WO2017080334A1

WO2017080334A1 - Login method and login system based on open-source secure shell protocol

Info

Publication number: WO2017080334A1
Application number: PCT/CN2016/101392
Authority: WO
Inventors: 李智荣
Original assignee: 上海斐讯数据通信技术有限公司
Priority date: 2015-11-13
Filing date: 2016-09-30
Publication date: 2017-05-18
Also published as: CN105282175A; CN105282175B

Abstract

Provided are a login method and login system based on an open-source secure shell protocol. The login method based on an open-source secure shell protocol comprises the following steps: sending system user information to an open-source secure shell protocol application module; a Linux kernel module verifying the system user information; and after the system user information passes the verification of a Linux kernel, executing a redirection application module to realize login. By means of the login method and login system of the present invention, redirection is performed twice by a redirection application module, and the login of an SSH user is realized without needing to modify an open-source SSH source code; therefore, costs for subsequent upgrade or operation and maintenance are greatly reduced.

Description

Login method and login system based on open source secure shell protocol

The present application claims the priority of the Chinese Patent Application No. 201510778846.

Technical field

The present invention relates to the field of communications technologies, and in particular, to a login method and a login system based on an open source secure shell protocol.

Background technique

Secure Shell (SSH) is currently a reliable protocol that provides security for remote login sessions and other network services. The SSH protocol can not only effectively prevent information leakage during remote management, but also compress the transmitted data and speed up the transmission. SSH has many functions. It can replace Telnet and provide a secure "channel" for FTP, PoP, and even PPP.

Network equipment systems such as switches have their own custom command-line interface (CLI) configuration interface. When the user logs in through SSH, he enters the customized CLI configuration interface of the embedded device system, instead of the shell interface of the Linux system.

At present, in addition to a few companies with strong R&D capabilities, they will implement the SSH protocol themselves. Most of the network equipment R&D vendors are based on open source SSH software (such as OpenSSH), and adapt their own systems to modify the source code of open source software. Implement SSH user authentication login function.

However, if the company realizes the development of the SSH protocol and does not use open source software, this research and development has been successful, and it is only suitable for a few companies with certain research and development capabilities. Many companies use open source SSH software (such as OpenSSH) to adapt their own systems to modify the source code of open source software to implement SSH user authentication login function. However, at present, because of the need to modify the open source software source code, it is necessary to learn the source code of the open source software, and the cost of upgrading the open source software version or replacing the open source software and system maintenance personnel is high.

Therefore, how to implement the login function of the SSH user on the basis of no increase in cost has become one of the problems to be solved by those skilled in the art.

Summary of the invention

In view of the above disadvantages of the prior art, it is an object of the present invention to provide a host based on an open source secure shell protocol. The recording method and the login system are used to solve the problem of high cost of implementing the SSH user login function in the prior art.

To achieve the above and other related objects, the present invention provides a login method based on an open source secure shell protocol, and the login method based on an open source secure shell protocol includes the following steps: sending system user information to an open source secure shell protocol application module; The kernel module verifies the system user information; after the Linux kernel verifies the system user information, the redirect application module is executed to implement login.

In an embodiment of the invention, the step of executing the redirecting application module to implement the login comprises: establishing a redirected SSH connection between the redirected application module and the Linux kernel; and in the redirecting the application module and the prefabrication A TCP connection is established between the command line interfaces to implement login.

In an embodiment of the invention, a long TCP connection is established between the redirected application module and the pre-made command line interface.

In an embodiment of the present invention, the login method based on the open source secure shell protocol further includes: adding system user information to the Linux kernel after logging in to the Linux system, where the system user information includes: a username and a password.

In an embodiment of the invention, the step of adding system user information to the Linux kernel includes: the Linux kernel saving the system user information in the /etc/shadow and /etc/passwd folders.

In an embodiment of the present invention, when the Linux kernel saves the system user information in the /etc/passwd folder, the execution program of the system user information verification is specified in the /etc/passwd folder. Redirect application module.

The invention provides a login system based on an open source secure shell protocol, and the login system based on the open source secure shell protocol comprises: an open source secure shell protocol application module for receiving system user information; and a Linux kernel for the system user The information is verified; the application module is redirected, and after the Linux system verifies the user information of the system, the redirection application module is executed to implement login.

In an embodiment of the present invention, the redirecting application module includes: a first redirecting unit, configured to establish a redirected SSH connection between the redirected application module and a Linux system kernel; and a second redirecting unit, Used to establish a TCP connection between the redirected application module and the pre-made command line interface to implement login.

In an embodiment of the invention, the second redirecting unit establishes a long TCP connection between the redirected application module and the pre-made command line interface.

In an embodiment of the present invention, the login system based on the open source secure shell protocol further includes: a user information adding module, configured to add system user information to the Linux kernel after logging in to the Linux system, where the system user information includes :user name and password.

As described above, the login method and login system based on the open source secure shell protocol of the present invention have the following beneficial effects:

The login method based on the open source secure shell protocol of the present invention, after the Linux kernel verifies the system user information, By redirecting the application module to achieve login, there is no need to modify the source code of the open source software, thus greatly reducing the cost of subsequent upgrades or system maintenance.

DRAWINGS

FIG. 1 is a schematic flowchart showing an embodiment of a login method based on an open source secure shell protocol according to an embodiment of the present invention.

FIG. 2 is a schematic structural diagram of an embodiment of a login system based on an open source secure shell protocol according to the present invention.

Component label description

2 Login system based on open source secure shell protocol

21 Open Source Secure Shell Protocol Application Module

22 Linux kernel

23 redirect application module

S11~S13 steps

detailed description

The embodiments of the present invention are described below by way of specific examples, and those skilled in the art can readily understand other advantages and effects of the present invention from the disclosure of the present disclosure. The present invention may be embodied or applied in various other specific embodiments, and various modifications and changes can be made without departing from the spirit and scope of the invention. It should be noted that the features in the following embodiments and embodiments may be combined with each other without conflict.

It should be noted that the illustrations provided in the following embodiments merely illustrate the basic concept of the present invention in a schematic manner, and only the components related to the present invention are shown in the drawings, rather than the number and shape of components in actual implementation. Dimensional drawing, the actual type of implementation of each component's type, number and proportion can be a random change, and its component layout can be more complicated.

As described in the background art, when logging in via SSH, either the SSH protocol is developed by itself or the open source SSH software is used, but in either case, the development cost is high and the scope of the application is very limited.

Referring to FIG. 1, the present invention provides a login method based on an open source secure shell protocol, and the login method based on an open source secure shell protocol includes the following steps:

S11, sending system user information to an open source secure shell protocol application module;

S12. The Linux kernel module verifies the system user information.

S13. After the Linux kernel verifies the user information of the system, the redirect application module is executed to implement login.

Specifically, the user requests an SSH connection with OpenSSH through an SSH client software (such as SecureCRT), and sends an SSH username and password to OpenSSH during this process.

OpenSSH queries Linux for the existence of the username and the correct password for the username. If it is incorrect, the user's connection request is rejected. Otherwise, the next step is processed. Specifically, the Linux kernel (linux kernel) verifies the username and password.

After learning that the user authentication has passed, OpenSSH executes the RdirectIO application (the application is a pre-developed redirect application module). OpenSSH redirects when RdirectIO is executed, thus enabling SSH user login. RdirectIO is an application that needs to be implemented in this embodiment, and its function refers to the following description.

In this embodiment, the step of executing the redirecting application module to implement the login includes: establishing a redirected SSH connection between the redirected application module and the Linux kernel; and the redirecting application module and the pre-made command line interface Establish a TCP connection to implement login. Specifically, a long TCP connection is established between the redirect application module and the pre-made command line interface.

In practice, OpenSSH creates a pipe when it executes RdirectIO. Through this pipeline, RdirectIO's standard IO will be redirected to the ssh connection. At the same time, RdirectIO establishes a tcp connection with the system customization CLI to redirect the standard IO of RdirectIO to this tcp connection.

That is, the function of RdirectIO is to redirect the input of the system custom CLI to the RdirectIO standard output; likewise, redirect the standard input of RdirectIO to the output of the system custom CLI, so that it can be established between the system customization CLI and RdirectIO. TCP long connection to achieve the IO redirection function here.

Specifically, the implementation code of the RdirectIO is:

After the SSH user logs in to the system through SSH authentication, the data entered on the SSH client (such as SecureCRT) is redirected to the system CLI interface twice; otherwise, the system customizes the CLI input. The data is also redirected to the SSH client twice.

Although the data entered by the user on the SSH connection is first decrypted by OpenSSH, the decrypted data is redirected twice to reach the system customization CLI. However, in the system's perception of the user, the user directly enters the system customization CLI interface. In the perception of the system user, the user is directly logged into the system customization CLI interface.

In the embodiment, the login method based on the open source secure shell protocol further includes: adding system user information to the Linux kernel after logging in to the Linux system, where the system user information includes: a user Name and password.

Specifically, the step of adding system user information to the Linux kernel includes: the Linux kernel saving the system user information in the /etc/shadow and /etc/passwd folders. At the same time, when the Linux kernel saves the system user information in the /etc/passwd folder, the execution program after the system user information verification is specified in the /etc/passwd folder is the redirect application module.

In practical applications, the open source OpenSSH user authentication is to verify the correctness of the username and password to the Linux kernel. The user logs in to the system through the serial port and adds the same user name and password to the Linux kernel when adding an SSH user to the system. The Linux system saves the system user and its password in two files "/etc/shadow" and "/etc/passwd".

For example, the user adds a user named admin to the switch. When the switch system adds the user to its own configuration file, it adds a system user named admin to the Linux kernel. After the system user increases successfully, a record is added to each of the two files "/etc/shadow" and "/etc/passwd". When adding the admin user's record to the "/etc/passwd" file, the content after the last ":" is the application that OpenSSH will execute after determining that the username and password are correct. The RdirectIO application is filled in here.

Specifically, the implementation code of the shadow file is:

#cat/etc/shadow

Root: 5Gg.mRfhg Iz4g: 10925:0:99999:7:::

Sshd:kVsqISda3pms.:0:0:99999:7:::

Admin:IjU5ugwlS2HnY:15357:0:99999:7:::

#

The implementation code for the passwd file is:

#cat/etc/passwd

Root:x:0:0:root:/root? /bin/sh

Sshd:x:1000:1000:sshd privsep:/var/empty:/bin/ssh

Admin:x:1001:1001:Linux User,,,:/home:/mnt/app/RdirectIO

#

OpenSSH creates a pipe between OpenSSH and RdirectIO when executing the RdirectIO application. The data entered by the user on the SSH client (such as SecureCRT) is decrypted by OpenSSH and directly reaches RdirectIO through this pipe. In turn, the standard output of RdirectIO is also encrypted by OpenSSH through this pipe and output to the SSH client. The processing here is done by OpenSSH open source software, and there is no need to modify the OpenSSH source code.

The login method based on the open source secure shell protocol in this embodiment performs two redirections through the pre-made redirection application module, thereby implementing login of the SSH user, and does not require open source SSH source code, thereby greatly reducing subsequent upgrade or operation and maintenance. the cost of.

The present invention provides a login system based on an open source secure shell protocol. Referring to FIG. 2, the login system based on the open source secure shell protocol includes:

An open source secure shell protocol application module 21 for receiving system user information;

a Linux kernel 22, configured to verify user information of the system;

The redirecting application module 23 is configured to execute the redirecting application module to implement login after the Linux system verifies the system user information.

In this embodiment, the redirection application module 23 includes: a first redirection unit and a second redirection unit (not shown), where the first redirection unit is used in the redirection application module A redirected SSH connection is established between the kernels of the Linux system; the second redirecting unit is configured to establish a TCP connection between the redirected application module and the pre-made command line interface to implement login. Specifically, the second redirecting unit establishes a long TCP connection between the redirected application module and the pre-made command line interface.

In this embodiment, the login system based on the open source secure shell protocol further includes: a user information adding module, configured to add system user information to the Linux kernel after logging in to the Linux system, where the system user information includes: a username And password.

For a specific implementation process of the login system based on the open source security shell protocol in this embodiment, refer to the foregoing detailed description of the login method based on the open source secure shell protocol, and details are not described herein again.

In summary, the login method and the login system based on the open source secure shell protocol of the present invention use the pre-made redirection module to implement two redirections, thereby implementing login of the SSH user, and does not need to modify the open source SSH source code, thereby greatly reducing The cost of subsequent upgrades and operational maintenance. Therefore, the present invention effectively overcomes various shortcomings in the prior art and has high industrial utilization value.

The above-described embodiments are merely illustrative of the principles of the invention and its effects, and are not intended to limit the invention. Modifications or variations of the above-described embodiments may be made by those skilled in the art without departing from the spirit and scope of the invention. Therefore, all equivalent modifications or changes made by those skilled in the art without departing from the spirit and scope of the invention will be covered by the appended claims.

Claims

A login method based on an open source secure shell protocol, characterized in that the login method based on the open source secure shell protocol comprises the following steps:

Send system user information to the open source secure shell protocol application module;

The Linux kernel module verifies the system user information;

After the Linux kernel verifies the user information of the system, the redirect application module is executed to implement the login.
The method for logging in based on the open source secure shell protocol according to claim 1, wherein the step of executing the redirecting application module to implement the login comprises:

Establishing a redirected SSH connection between the redirected application module and the Linux kernel;

A TCP connection is established between the redirected application module and the pre-made command line interface to implement login.
The login method based on the open source secure shell protocol of claim 2, wherein a long TCP connection is established between the redirected application module and the pre-made command line interface.
The method for logging in based on the open source secure shell protocol according to claim 1, further comprising: adding system user information to the Linux kernel after logging in to the Linux system, the system user information comprising: a username and a password.
The login method based on the open source secure shell protocol according to claim 4, wherein the step of adding system user information to the Linux kernel comprises: the Linux kernel saving the system user information in /etc/shadow and / In the etc/passwd folder.
The login method based on the open source secure shell protocol according to claim 5, wherein the Linux kernel specifies the system user information in the /etc/passwd folder, and specifies in the /etc/passwd folder. The execution program after the system user information is verified is the redirect application module.
A login system based on an open source secure shell protocol, characterized in that the login system based on the open source secure shell protocol comprises:

An open source secure shell protocol application module for receiving system user information;

a Linux kernel for verifying user information of the system;

The redirecting application module is configured to execute the redirecting application module to implement login after the Linux system verifies the user information of the system.
The login system based on the open source secure shell protocol of claim 7, wherein the redirecting application module comprises:

a first redirecting unit, configured to establish a redirected SSH connection between the redirected application module and a Linux system kernel;

And a second redirecting unit, configured to establish a TCP connection between the redirected application module and the pre-made command line interface to implement login.
The login system based on the open source secure shell protocol of claim 8, wherein the second redirecting unit establishes a long TCP connection between the redirected application module and the pre-made command line interface.
The login system based on the open source secure shell protocol of claim 7, further comprising: a user information adding module, configured to add system user information to the Linux kernel after logging in to the Linux system, the system user information Includes: username and password.