sftp rsa key auth

[evilmoe2]

Hello,

Would you please add the feature to use sftp with a rsy auth key + password (security reason).
I normally dont allow sftp connection with just a password on my servers, but unfortunately I have to atm with chevereto.


Sven

 

[Rodolfo]

When you mention security you say it because the password is stored in the Chevereto database?

 

[evilmoe2]

Not only because of the clean text password saved in the db. I care more about the security of my servers. I have to enable password login on the server. Which is a security risk.

 

[Rodolfo]

I think that it could be added, can you test it?

app/lib/classes/class.sftp.php

This:

if(!$this->resource->login($args['user'], $args['password'])) {

Should be this:

if(!$this->resource->_privatekey_login($args['user'], $args['password'])) {

(taken from here: http://phpseclib.bantux.org/api/master/)

 

[evilmoe2]

I get a internal server error then. In my auth.log I just see "Connection closed by 127.0.0.1 [preauth]".

EDIT: I have installed the php-seclib package.

 

[evilmoe2]

Any update?

 

[Rodolfo]

I haven't test it. As you may notice is not a popular request.

 

[evilmoe2]

I haven't test it. As you may notice is not a popular request.

I understand your point.

BTW: I found a way to enable password login just from a single IP.
sshd_config

PasswordAuthentication no
Match address xxx.xxx.xxx.xxx
PasswordAuthentication yes