+ hjpRt^RIt^RIt^RItRtRtRt^RIt]!]R4'd"]PR8XdRt]P3tM9Rt]PP]PPP3t^R IHt^R IHt^R IHtRR lt!R R4t!RR]4t]R8d]t!RR]4t !RR]4t!R# ]]3d2^RIt^RIt^RItRt]P*3tLt ]d RtRtLi;ii;i)z This module provides GSS-API / SSPI authentication as defined in :rfc:`4462`. .. note:: Credential delegation is not supported in server mode. .. seealso:: :doc:`/api/kex_gss` .. versionadded:: 1.15 NT __title__z python-gssapiMITPYTHON-GSSAPI-NEWSSPIF)MSG_USERAUTH_REQUEST) SSHException)__version_info__c\R8Xd \W4#\R8Xd \W4#\R8Xd!\PR8Xd \ W4#\ R4h)a| Provide SSH2 GSS-API / SSPI authentication. :param str auth_method: The name of the SSH authentication mechanism (gssapi-with-mic or gss-keyex) :param bool gss_deleg_creds: Delegate client credentials or not. We delegate credentials by default. :return: Either an `._SSH_GSSAPI_OLD` or `._SSH_GSSAPI_NEW` (Unix) object or an `_SSH_SSPI` (Windows) object :rtype: object :raises: ``ImportError`` -- If no GSS-API / SSPI module could be imported. :see: `RFC 4462 `_ :note: Check for the available API and return either an `._SSH_GSSAPI_OLD` (MIT GSSAPI using python-gssapi package) object, an `._SSH_GSSAPI_NEW` (MIT GSSAPI using gssapi package) object or an `._SSH_SSPI` (MS SSPI) object. If there is no supported API available, ``None`` will be returned. rrrntz)Unable to import a GSS-API / SSPI module!)_API_SSH_GSSAPI_OLD_SSH_GSSAPI_NEWosname _SSH_SSPI ImportError) auth_methodgss_deleg_credss&&K/var/www/html/bestweb/venv/lib/python3.14/site-packages/paramiko/ssh_gss.pyGSSAuthrNsR, u}{<< $ ${<< BGGtO66EFFcRa]tRt^ntoRtRtRtRtR RltRt Rt Rt R t Vt R #) _SSH_GSSAuthzg Contains the shared variables and methods of `._SSH_GSSAPI_OLD`, `._SSH_GSSAPI_NEW` and `._SSH_SSPI`. c WnW nRVnRVnRVnRVnRVnRVnRVnRVn RVn RVn R#) :param str auth_method: The name of the SSH authentication mechanism (gssapi-with-mic or gss-keyex) :param bool gss_deleg_creds: Delegate client credentials or not Nzssh-connectionz1.2.840.113554.1.2.2F) _auth_method_gss_deleg_creds _gss_host _username _session_id_service _krb5_mech _gss_ctxt_gss_ctxt_status _gss_srv_ctxt_gss_srv_ctxt_statuscc_fileselfrrs&&&r__init___SSH_GSSAuth.__init__tse ( /(  1 %"$)! rc DVPR4'd WnR#R#)z This is just a setter to use a non default service. I added this method, because RFC 4462 doesn't specify "ssh-connection" as the only service value. :param str service: The desired SSH service zssh-N)findr )r(services&&r set_service_SSH_GSSAuth.set_services <<  #M rc WnR#)z Setter for C{username}. If GSS-API Key Exchange is performed, the username is not set by C{ssh_init_sec_context}. :param str username: The name of the user who attempts to login N)r)r(usernames&&r set_username_SSH_GSSAuth.set_usernames "rc ^RIHp^RIHpVP ^4pVP V!VP 44pVP \V44pVR8Xd We,#WF,V,#)a| This method returns a single OID, because we only support the Kerberos V5 mechanism. :param str mode: Client for client mode and server for server mode :return: A byte sequence containing the number of supported OIDs, the length of the OID and the actual OID encoded with DER :note: In server mode we just return the OID length and the DER encoded OID. )ObjectIdentifier)encoderserver)pyasn1.type.univr5pyasn1.codec.derr6 _make_uint32encoder!len)r(moder5r6OIDskrb5_OIDOID_lens&& r ssh_gss_oids_SSH_GSSAuth.ssh_gss_oidssd 6,  #>>"24??"CD##CM2 8 % %~((rc z^RIHpVPV4wr4VP4VP8wdR#R#)z Check if the given OID is the Kerberos V5 OID (server mode). :param str desired_mech: The desired GSS-API mechanism of the client :return: ``True`` if the given OID is supported, otherwise C{False} decoderFT)r9rEdecode__str__r!)r( desired_mechrEmech__s&& rssh_check_mech_SSH_GSSAuth.ssh_check_mechs/ ->>,/ <<>T__ ,rc 0\P!RV4#)z Create a 32 bit unsigned integer (The byte sequence of an integer). :param int integer: The integer value to convert :return: The byte sequence of an 32 bit integer z!I)structpack)r(integers&&rr:_SSH_GSSAuth._make_uint32s{{4))rc VP\V44pWQ, pV\P!R\4, pWPP\V44, pWRP 4, pWPP\V44, pWSP 4, pWPP\V44, pWTP 4, pV#)a^ Create the SSH2 MIC filed for gssapi-with-mic. :param str session_id: The SSH session ID :param str username: The name of the user who attempts to login :param str service: The requested SSH service :param str auth_method: The requested SSH authentication mechanism :return: The MIC as defined in RFC 4462. The contents of the MIC field are: string session_identifier, byte SSH_MSG_USERAUTH_REQUEST, string user-name, string service (ssh-connection), string authentication-method (gssapi-with-mic or gssapi-keyex) B)r:r<rNrOrr;)r( session_idr1r-rmics&&&&& r_ssh_build_mic_SSH_GSSAuth._ssh_build_mics"J0  v{{3 455   X//      W.. ~~   [!122 !!## r) rr"r#rrr$r%r!r rrr&N)client)__name__ __module__ __qualname____firstlineno____doc__r)r.r2rArKr:rV__static_attributes____classdictcell__ __classdict__s@rrrns2 6 $"),  *rrcha]tRt^toRtRtR RltR RltR RltR Rlt ] R4t R t R t VtR#)r z Implementation of the GSS-API MIT Kerberos Authentication for SSH2, using the older (unmaintained) python-gssapi package. :see: `.GSSAuth` c H\PWV4VP'dF\P\P \P \P3VnR#\P\P \P 3VnR#rN) rr)rgssapiC_PROT_READY_FLAG C_INTEG_FLAG C_MUTUAL_FLAG C_DELEG_FLAG _gss_flagsr's&&&rr)_SSH_GSSAPI_OLD.__init__ss dA  ((##$$## DO((##$$DOrNc ^RIHpW0nWn\P !RVP,\P 4p\P!4pVPVn Vf+\PPVP4pMfVPV4wrV P4VP8wd \R4h\PPVP4pRp VfE\P !VVVPR7VnVP"P%V 4p MVP"P%V4p VP"P.VnV # \P&dNRP)\*P,!4^,TP4p \P&!T 4hi;i)ac Initialize a GSS-API context. :param str username: The name of the user who attempts to login :param str target: The hostname of the target to connect to :param str desired_mech: The negotiated GSS-API mechanism ("pseudo negotiated" mechanism, because we support just the krb5 mechanism :-)) :param str recv_token: The GSS-API token received from the Server :raises: `.SSHException` -- Is raised if the desired mechanism of the client is not supported :return: A ``String`` if the GSS-API has returned a token or ``None`` if no token was returned rDhost@NUnsupported mechanism OID.) peer_name mech_type req_flagsz {} Target: {})r9rErrreNameC_NT_HOSTBASED_SERVICEContextrjflagsOIDmech_from_stringr!rFrGr InitContextr"step GSSExceptionformatsysexc_info establishedr#) r(targetrHr1 recv_tokenrE targ_namectx krb5_mechrIrJtokenmessages &&&&& rssh_init_sec_context$_SSH_GSSAPI_OLD.ssh_init_sec_context sk$ -!KK dnn $f&C&C nnOO   33DOODI~~l3HD||~0"#?@@"JJ77H  /!!'!3!3''!ii" ++E2++J7!% : : "" /%,,S\\^A->OG%%g. . /sAFFA"G)c WnV'gZVPVPVPVPVP4pVP P V4pV#VPP VP4pV#)a Create the MIC token for a SSH2 message. :param str session_id: The SSH session ID :param bool gss_kex: Generate the MIC for GSS-API Key Exchange or not :return: gssapi-with-mic: Returns the MIC token from GSS-API for the message we created with ``_ssh_build_mic``. gssapi-keyex: Returns the MIC token from GSS-API with the SSH session ID as message. )rrVrr rr"get_micr$r(rTgss_kex mic_field mic_tokens&&& r ssh_get_mic_SSH_GSSAPI_OLD.ssh_get_micAs&++   !! I ..y9I**2243C3CDIrc WnW0nVPf\P!4VnVPP V4pVPP VnV#)s Accept a GSS-API context (server mode). :param str hostname: The servers hostname :param str username: The name of the user who attempts to login :param str recv_token: The GSS-API Token received from the server, if it's not the initial call. :return: A ``String`` if the GSS-API has returned a token or ``None`` if no token was returned )rrr$re AcceptContextryr~r%r(hostnamerr1rs&&&& rssh_accept_sec_context&_SSH_GSSAPI_OLD.ssh_accept_sec_context\sZ"!    %!'!5!5!7D ""'' 3$($6$6$B$B! rc 8W nW0nVPeZVPVPVPVPVP4pVP P WA4R#VPP VPV4R#)a< Verify the MIC token for a SSH2 message. :param str mic_token: The MIC token received from the client :param str session_id: The SSH session ID :param str username: The name of the user who attempts to login :return: None if the MIC check was successful :raises: ``gssapi.GSSException`` -- if the MIC check failed N)rrrVr rr$ verify_micr"r(rrTr1rs&&&& r ssh_check_mic_SSH_GSSAPI_OLD.ssh_check_micps{&! >> %++   !! I    ) )) ? NN % %d&6&6 Brc :VPPeR#R#)y Checks if credentials are delegated (server mode). :return: ``True`` if credentials are delegated, otherwise ``False`` TF)r$delegated_credr(s&rcredentials_delegated%_SSH_GSSAPI_OLD.credentials_delegateds    , , 8rc \h)a> Save the Client token in a file. This is used by the SSH server to store the client credentials if credentials are delegated (server mode). :param str client_token: The GSS-API token received form the client :raises: ``NotImplementedError`` -- Credential delegation is currently not supported in server mode NotImplementedErrorr( client_tokens&&rsave_client_creds!_SSH_GSSAPI_OLD.save_client_creds "!rr"r#rjrr$r%rrNNNFNrYrZr[r\r]r)rrrrpropertyrrr^r_r`s@rr r sC,2h6(C4 " "rr cha]tRtRtoRtRtR RltR RltRRltRRlt ] R 4t R t R t VtR#)r iz Implementation of the GSS-API MIT Kerberos Authentication for SSH2, using the newer, currently maintained gssapi package. :see: `.GSSAuth` c \PWV4VP'dn\PP \PP \PP\PP3Vn R#\PP \PP \PP3Vn R#rd) rr)rreRequirementFlagprotection_ready integritymutual_authenticationdelegate_to_peerrjr's&&&rr)_SSH_GSSAPI_NEW.__init__s dA  &&77&&00&&<<&&77 DO&&77&&00&&<<DOrNc d^RIHpW0nWn\P !RVP,\P PR7pVe>VPV4wrxVP4VP8wd \R4h\PPp Rp VfF\P!VVPV RR7VnVP P#V 4p MVP P#V4p VP P$VnV #)a Initialize a GSS-API context. :param str username: The name of the user who attempts to login :param str target: The hostname of the target to connect to :param str desired_mech: The negotiated GSS-API mechanism ("pseudo negotiated" mechanism, because we support just the krb5 mechanism :-)) :param str recv_token: The GSS-API token received from the Server :raises: `.SSHException` -- Is raised if the desired mechanism of the client is not supported :raises: ``gssapi.exceptions.GSSError`` if there is an error signaled by the GSS-API implementation :return: A ``String`` if the GSS-API has returned a token or ``None`` if no token was returned rDrm) name_typeNrninitiate)rrurIusage)r9rErrrerrNameTypehostbased_servicerFrGr!rMechTypekerberosSecurityContextrjr"rycompleter#) r(rrHr1rrErrIrJrrs &&&&& rr$_SSH_GSSAPI_NEW.ssh_init_sec_contexts& -!KK dnn $oo77   #~~l3HD||~0"#?@@OO,,   #33oo DN NN''.ENN'' 3E $ 7 7 rc WnV'gZVPVPVPVPVP4pVP P V4pV#VPP VP4pV#)a Create the MIC token for a SSH2 message. :param str session_id: The SSH session ID :param bool gss_kex: Generate the MIC for GSS-API Key Exchange or not :return: gssapi-with-mic: Returns the MIC token from GSS-API for the message we created with ``_ssh_build_mic``. gssapi-keyex: Returns the MIC token from GSS-API with the SSH session ID as message. :rtype: str )rrVrr rr" get_signaturer$rs&&& rr_SSH_GSSAPI_NEW.ssh_get_mics&++   !! I 44Y?I**889I9IJIrc WnW0nVPf\P!RR7VnVPP V4pVPP VnV#)raccept)r)rrr$rerryrr%rs&&&& rr&_SSH_GSSAPI_NEW.ssh_accept_sec_contexts\"!    %!'!7!7h!GD ""'' 3$($6$6$?$?! rc 8W nW0nVPeZVPVPVPVPVP4pVP P WA4R#VPP VPV4R#)aC Verify the MIC token for a SSH2 message. :param str mic_token: The MIC token received from the client :param str session_id: The SSH session ID :param str username: The name of the user who attempts to login :return: None if the MIC check was successful :raises: ``gssapi.exceptions.GSSError`` -- if the MIC check failed N)rrrVr rr$verify_signaturer"rs&&&& rr_SSH_GSSAPI_NEW.ssh_check_mic$s{&! >> %++   !! I    / / E NN + +D,<,s    - - 9rc \h)a? Save the Client token in a file. This is used by the SSH server to store the client credentials if credentials are delegated (server mode). :param str client_token: The GSS-API token received form the client :raises: ``NotImplementedError`` -- Credential delegation is currently not supported in server mode rrs&&rr!_SSH_GSSAPI_NEW.save_client_credsJs "!rrrrrrr`s@rr r sC,,\8(I4   " "rr cda]tRtRtoRtRtR RltR RltRtRRlt ] R 4t R t R t VtR#)riWzZ Implementation of the Microsoft SSPI Kerberos Authentication for SSH2. :see: `.GSSAuth` c ,\PWV4VP'dB\P\P ,\P ,VnR#\P\P ,VnR#rd)rr)rsspiconISC_REQ_INTEGRITYISC_REQ_MUTUAL_AUTHISC_REQ_DELEGATErjr's&&&rr)_SSH_SSPI.__init__^si dA  ))--.**+ O))G,G,GG OrNc T^RIHpW0nWn^pRVP,pVe>VP V4wrVP 4VP 8wd \R4hVf)\P!RVPVR7Vn VPPV4wrjV ^,Pp T^8Xd RTnRp T # \Pd9p T ;P RP#TP4, unhRp ? ii;i) aT Initialize a SSPI context. :param str username: The name of the user who attempts to login :param str target: The FQDN of the target to connect to :param str desired_mech: The negotiated SSPI mechanism ("pseudo negotiated" mechanism, because we support just the krb5 mechanism :-)) :param recv_token: The SSPI token received from the Server :raises: `.SSHException` -- Is raised if the desired mechanism of the client is not supported :return: A ``String`` if the SSPI has returned a token or ``None`` if no token was returned rDhost/NrnKerberos)scflags targetspnz , Target: {}T)r9rErrrFrGr!rsspi ClientAuthrjr" authorizeBuffer pywintypeserrorstrerrorr{r#) r(rrHr1rrErrrIrJres &&&&& rr_SSH_SSPI.ssh_init_sec_contextqs$ -!dnn,  #~~l3HD||~0"#?@@ !!%9" >>33J?LE!HOOE A: %)D !E    JJ.//? ?J  s*ACD'/3D""D'c WnV'gZVPVPVPVPVP4pVP P V4pV#VPP VP4pV#)a Create the MIC token for a SSH2 message. :param str session_id: The SSH session ID :param bool gss_kex: Generate the MIC for Key Exchange with SSPI or not :return: gssapi-with-mic: Returns the MIC token from SSPI for the message we created with ``_ssh_build_mic``. gssapi-keyex: Returns the MIC token from SSPI with the SSH session ID as message. )rrVrr rr"signr$rs&&& rr_SSH_SSPI.ssh_get_mics&++   !! I ++I6I**//0@0@AIrc WnW nRVP,p\P!RVR7VnVPP V4wrVV^,P pV^8Xd RVnRpV#)ag Accept a SSPI context (server mode). :param str hostname: The servers FQDN :param str username: The name of the user who attempts to login :param str recv_token: The SSPI Token received from the server, if it's not the initial call. :return: A ``String`` if the SSPI has returned a token or ``None`` if no token was returned rr)spnTN)rrr ServerAuthr$rrr%)r(rr1rrrrs&&&& rr _SSH_SSPI.ssh_accept_sec_contextsm"!dnn, !__ZYG))33J? a A:(,D %E rc $W nW0nVeZVPVPVPVPVP4pVP P WA4R#VPP VPV4R#)a3 Verify the MIC token for a SSH2 message. :param str mic_token: The MIC token received from the client :param str session_id: The SSH session ID :param str username: The name of the user who attempts to login :return: None if the MIC check was successful :raises: ``sspi.error`` -- if the MIC check failed N)rrrVr rr$verifyr"rs&&&& rr_SSH_SSPI.ssh_check_micsw&!  ++   !! I    % %i ; NN ! !$"2"2I >rc VP\P,;'d!VP;'g VP#)r)rjrrr%rs&rr_SSH_SSPI.credentials_delegateds:!9!99   % % 8 8 rc \h)a; Save the Client token in a file. This is used by the SSH server to store the client credentails if credentials are delegated (server mode). :param str client_token: The SSPI token received form the client :raises: ``NotImplementedError`` -- Credential delegation is currently not supported in server mode rrs&&rr_SSH_SSPI.save_client_credsrrrrrrrr`s@rrrWsB &2h6,?<   " "rr)T))"r]rNrr|GSS_AUTH_AVAILABLEGSS_EXCEPTIONSr rehasattrrrz exceptions GeneralErrorrawmiscGSSErrorrOSErrorrrrrparamiko.commonrparamiko.ssh_exceptionrparamiko._versionrrrr _SSH_GSSAPIr rrrrrs8,  v{##(8(8O(K --/"    * * JJOO $ $  1/.G@~~Bq"lq"hf!Kl"ll"^s" s"u W  $**, " s4C C 8C D C77 DD DD