-SFTP-Foreign.pl line 26

Please let me know if you require additional information.