snapshot of https://github.com/seaweedfs/seaweedfs.git (master, 2026-09-16; blobs > 131072B omitted)

weed/sftpd/auth/auth.go

@@ -0,0 +1,90 @@
+// Package auth provides authentication and authorization functionality for the SFTP server
+package auth
+
+import (
+	"fmt"
+
+	"github.com/seaweedfs/seaweedfs/weed/sftpd/user"
+	"golang.org/x/crypto/ssh"
+)
+
+// Provider defines the interface for authentication providers
+type Provider interface {
+	// GetAuthMethods returns the SSH server auth methods
+	GetAuthMethods() []ssh.AuthMethod
+}
+
+// Manager handles authentication and authorization
+type Manager struct {
+	userStore          user.Store
+	passwordAuth       *PasswordAuthenticator
+	publicKeyAuth      *PublicKeyAuthenticator
+	certificateAuth    *CertificateAuthenticator
+	enabledAuthMethods []string
+}
+
+// NewManager creates a new authentication manager.
+//
+// trustedUserCAKeysFile is the path to a file containing trusted CA public
+// keys (OpenSSH authorized_keys format). It is required when "certificate"
+// is listed in enabledAuthMethods and ignored otherwise.
+func NewManager(userStore user.Store, enabledAuthMethods []string, trustedUserCAKeysFile string) (*Manager, error) {
+	manager := &Manager{
+		userStore:          userStore,
+		enabledAuthMethods: enabledAuthMethods,
+	}
+
+	// Initialize authenticators based on enabled methods
+	passwordEnabled := false
+	publicKeyEnabled := false
+	certificateEnabled := false
+
+	for _, method := range enabledAuthMethods {
+		switch method {
+		case "password":
+			passwordEnabled = true
+		case "publickey":
+			publicKeyEnabled = true
+		case "certificate":
+			certificateEnabled = true
+		}
+	}
+
+	manager.passwordAuth = NewPasswordAuthenticator(userStore, passwordEnabled)
+	manager.publicKeyAuth = NewPublicKeyAuthenticator(userStore, publicKeyEnabled)
+
+	certAuth, err := NewCertificateAuthenticator(userStore, certificateEnabled, trustedUserCAKeysFile)
+	if err != nil {
+		return nil, fmt.Errorf("init certificate auth: %w", err)
+	}
+	manager.certificateAuth = certAuth
+
+	return manager, nil
+}
+
+// GetSSHServerConfig returns an SSH server config with the appropriate authentication methods
+func (m *Manager) GetSSHServerConfig() *ssh.ServerConfig {
+	config := &ssh.ServerConfig{}
+
+	// Add password authentication if enabled
+	if m.passwordAuth.Enabled() {
+		config.PasswordCallback = m.passwordAuth.Authenticate
+	}
+
+	// Wire the public-key channel. Certificate auth, when enabled, takes
+	// over the channel entirely (MinIO/OpenSSH-style): plain public keys
+	// are rejected even if "publickey" is also listed in enabledAuthMethods.
+	switch {
+	case m.certificateAuth.Enabled():
+		config.PublicKeyCallback = m.certificateAuth.Authenticate
+	case m.publicKeyAuth.Enabled():
+		config.PublicKeyCallback = m.publicKeyAuth.Authenticate
+	}
+
+	return config
+}
+
+// GetUser retrieves a user from the user store
+func (m *Manager) GetUser(username string) (*user.User, error) {
+	return m.userStore.GetUser(username)
+}

weed/sftpd/auth/auth_test.go

@@ -0,0 +1,79 @@
+package auth
+
+import (
+	"strings"
+	"testing"
+	"time"
+
+	"golang.org/x/crypto/ssh"
+)
+
+// When both "publickey" and "certificate" are enabled, certificate auth takes
+// over the public-key channel: plain keys are rejected, certs are accepted, and
+// password auth stays independently wired.
+func TestManager_CertificateTakesOverPublicKeyChannel(t *testing.T) {
+	env := newTestEnv(t)
+	store := newStubStore("alice")
+
+	mgr, err := NewManager(store, []string{"password", "publickey", "certificate"}, env.caKeyFile)
+	if err != nil {
+		t.Fatalf("NewManager: %v", err)
+	}
+
+	cfg := mgr.GetSSHServerConfig()
+	if cfg.PasswordCallback == nil {
+		t.Fatal("expected password callback to stay wired")
+	}
+	if cfg.PublicKeyCallback == nil {
+		t.Fatal("expected public-key callback")
+	}
+
+	// Plain public key is rejected by the certificate authenticator.
+	if _, err := cfg.PublicKeyCallback(&fakeConnMetadata{user: "alice"}, env.userSigner.PublicKey()); err == nil {
+		t.Fatal("expected plain public key to be rejected")
+	} else if !strings.Contains(err.Error(), "public key without certificate") {
+		t.Fatalf("expected certificate-channel rejection, got %v", err)
+	}
+
+	// A valid cert is accepted.
+	cert := env.signCert(t, ssh.UserCert, []string{"alice"},
+		time.Now().Add(-time.Minute), time.Now().Add(time.Hour))
+	perms, err := cfg.PublicKeyCallback(&fakeConnMetadata{user: "alice"}, cert)
+	if err != nil {
+		t.Fatalf("expected cert to be accepted: %v", err)
+	}
+	if perms.Extensions["username"] != "alice" {
+		t.Fatalf("expected username extension alice, got %q", perms.Extensions["username"])
+	}
+}
+
+// Without "certificate", the public-key channel keeps plain public-key auth.
+func TestManager_PublicKeyOnlyChannel(t *testing.T) {
+	mgr, err := NewManager(newStubStore("alice"), []string{"publickey"}, "")
+	if err != nil {
+		t.Fatalf("NewManager: %v", err)
+	}
+
+	cfg := mgr.GetSSHServerConfig()
+	if cfg.PublicKeyCallback == nil {
+		t.Fatal("expected public-key callback")
+	}
+
+	env := newTestEnv(t)
+	// Routes to plain public-key auth (stub store has no registered key), which
+	// fails with a different error than the certificate channel would.
+	_, err = cfg.PublicKeyCallback(&fakeConnMetadata{user: "alice"}, env.userSigner.PublicKey())
+	if err == nil {
+		t.Fatal("expected authentication failure")
+	}
+	if strings.Contains(err.Error(), "without certificate") {
+		t.Fatalf("certificate auth should not be wired, got %v", err)
+	}
+}
+
+// Enabling certificate auth without a CA keys file is a hard configuration error.
+func TestManager_CertificateRequiresCAFile(t *testing.T) {
+	if _, err := NewManager(newStubStore(), []string{"certificate"}, ""); err == nil {
+		t.Fatal("expected error when certificate auth enabled without CA keys file")
+	}
+}

weed/sftpd/auth/certificate.go

@@ -0,0 +1,150 @@
+package auth
+
+import (
+	"bytes"
+	"crypto/subtle"
+	"errors"
+	"fmt"
+	"os"
+
+	"github.com/seaweedfs/seaweedfs/weed/sftpd/user"
+	"golang.org/x/crypto/ssh"
+)
+
+// CertificateAuthenticator authenticates clients that present an OpenSSH
+// user certificate signed by one of the configured trusted CA public keys.
+//
+// Behaviour mirrors MinIO's --sftp=trusted-user-ca-key option and OpenSSH's
+// TrustedUserCAKeys directive: when enabled, only key blobs of type
+// *ssh.Certificate are accepted on the public-key channel. Plain public
+// keys are rejected. The SSH login username must appear in the cert's
+// ValidPrincipals list and must resolve to an existing user in the store.
+type CertificateAuthenticator struct {
+	userStore  user.Store
+	enabled    bool
+	trustedCAs []ssh.PublicKey
+	checker    *ssh.CertChecker
+}
+
+// NewCertificateAuthenticator constructs a CertificateAuthenticator.
+// When enabled is true, caKeysFile must point to a file containing one or
+// more CA public keys in OpenSSH authorized_keys format (one per line).
+func NewCertificateAuthenticator(userStore user.Store, enabled bool, caKeysFile string) (*CertificateAuthenticator, error) {
+	a := &CertificateAuthenticator{
+		userStore: userStore,
+		enabled:   enabled,
+	}
+
+	if !enabled {
+		return a, nil
+	}
+
+	if caKeysFile == "" {
+		return nil, fmt.Errorf("certificate auth enabled but no trustedUserCAKeysFile provided")
+	}
+
+	cas, err := loadAuthorizedKeysFile(caKeysFile)
+	if err != nil {
+		return nil, fmt.Errorf("load trusted user CA keys from %s: %w", caKeysFile, err)
+	}
+	if len(cas) == 0 {
+		return nil, fmt.Errorf("no trusted user CA keys found in %s", caKeysFile)
+	}
+	a.trustedCAs = cas
+
+	// Pre-marshal trusted CA keys once. IsUserAuthority runs on every
+	// authentication attempt, so caching the marshaled form avoids
+	// repeated allocations on the hot path.
+	trustedCAsMarshaled := make([][]byte, len(cas))
+	for i, ca := range cas {
+		trustedCAsMarshaled[i] = ca.Marshal()
+	}
+
+	a.checker = &ssh.CertChecker{
+		IsUserAuthority: func(auth ssh.PublicKey) bool {
+			marshaled := auth.Marshal()
+			for _, caBytes := range trustedCAsMarshaled {
+				if subtle.ConstantTimeCompare(marshaled, caBytes) == 1 {
+					return true
+				}
+			}
+			return false
+		},
+	}
+
+	return a, nil
+}
+
+// Enabled reports whether certificate authentication is active.
+func (a *CertificateAuthenticator) Enabled() bool {
+	return a.enabled
+}
+
+// Authenticate implements ssh.ServerConfig.PublicKeyCallback.
+func (a *CertificateAuthenticator) Authenticate(conn ssh.ConnMetadata, key ssh.PublicKey) (*ssh.Permissions, error) {
+	if !a.enabled {
+		return nil, fmt.Errorf("certificate authentication disabled")
+	}
+
+	cert, ok := key.(*ssh.Certificate)
+	if !ok {
+		return nil, fmt.Errorf("public key without certificate not allowed")
+	}
+	if cert.CertType != ssh.UserCert {
+		return nil, fmt.Errorf("certificate is not a user certificate")
+	}
+	if len(cert.ValidPrincipals) == 0 {
+		return nil, fmt.Errorf("certificate has no valid principals")
+	}
+
+	username := conn.User()
+
+	// CertChecker.Authenticate verifies the CA signature (via IsUserAuthority),
+	// the ValidAfter/ValidBefore window, and that username is in ValidPrincipals.
+	perms, err := a.checker.Authenticate(conn, key)
+	if err != nil {
+		return nil, fmt.Errorf("certificate validation failed: %w", err)
+	}
+
+	// The SSH login user must exist in the SeaweedFS user store.
+	if _, err := a.userStore.GetUser(username); err != nil {
+		var notFound *user.UserNotFoundError
+		if errors.As(err, &notFound) {
+			return nil, fmt.Errorf("user %q not found", username)
+		}
+		return nil, fmt.Errorf("lookup user %q: %w", username, err)
+	}
+
+	if perms == nil {
+		perms = &ssh.Permissions{}
+	}
+	if perms.Extensions == nil {
+		perms.Extensions = map[string]string{}
+	}
+	perms.Extensions["username"] = username
+	return perms, nil
+}
+
+// loadAuthorizedKeysFile parses an authorized_keys-style file and returns
+// all public keys found in it. Blank lines and comment lines starting with
+// '#' are skipped.
+func loadAuthorizedKeysFile(path string) ([]ssh.PublicKey, error) {
+	data, err := os.ReadFile(path)
+	if err != nil {
+		return nil, err
+	}
+
+	var keys []ssh.PublicKey
+	for _, line := range bytes.Split(data, []byte("\n")) {
+		line = bytes.TrimSpace(line)
+		if len(line) == 0 || line[0] == '#' {
+			continue
+		}
+		pub, _, _, _, err := ssh.ParseAuthorizedKey(line)
+		if err != nil {
+			return nil, err
+		}
+		keys = append(keys, pub)
+	}
+	return keys, nil
+}

weed/sftpd/auth/certificate_test.go

@@ -0,0 +1,312 @@
+package auth
+
+import (
+	"crypto/ed25519"
+	"crypto/rand"
+	"errors"
+	"net"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/sftpd/user"
+	"golang.org/x/crypto/ssh"
+)
+
+// stubStore is a minimal user.Store for auth tests.
+type stubStore struct {
+	users map[string]*user.User
+}
+
+func newStubStore(usernames ...string) *stubStore {
+	s := &stubStore{users: map[string]*user.User{}}
+	for _, name := range usernames {
+		s.users[name] = &user.User{Username: name}
+	}
+	return s
+}
+
+func (s *stubStore) GetUser(username string) (*user.User, error) {
+	if u, ok := s.users[username]; ok {
+		return u, nil
+	}
+	return nil, &user.UserNotFoundError{Username: username}
+}
+func (s *stubStore) ValidatePassword(string, []byte) bool       { return false }
+func (s *stubStore) ValidatePublicKey(string, string) bool      { return false }
+func (s *stubStore) GetUserPermissions(string, string) []string { return nil }
+func (s *stubStore) SaveUser(*user.User) error                  { return nil }
+func (s *stubStore) DeleteUser(string) error                    { return nil }
+func (s *stubStore) ListUsers() ([]string, error)               { return nil, nil }
+
+// fakeConnMetadata satisfies ssh.ConnMetadata for the parts CertChecker uses.
+type fakeConnMetadata struct {
+	user string
+}
+
+func (c *fakeConnMetadata) User() string          { return c.user }
+func (c *fakeConnMetadata) SessionID() []byte     { return []byte("session") }
+func (c *fakeConnMetadata) ClientVersion() []byte { return []byte("SSH-2.0-test") }
+func (c *fakeConnMetadata) ServerVersion() []byte { return []byte("SSH-2.0-test") }
+func (c *fakeConnMetadata) RemoteAddr() net.Addr  { return &fakeAddr{} }
+func (c *fakeConnMetadata) LocalAddr() net.Addr   { return &fakeAddr{} }
+
+type fakeAddr struct{}
+
+func (fakeAddr) Network() string { return "tcp" }
+func (fakeAddr) String() string  { return "127.0.0.1:0" }
+
+// testEnv bundles a CA, a user signer, and a temp dir for a single test.
+type testEnv struct {
+	caSigner   ssh.Signer
+	userSigner ssh.Signer
+	caKeyFile  string
+}
+
+func newTestEnv(t *testing.T) *testEnv {
+	t.Helper()
+
+	_, caPriv, err := ed25519.GenerateKey(rand.Reader)
+	if err != nil {
+		t.Fatalf("ed25519 CA: %v", err)
+	}
+	caSigner, err := ssh.NewSignerFromKey(caPriv)
+	if err != nil {
+		t.Fatalf("ca signer: %v", err)
+	}
+
+	_, userPriv, err := ed25519.GenerateKey(rand.Reader)
+	if err != nil {
+		t.Fatalf("ed25519 user: %v", err)
+	}
+	userSigner, err := ssh.NewSignerFromKey(userPriv)
+	if err != nil {
+		t.Fatalf("user signer: %v", err)
+	}
+
+	dir := t.TempDir()
+	caFile := filepath.Join(dir, "ca_user.pub")
+	if err := os.WriteFile(caFile, ssh.MarshalAuthorizedKey(caSigner.PublicKey()), 0o600); err != nil {
+		t.Fatalf("write ca file: %v", err)
+	}
+
+	return &testEnv{caSigner: caSigner, userSigner: userSigner, caKeyFile: caFile}
+}
+
+// signCert produces a user cert signed by the test CA.
+func (e *testEnv) signCert(t *testing.T, certType uint32, principals []string, validAfter, validBefore time.Time) *ssh.Certificate {
+	t.Helper()
+	cert := &ssh.Certificate{
+		Key:             e.userSigner.PublicKey(),
+		CertType:        certType,
+		ValidPrincipals: principals,
+		ValidAfter:      uint64(validAfter.Unix()),
+		ValidBefore:     uint64(validBefore.Unix()),
+	}
+	if err := cert.SignCert(rand.Reader, e.caSigner); err != nil {
+		t.Fatalf("sign cert: %v", err)
+	}
+	return cert
+}
+
+func TestCertificateAuthenticator_GoldenPath(t *testing.T) {
+	env := newTestEnv(t)
+	store := newStubStore("alice")
+
+	a, err := NewCertificateAuthenticator(store, true, env.caKeyFile)
+	if err != nil {
+		t.Fatalf("new: %v", err)
+	}
+
+	cert := env.signCert(t, ssh.UserCert, []string{"alice"},
+		time.Now().Add(-time.Minute), time.Now().Add(time.Hour))
+
+	perms, err := a.Authenticate(&fakeConnMetadata{user: "alice"}, cert)
+	if err != nil {
+		t.Fatalf("Authenticate: %v", err)
+	}
+	if perms.Extensions["username"] != "alice" {
+		t.Fatalf("expected username extension alice, got %q", perms.Extensions["username"])
+	}
+}
+
+func TestCertificateAuthenticator_RejectsPlainPublicKey(t *testing.T) {
+	env := newTestEnv(t)
+	store := newStubStore("alice")
+
+	a, err := NewCertificateAuthenticator(store, true, env.caKeyFile)
+	if err != nil {
+		t.Fatalf("new: %v", err)
+	}
+
+	_, err = a.Authenticate(&fakeConnMetadata{user: "alice"}, env.userSigner.PublicKey())
+	if err == nil {
+		t.Fatal("expected rejection of plain public key, got nil")
+	}
+	if !strings.Contains(err.Error(), "public key without certificate") {
+		t.Fatalf("unexpected error: %v", err)
+	}
+}
+
+func TestCertificateAuthenticator_RejectsHostCert(t *testing.T) {
+	env := newTestEnv(t)
+	store := newStubStore("alice")
+	a, _ := NewCertificateAuthenticator(store, true, env.caKeyFile)
+
+	cert := env.signCert(t, ssh.HostCert, []string{"alice"},
+		time.Now().Add(-time.Minute), time.Now().Add(time.Hour))
+
+	if _, err := a.Authenticate(&fakeConnMetadata{user: "alice"}, cert); err == nil {
+		t.Fatal("expected rejection of host cert, got nil")
+	}
+}
+
+func TestCertificateAuthenticator_RejectsEmptyPrincipals(t *testing.T) {
+	env := newTestEnv(t)
+	store := newStubStore("alice")
+	a, _ := NewCertificateAuthenticator(store, true, env.caKeyFile)
+
+	cert := env.signCert(t, ssh.UserCert, nil,
+		time.Now().Add(-time.Minute), time.Now().Add(time.Hour))
+
+	_, err := a.Authenticate(&fakeConnMetadata{user: "alice"}, cert)
+	if err == nil || !strings.Contains(err.Error(), "no valid principals") {
+		t.Fatalf("expected empty-principals rejection, got %v", err)
+	}
+}
+
+func TestCertificateAuthenticator_RejectsWrongPrincipal(t *testing.T) {
+	env := newTestEnv(t)
+	store := newStubStore("alice", "bob")
+	a, _ := NewCertificateAuthenticator(store, true, env.caKeyFile)
+
+	cert := env.signCert(t, ssh.UserCert, []string{"bob"},
+		time.Now().Add(-time.Minute), time.Now().Add(time.Hour))
+
+	if _, err := a.Authenticate(&fakeConnMetadata{user: "alice"}, cert); err == nil {
+		t.Fatal("expected wrong-principal rejection, got nil")
+	}
+}
+
+func TestCertificateAuthenticator_RejectsExpiredCert(t *testing.T) {
+	env := newTestEnv(t)
+	store := newStubStore("alice")
+	a, _ := NewCertificateAuthenticator(store, true, env.caKeyFile)
+
+	cert := env.signCert(t, ssh.UserCert, []string{"alice"},
+		time.Now().Add(-2*time.Hour), time.Now().Add(-time.Hour))
+
+	if _, err := a.Authenticate(&fakeConnMetadata{user: "alice"}, cert); err == nil {
+		t.Fatal("expected expired-cert rejection, got nil")
+	}
+}
+
+func TestCertificateAuthenticator_RejectsUnknownCA(t *testing.T) {
+	env := newTestEnv(t)
+	store := newStubStore("alice")
+	a, _ := NewCertificateAuthenticator(store, true, env.caKeyFile)
+
+	// Sign with a different CA.
+	_, otherCAPriv, _ := ed25519.GenerateKey(rand.Reader)
+	otherCASigner, _ := ssh.NewSignerFromKey(otherCAPriv)
+
+	cert := &ssh.Certificate{
+		Key:             env.userSigner.PublicKey(),
+		CertType:        ssh.UserCert,
+		ValidPrincipals: []string{"alice"},
+		ValidAfter:      uint64(time.Now().Add(-time.Minute).Unix()),
+		ValidBefore:     uint64(time.Now().Add(time.Hour).Unix()),
+	}
+	if err := cert.SignCert(rand.Reader, otherCASigner); err != nil {
+		t.Fatalf("sign: %v", err)
+	}
+
+	if _, err := a.Authenticate(&fakeConnMetadata{user: "alice"}, cert); err == nil {
+		t.Fatal("expected unknown-CA rejection, got nil")
+	}
+}
+
+func TestCertificateAuthenticator_RejectsUnknownUser(t *testing.T) {
+	env := newTestEnv(t)
+	store := newStubStore() // no users
+	a, _ := NewCertificateAuthenticator(store, true, env.caKeyFile)
+
+	cert := env.signCert(t, ssh.UserCert, []string{"alice"},
+		time.Now().Add(-time.Minute), time.Now().Add(time.Hour))
+
+	_, err := a.Authenticate(&fakeConnMetadata{user: "alice"}, cert)
+	if err == nil || !strings.Contains(err.Error(), "not found") {
+		t.Fatalf("expected user-not-found, got %v", err)
+	}
+}
+
+func TestCertificateAuthenticator_LoadsMultipleCAKeys(t *testing.T) {
+	env := newTestEnv(t)
+
+	// Append a second CA pubkey to the file.
+	_, ca2Priv, _ := ed25519.GenerateKey(rand.Reader)
+	ca2Signer, _ := ssh.NewSignerFromKey(ca2Priv)
+	f, err := os.OpenFile(env.caKeyFile, os.O_APPEND|os.O_WRONLY, 0)
+	if err != nil {
+		t.Fatalf("open: %v", err)
+	}
+	if _, err := f.Write(ssh.MarshalAuthorizedKey(ca2Signer.PublicKey())); err != nil {
+		t.Fatalf("write: %v", err)
+	}
+	f.Close()
+
+	store := newStubStore("alice")
+	a, err := NewCertificateAuthenticator(store, true, env.caKeyFile)
+	if err != nil {
+		t.Fatalf("new: %v", err)
+	}
+	if len(a.trustedCAs) != 2 {
+		t.Fatalf("expected 2 CAs, got %d", len(a.trustedCAs))
+	}
+
+	// A cert signed by the second CA should be accepted.
+	cert := &ssh.Certificate{
+		Key:             env.userSigner.PublicKey(),
+		CertType:        ssh.UserCert,
+		ValidPrincipals: []string{"alice"},
+		ValidAfter:      uint64(time.Now().Add(-time.Minute).Unix()),
+		ValidBefore:     uint64(time.Now().Add(time.Hour).Unix()),
+	}
+	if err := cert.SignCert(rand.Reader, ca2Signer); err != nil {
+		t.Fatalf("sign: %v", err)
+	}
+	if _, err := a.Authenticate(&fakeConnMetadata{user: "alice"}, cert); err != nil {
+		t.Fatalf("Authenticate with second CA: %v", err)
+	}
+}
+
+func TestNewCertificateAuthenticator_DisabledIgnoresFile(t *testing.T) {
+	a, err := NewCertificateAuthenticator(newStubStore(), false, "")
+	if err != nil {
+		t.Fatalf("new: %v", err)
+	}
+	if a.Enabled() {
+		t.Fatal("expected disabled")
+	}
+}
+
+func TestNewCertificateAuthenticator_EnabledRequiresFile(t *testing.T) {
+	_, err := NewCertificateAuthenticator(newStubStore(), true, "")
+	if err == nil {
+		t.Fatal("expected error when enabled without file")
+	}
+}
+
+func TestNewCertificateAuthenticator_MissingFile(t *testing.T) {
+	_, err := NewCertificateAuthenticator(newStubStore(), true, filepath.Join(t.TempDir(), "nope.pub"))
+	if err == nil {
+		t.Fatal("expected error for missing file")
+	}
+	// Sanity: not a not-found-user-style error.
+	var notFound *user.UserNotFoundError
+	if errors.As(err, &notFound) {
+		t.Fatalf("unexpected error type: %v", err)
+	}
+}

weed/sftpd/auth/password.go

@@ -0,0 +1,53 @@
+package auth
+
+import (
+	"fmt"
+	"math/rand/v2"
+	"time"
+
+	"github.com/seaweedfs/seaweedfs/weed/sftpd/user"
+	"golang.org/x/crypto/ssh"
+)
+
+// PasswordAuthenticator handles password-based authentication
+type PasswordAuthenticator struct {
+	userStore user.Store
+	enabled   bool
+}
+
+// NewPasswordAuthenticator creates a new password authenticator
+func NewPasswordAuthenticator(userStore user.Store, enabled bool) *PasswordAuthenticator {
+	return &PasswordAuthenticator{
+		userStore: userStore,
+		enabled:   enabled,
+	}
+}
+
+// Enabled returns whether password authentication is enabled
+func (a *PasswordAuthenticator) Enabled() bool {
+	return a.enabled
+}
+
+// Authenticate validates a password for a user
+func (a *PasswordAuthenticator) Authenticate(conn ssh.ConnMetadata, password []byte) (*ssh.Permissions, error) {
+	username := conn.User()
+
+	// Check if password auth is enabled
+	if !a.enabled {
+		return nil, fmt.Errorf("password authentication disabled")
+	}
+
+	// Validate password against user store
+	if a.userStore.ValidatePassword(username, password) {
+		return &ssh.Permissions{
+			Extensions: map[string]string{
+				"username": username,
+			},
+		}, nil
+	}
+
+	// Add delay to prevent brute force attacks
+	time.Sleep(time.Duration(100+rand.IntN(100)) * time.Millisecond)
+
+	return nil, fmt.Errorf("authentication failed")
+}

weed/sftpd/auth/publickey.go

@@ -0,0 +1,51 @@
+package auth
+
+import (
+	"fmt"
+
+	"github.com/seaweedfs/seaweedfs/weed/sftpd/user"
+	"golang.org/x/crypto/ssh"
+)
+
+// PublicKeyAuthenticator handles public key-based authentication
+type PublicKeyAuthenticator struct {
+	userStore user.Store
+	enabled   bool
+}
+
+// NewPublicKeyAuthenticator creates a new public key authenticator
+func NewPublicKeyAuthenticator(userStore user.Store, enabled bool) *PublicKeyAuthenticator {
+	return &PublicKeyAuthenticator{
+		userStore: userStore,
+		enabled:   enabled,
+	}
+}
+
+// Enabled returns whether public key authentication is enabled
+func (a *PublicKeyAuthenticator) Enabled() bool {
+	return a.enabled
+}
+
+// Authenticate validates a public key for a user
+func (a *PublicKeyAuthenticator) Authenticate(conn ssh.ConnMetadata, key ssh.PublicKey) (*ssh.Permissions, error) {
+	username := conn.User()
+
+	// Check if public key auth is enabled
+	if !a.enabled {
+		return nil, fmt.Errorf("public key authentication disabled")
+	}
+
+	// Convert key to string format for comparison
+	keyData := string(key.Marshal())
+
+	// Validate public key
+	if a.userStore.ValidatePublicKey(username, keyData) {
+		return &ssh.Permissions{
+			Extensions: map[string]string{
+				"username": username,
+			},
+		}, nil
+	}
+
+	return nil, fmt.Errorf("authentication failed")
+}