sshfs cannot handle passwords longer than 64 characters from stdin
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
sshfs-fuse (Ubuntu) |
Confirmed
|
Wishlist
|
Unassigned |
Bug Description
If sshfs is called with the "password_stdin" option (for example, when invoked with pam_mount) it will refuse to accept a password longer than 64 characters.
The limit is hardcoded in the sshfs.c file (line 3069 in version 2.3, line 3466 in version 2.5) with the variable named "max_password".
To reproduce, from the command-line you can use for example:
sshfs mvaldez@
then type the password (sshfs will wait for the password from stdin without prompt) and press Enter. If the password is longer than 64 characters it will fail with the message: "Password too long".
When used with pam_mount, the logs in /var/log/auth.log show the following messages:
pam_mount(
pam_mount(
pam_mount(
This limit seems to be inherited from the first patches sent to the sshfs-fuse project (around 2008) for the password_stdin option, but it seems to be arbitrary. I have successfully changed the limit to 1024 without problems. Also, the function "read_password" which is used to capture the password from stdin is only used when using the "password_stdin" option (so any change in the allowed length won't affect any other part of the program).
This tests were done in Ubuntu 12.04.5 LTS but the limit is the same up to the latest sshfs-fuse version (2.5).
I can confirm this with Vivid's sshfs version 2.5-1ubuntu1. Well, except for the detail that the problem didn't appear to be with passwords longer than 64 characters, but rather with passwords 64 characters (inclusive) or longer.
Not sure whatever to categorize it as a bug or not, given that the program strictly speaking is behaving as intended, even if I agree that it appear to be arbitrary.
My suggestion is to bring the case up with upstream. According to http:// fuse.sourceforg e.net/sshfs. html the suggested method is to send an e-mail to <email address hidden>.