Dohbedoh opened a new issue, #925: URL: https://github.com/apache/mina-sshd/issues/925
### Version 2.20.0 ### Bug description A server configured to require no authentication now rejects every client. Since [530dbdb8](https://github.com/apache/mina-sshd/commit/530dbdb8ef5de803e84adbb554cad1826640a1be) (“ServerUserAuthService: early return for unknown auth methods”), `ServerUserAuthService#handleUserAuthRequestMessage` fails any `none` request before looking up the factory: ``` if ("none".equals(method)) { return true; // -> SSH_MSG_USERAUTH_FAILURE } else if (!authMethods.stream()...anyMatch(s -> method.equals(s))) { ``` So `UserAuthNoneFactory`/`UserAuthNone` is never invoked, even when explicitly configured. With `UserAuthNoneFactory` as the only factory, no client can authenticate. This also seem to contradict [RFC 4252 §5.2](https://www.rfc-editor.org/rfc/rfc4252#section-5.2): > If no authentication is needed for the user, the server MUST return SSH_MSG_USERAUTH_SUCCESS. This was maybe un unforeseen impact of the change that was made. **Reproducer** ``` import java.nio.file.Files; import java.time.Duration; import java.util.List; import org.apache.sshd.client.SshClient; import org.apache.sshd.client.session.ClientSession; import org.apache.sshd.server.SshServer; import org.apache.sshd.server.auth.UserAuthNoneFactory; import org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider; public class NoneAuthRepro { public static void main(String[] args) throws Exception { SshServer sshd = SshServer.setUpDefaultServer(); sshd.setPort(0); sshd.setKeyPairProvider(new SimpleGeneratorHostKeyProvider(Files.createTempFile("host", ".ser"))); sshd.setUserAuthFactories(List.of(UserAuthNoneFactory.INSTANCE)); // no authentication required sshd.start(); try (SshClient client = SshClient.setUpDefaultClient()) { client.start(); try (ClientSession session = client.connect("user", "localhost", sshd.getPort()) .verify(Duration.ofSeconds(10)).getSession()) { session.auth().verify(Duration.ofSeconds(10)); System.out.println("AUTHENTICATED: " + session.isAuthenticated()); } } finally { sshd.stop(true); } } } ``` ### Actual behavior I think what happens is: 1) Client sends `none`, and the server returns `SSH_MSG_USERAUTH_FAILURE`. `none` is removed from the method list (`handleAuthenticationFailure`), so the list is empty. 2) Client falls back to its own methods `keyboard-interactive`, and the server rejects them as “not in methods that can proceed [[none]]”. 3) Client fails with `No more authentication methods available`. ### Expected behavior When `none` is configured as an auth method, a `none` request is handed to `UserAuthNone` and returns `SSH_MSG_USERAUTH_SUCCESS`, as in 2.19.0 and per RFC 4252 §5.2. When none is not configured, failing it early is fine. ### Relevant log output ```Shell Oct 12, 2026 9:24:53 AM org.apache.sshd.client.keyverifier.StaticServerKeyVerifier handleAcceptance WARNING: Server at localhost/127.0.0.1:51073 presented unverified EC key: SHA256:zQmLOCJPbRRZFH7GkPKWAWEv2NTQ+kWYryNinU0InfQ Oct 12, 2026 9:24:53 AM org.apache.sshd.server.session.ServerUserAuthService handleUserAuthRequestMessage WARNING: handleUserAuthRequestMessage(ServerSessionImpl[null@/127.0.0.1:51074]) client sent method=publickey not in methods that can proceed [[none]] [ERROR] Tests run: 1, Failures: 0, Errors: 1, Skipped: 0, Time elapsed: 0.419 s <<< FAILURE! -- in io.jenkins.plugins.mina_sshd_api.core.NoneAuthReproTest [ERROR] io.jenkins.plugins.mina_sshd_api.core.NoneAuthReproTest.noneAuthentication -- Time elapsed: 0.415 s <<< ERROR! org.apache.sshd.common.SshException: No more authentication methods available at org.apache.sshd.common.future.AbstractSshFuture.verifyResult(AbstractSshFuture.java:141) at org.apache.sshd.client.future.DefaultAuthFuture.verify(DefaultAuthFuture.java:56) at org.apache.sshd.client.future.DefaultAuthFuture.verify(DefaultAuthFuture.java:35) at org.apache.sshd.common.future.VerifiableFuture.verify(VerifiableFuture.java:110) at org.apache.sshd.common.future.VerifiableFuture.verify(VerifiableFuture.java:96) at io.jenkins.plugins.mina_sshd_api.core.NoneAuthReproTest.noneAuthentication(NoneAuthReproTest.java:59) Caused by: org.apache.sshd.common.SshException: No more authentication methods available at org.apache.sshd.client.session.ClientUserAuthService.tryNext(ClientUserAuthService.java:441) at org.apache.sshd.client.session.ClientUserAuthService.processUserAuth(ClientUserAuthService.java:375) at org.apache.sshd.client.session.ClientUserAuthService.process(ClientUserAuthService.java:270) at org.apache.sshd.common.session.helpers.CurrentService.process(CurrentService.java:109) at org.apache.sshd.common.session.helpers.AbstractSession.doHandleMessage(AbstractSession.java:638) at org.apache.sshd.common.session.helpers.AbstractSession.lambda$handleMessage$0(AbstractSession.java:559) at org.apache.sshd.common.util.threads.ThreadUtils.runAsInternal(ThreadUtils.java:68) at org.apache.sshd.common.session.helpers.AbstractSession.handleMessage(AbstractSession.java:558) at org.apache.sshd.common.session.helpers.AbstractSession.decode(AbstractSession.java:1748) at org.apache.sshd.common.session.helpers.AbstractSession.messageReceived(AbstractSession.java:517) at org.apache.sshd.common.session.helpers.AbstractSessionIoHandler.messageReceived(AbstractSessionIoHandler.java:76) at org.apache.sshd.mina.MinaService.messageReceived(MinaService.java:163) at org.apache.mina.core.filterchain.DefaultIoFilterChain$TailFilter.messageReceived(DefaultIoFilterChain.java:1015) at org.apache.mina.core.filterchain.DefaultIoFilterChain.callNextMessageReceived(DefaultIoFilterChain.java:650) at org.apache.mina.core.filterchain.DefaultIoFilterChain.access$1300(DefaultIoFilterChain.java:49) at org.apache.mina.core.filterchain.DefaultIoFilterChain$EntryImpl$1.messageReceived(DefaultIoFilterChain.java:1128) at org.apache.mina.core.filterchain.IoFilterAdapter.messageReceived(IoFilterAdapter.java:122) at org.apache.mina.core.filterchain.DefaultIoFilterChain.callNextMessageReceived(DefaultIoFilterChain.java:650) at org.apache.mina.core.filterchain.DefaultIoFilterChain.fireMessageReceived(DefaultIoFilterChain.java:643) at org.apache.mina.core.polling.AbstractPollingIoProcessor.read(AbstractPollingIoProcessor.java:539) at org.apache.mina.core.polling.AbstractPollingIoProcessor.access$1200(AbstractPollingIoProcessor.java:68) at org.apache.mina.core.polling.AbstractPollingIoProcessor$Processor.process(AbstractPollingIoProcessor.java:1224) at org.apache.mina.core.polling.AbstractPollingIoProcessor$Processor.process(AbstractPollingIoProcessor.java:1213) at org.apache.mina.core.polling.AbstractPollingIoProcessor$Processor.run(AbstractPollingIoProcessor.java:683) at org.apache.mina.util.NamePreservingRunnable.run(NamePreservingRunnable.java:64) at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1144) at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:642) at java.base/java.lang.Thread.run(Thread.java:1583) ``` ### Other information Found via Jenkins: [sshd-plugin](https://github.com/jenkinsci/sshd-plugin) uses `UserAuthNoneFactory` when Jenkins security is disabled. `CLITest.redirectToEndpointShouldBeFollowed` fails on 2.20.0 (https://github.com/jenkinsci/bom/pull/7546). -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
