Why [e-mail] is following user authentication?

[Alon Bar-Lev]

Hello,

This hostkeys extension is great, reading[1]:
"""
OpenSSH supports a protocol extension allowing a server to inform a
client of all its protocol v.2 host keys after user-authentication has
completed.
"""

I wonder, why should user authentication be completed before this
functionality is available? This means that ssh-keyscan tool (for
example) cannot take advantage of the functionality.

The only reason I could think of (apart of sshd internal
implementation ordering) is to avoid cpu load attack of anonymous
clients forcing server to perform expensive operations.

However, a similar attack can be achieved by multiple connections and/or re-kex.

In sshd.c I see hostkeys-***@openssh.com sent before calling
do_authenticated(), so I even more curios.

Thanks!
Alon Bar-Lev.

[1] https://github.com/openssh/openssh-portable/blob/master/PROTOCOL#L284

[Damien Miller]

Post by Alon Bar-Lev
Hello,
"""
OpenSSH supports a protocol extension allowing a server to inform a
client of all its protocol v.2 host keys after user-authentication has
completed.
"""
I wonder, why should user authentication be completed before this
functionality is available? This means that ssh-keyscan tool (for
example) cannot take advantage of the functionality.

It's done this way because the only extensible messages in the protocol
are channel and global requests, which are only valid after the
"ssh-connection" (channels) service has been requested. This only happens
after userauth.

It would be better to do it after key exchange and before user
authentication, but it would also be less compatible with other
implementations.

-d

[Alon Bar-Lev]

Post by Damien Miller

Post by Alon Bar-Lev
Hello,
"""
OpenSSH supports a protocol extension allowing a server to inform a
client of all its protocol v.2 host keys after user-authentication has
completed.
"""
I wonder, why should user authentication be completed before this
functionality is available? This means that ssh-keyscan tool (for
example) cannot take advantage of the functionality.

It's done this way because the only extensible messages in the protocol
are channel and global requests, which are only valid after the
"ssh-connection" (channels) service has been requested. This only happens
after userauth.
It would be better to do it after key exchange and before user
authentication, but it would also be less compatible with other
implementations.
-d

Thank you for quick response!
I was under the impression that global requests can be sent before
user authentication.