ssh-client-wrapper 3.1.2 → 3.1.3

package/README.md

@@ -56,7 +56,7 @@ Creates a new SSH client instance.
     *   `host` (string): The hostname or IP address of the server.
     *   `user` (string): The username for authentication.
     *   `port` (number, optional): The port number. Defaults to 22.
-    *   `password` (string | Function, optional): The password for authentication, or a function that returns the password.
+    *   `password` (string | Function, optional): The password for authentication, or a function that returns the password. See [Wrong password](#wrong-password).
     *   `keyFile` (string, optional): The path to the private key file for key-based authentication.
     *   `passphrase` (string | Function, optional): The passphrase for the private key, or a function that returns it.
     *   `noStrictHostKeyChecking` (boolean, optional): If `true`, bypasses strict host key checking.
@@ -190,6 +190,15 @@ Checks if a connection to the remote host can be established.
 
 *   Returns: `Promise<boolean>` - Resolves with `true` on success.
 
+### Wrong password
+
+If the login is refused, the promise is rejected with an `Error` whose `message` is `Permission denied` and whose `code` is `AUTH_FAILED`. `host`, `user` and `port` tell which login failed.
+
+*   `password` / `passphrase` given as a **string**: ssh is asked to try only once (`-oNumberOfPasswordPrompts=1`), because sending the same wrong string again can not succeed (and may lock the account). The promise is rejected at once.
+*   `password` / `passphrase` given as a **function**: the function is called each time ssh asks (up to three times, the ssh default), so that it can ask the user again and return another value. If none of them is accepted the promise is rejected as above.
+
+Whether to ask the user again after an `AUTH_FAILED` is up to the application.
+
 ### `.disconnect()`
 Closes the master SSH connection to the remote host.
 

package/lib/sshExec.js

@@ -205,7 +205,12 @@ export async function connect(hostInfo, timeout = 60) {
         done = true;
         resolve();
       } else if (/Permission denied \(/.test(output)) {
-        reject(new Error("Permission denied"));
+        const err = new Error("Permission denied");
+        err.code = "AUTH_FAILED";
+        err.host = hostInfo.host;
+        err.user = hostInfo.user;
+        err.port = hostInfo.port;
+        reject(err);
       } else if (/Could not resolve hostname/.test(output)) {
         reject(new Error("Could not resolve hostname"));
       } else if (/Bad port/.test(output)) {
@@ -251,6 +256,14 @@ export async function connect(hostInfo, timeout = 60) {
   try {
     await p;
     debug(`connected to ${hostInfo.host}`);
+  } catch (e) {
+    //the pty of a failed connection must not be left behind. It keeps the process alive.
+    debug(`failed to connect to ${hostInfo.host}, kill master pty`);
+    if (hostInfo.masterPty) {
+      hostInfo.masterPty.kill();
+      hostInfo.masterPty = null;
+    }
+    throw e;
   } finally {
     if (ac !== null) {
       ac.abort();

package/lib/util.js

@@ -155,6 +155,20 @@ export const sanityCheck = (hostInfo)=>{
   return hostInfo;
 };
 
+/**
+ * check if the password and the passphrase can not change between the prompts of ssh
+ * @param {object} hostInfo - host information object defined in index.js
+ * @returns {boolean} - true if at least one of them is a string and none of them is a function
+ */
+function hasFixedSecret(hostInfo) {
+  const secrets = [hostInfo.password, hostInfo.passphrase];
+  return secrets.some((e)=>{
+    return typeof e === "string";
+  }) && !secrets.some((e)=>{
+    return typeof e === "function";
+  });
+}
+
 function getControlPersistDir(hostInfo) {
   for (const candidate of [hostInfo.ControlPersistDir, process.env.SSH_CONTROL_PERSIST_DIR]) {
     if (typeof candidate === "string") {
@@ -237,6 +251,11 @@ export const getSshOption = (hostInfo, withoutDestination)=>{
   if (Number.isInteger(hostInfo.ConnectTimeout) && hostInfo.ConnectTimeout > 0) {
     args.push(`-oConnectTimeout=${hostInfo.ConnectTimeout}`);
   }
+  //ssh asks three times by default. If the secret is a fixed string, asking again with the same string is
+  //of no use. A function can give another secret each time, so it keeps the default.
+  if (hasFixedSecret(hostInfo)) {
+    args.push("-oNumberOfPasswordPrompts=1");
+  }
   if (Array.isArray(hostInfo.sshOpt)) {
     args.push(...hostInfo.sshOpt.filter((e)=>{
       return typeof e === "string";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ssh-client-wrapper",
-  "version": "3.1.2",
+  "version": "3.1.3",
   "description": "wrapper library for open ssh client and rsync",
   "keywords": [
     "ssh",