yuvipanda / jupyterhub-ssh

SSH Access to JupyterHubs
BSD 3-Clause "New" or "Revised" License
96 stars 29 forks source link

Password rejected by jupyterhub-sftp - my debugging journey #58

Closed consideRatio closed 3 years ago

consideRatio commented 3 years ago

I've created a JupyterHub API token at /hub/token to be used as a password and that works fine for use with the jupyterhub-ssh service, but when I try to use the jupyterhub-sftp service I run into this issue.

$ sftp -P 2222 consideratio@hub.jupytearth.org 

consideratio@hub.jupytearth.org's password: 
Permission denied, please try again.

The logs of jupyterhub-sftp say the following when I make an attempt that fails and then close the connection.

Server listening on 0.0.0.0 port 2222.
Server listening on :: port 2222.
Failed password for consideratio from 192.168.3.79 port 56602 ssh2
Connection closed by authenticating user consideratio 192.168.3.79 port 56602 [preauth]

I realized that I could try to modify the python script to print messages or write to a file.

def valid_user(hub_url, username, token):
    """
    Check if token is valid for username in hub at hub_url
    """
    # FIXME: Construct this URL better? 
    url = f'{hub_url}/hub/api/user'
    headers = {
        'Authorization': f'token {token}'
    }
    resp = requests.get(url, headers=headers)

    f = open("/tmp/logs.txt", "a")
    f.write("valid_user was called\n")
    f.write(f"hub_url: {hub_url}, username: {username}, token: {token}\n")
    f.write(f"resp.status_code: {resp.status_code}\n")
    f.close()

    return resp.status_code == 200

Looking for my logs.txt file inside /tmp I instead find debug.log.

# cat /tmp/debug.log 

*** Wed Aug 11 14:07:28 2021

debug.log is generated due to this...

https://github.com/yuvipanda/jupyterhub-ssh/blob/b7ecf602cd136ed4403be3e4d178501fd0901716/jupyterhub-sftp/etc/pam.d/common-auth#L1-L6

I modify the python script locally to conclude that it is never being executed. And finally, I realize that #46 made the following line cause problems.

https://github.com/yuvipanda/jupyterhub-ssh/blob/b7ecf602cd136ed4403be3e4d178501fd0901716/jupyterhub-sftp/jupyterhub-token-verify.py#L1

By instead making that line become the following, everything started working out as it should!

#!/usr/bin/python3