PubkeyAuthentication is not bool by SSH specifications

[ondrejsuk1]

Hello,

we're using asyncssh in out project and we found problem with ssh_config - exactly this error:

asyncssh.config.ConfigParseError: /home/sukondrej/.ssh/config line 1: Invalid PubkeyAuthentication boolean value: unbound

leads me to SSHClientConfig configuration parser (and even in SSHServerConfig):

asyncssh/asyncssh/config.py

Line 671 in 742f091

('PubkeyAuthentication', SSHConfig._set_bool),

asyncssh/asyncssh/config.py

Line 768 in 742f091

('PubkeyAuthentication', SSHConfig._set_bool),

This configuration option is not boolean, according the OpenSSH specification. PubkeyAuthentication can be one of yes, no, unbound or host-bound.

I'm not posting OS version or Python version, as mentioned in CONTRIBUTING.rst, because this is not version specific, but if you want them, I'll post them. I found out that this directive is used on these places (but maybe even more):

docs/api.rst:  | PubkeyAuthentication
docs/api.rst:  | PubkeyAuthentication
tests/test_connection.py:            f.write('Match host localhost\nPubkeyAuthentication no')
asyncssh/connection.py:                config.get('PubkeyAuthentication', True))
asyncssh/config.py:        ('PubkeyAuthentication',            SSHConfig._set_bool),
asyncssh/config.py:        ('PubkeyAuthentication',            SSHConfig._set_bool),

BR
Ondřej Suk

[ronf]

It appears that this setting started off as a boolean, but added the new "unbound" and "host-bound" options in OpenSSH 8.9, released in 2022, which was probably after I added support for this option. Unfortunately, I missed the release note about the new settings. I'll need to see if I can find documentation on the binding being done there. I may also be able to temporarily support parsing these new values but not actually implementing the binding, so "unbound" would basically be treated as "yes", but without support for the new binding.

[ondrejsuk1]

Hi,
yes, I think that these new values are added few years ageo, but I don't know exactly. But my friend tell me that this library is reimplementation of SSHv2 protocol, instead of OpenSSH, so I'm sorry that i missed that.
I think that postpone full functionality is better, instead of workaround, that treats unbound as "yes"

Thank you

BR
Ondřej Suk

[ronf]

Thanks for the feedback. I'm currently in the middle of handling some security-related items, so I may not have time to figure out this new host-bound authentication right away. However, I'll keep this on my backlog. AsyncSSH doesn't support all of the settings that OpenSSH does, but once I add support for a setting I try to implement it fully, so parsing errors like this don't occur.