diff --git a/Ghidra/Framework/FileSystem/src/main/java/ghidra/framework/client/HeadlessClientAuthenticator.java b/Ghidra/Framework/FileSystem/src/main/java/ghidra/framework/client/HeadlessClientAuthenticator.java index b1ad049b5b..08a476a908 100644 --- a/Ghidra/Framework/FileSystem/src/main/java/ghidra/framework/client/HeadlessClientAuthenticator.java +++ b/Ghidra/Framework/FileSystem/src/main/java/ghidra/framework/client/HeadlessClientAuthenticator.java @@ -39,7 +39,7 @@ public class HeadlessClientAuthenticator implements ClientAuthenticator { private static Object sshPrivateKey; private static String userID = ClientUtil.getUserName(); // default username - private static boolean passwordPromptAlowed; + private static boolean passwordPromptAllowed; private Authenticator authenticator = new Authenticator() { @Override @@ -75,7 +75,7 @@ public class HeadlessClientAuthenticator implements ClientAuthenticator { */ public static void installHeadlessClientAuthenticator(String username, String keystorePath, boolean allowPasswordPrompt) throws IOException { - passwordPromptAlowed = allowPasswordPrompt; + passwordPromptAllowed = allowPasswordPrompt; if (username != null) { userID = username; } @@ -117,7 +117,7 @@ public class HeadlessClientAuthenticator implements ClientAuthenticator { success = true; Msg.info(HeadlessClientAuthenticator.class, "Loaded SSH key: " + keystorePath); } - catch (InvalidKeyException e) { // keyfile is not a valid SSH provate key format + catch (InvalidKeyException e) { // keyfile is not a valid SSH private key format // does not appear to be an SSH private key - try PKI keystore parse if (ApplicationKeyManagerFactory.setKeyStore(keystorePath, false)) { success = true; @@ -140,7 +140,7 @@ public class HeadlessClientAuthenticator implements ClientAuthenticator { private char[] getPassword(String usage, String prompt) { - if (!passwordPromptAlowed) { + if (!passwordPromptAllowed) { Msg.warn(this, "Headless client not configured to supply required password"); return BADPASSWORD; } @@ -208,7 +208,7 @@ public class HeadlessClientAuthenticator implements ClientAuthenticator { public boolean processPasswordCallbacks(String title, String serverType, String serverName, NameCallback nameCb, PasswordCallback passCb, ChoiceCallback choiceCb, AnonymousCallback anonymousCb, String loginError) { - if (anonymousCb != null && !passwordPromptAlowed) { + if (anonymousCb != null && !passwordPromptAllowed) { // Assume that login error will not occur with anonymous login anonymousCb.setAnonymousAccessRequested(true); return true; @@ -238,7 +238,7 @@ public class HeadlessClientAuthenticator implements ClientAuthenticator { @Override public char[] getKeyStorePassword(String keystorePath, boolean passwordError) { if (passwordError) { - if (passwordPromptAlowed) { + if (passwordPromptAllowed) { Msg.error(this, "Incorrect keystore password specified: " + keystorePath); } else { diff --git a/Ghidra/Framework/Generic/src/main/java/ghidra/net/ApplicationKeyManagerFactory.java b/Ghidra/Framework/Generic/src/main/java/ghidra/net/ApplicationKeyManagerFactory.java index 825dd19544..fbbc77c5dc 100644 --- a/Ghidra/Framework/Generic/src/main/java/ghidra/net/ApplicationKeyManagerFactory.java +++ b/Ghidra/Framework/Generic/src/main/java/ghidra/net/ApplicationKeyManagerFactory.java @@ -159,7 +159,7 @@ public class ApplicationKeyManagerFactory { /** * If the system property ghidra.keystore takes precedence in establishing - * the ketsore. If using a GUI and the system property has not been set, the + * the keystore. If using a GUI and the system property has not been set, the * user preference with the same name will be used. * @return active keystore path or null if currently not running with a keystore or * one has not been set. diff --git a/Ghidra/RuntimeScripts/Common/support/analyzeHeadlessREADME.html b/Ghidra/RuntimeScripts/Common/support/analyzeHeadlessREADME.html index e26de5388c..644fe7b45f 100644 --- a/Ghidra/RuntimeScripts/Common/support/analyzeHeadlessREADME.html +++ b/Ghidra/RuntimeScripts/Common/support/analyzeHeadlessREADME.html @@ -148,7 +148,7 @@ The Headless Analyzer uses the command-line parameters discussed below. See - +
@@ -503,29 +503,33 @@ The Headless Analyzer uses the command-line parameters discussed below. See -keystore <KeystorePath>
When connecting to a Ghidra Server using PKI or SSH authentication, this option allows - specification of a suitable private keystore file. The file should rely on filesystem protection - only to avoid prompting for a password. + specification of a suitable private keystore file. The keystore file should always be properly + protected with filesystem protections. Since SSH authentication is intended for batch operations, + we do not support password protected SSH keys. However, we do support password prompting for + PKI authentication.
+ See here for more information regarding which authentication method to use

  • -connect <userID>
    - If used, allows the process owner's default userID to be overridden with the given - userID when connecting to a Ghidra Server (provided the server has been - configured to allow this). + If used, allows the process owner's default userID to be overridden with the given + userID when connecting to a Ghidra Server. In order to use this parameter, + the server must be configured to allow a non-default username (see Ghidra Server Configuration -u option).


  • -p
    - When connecting to a server, allows interactive prompting for a password via the console. - Although this method of authentication is normally discouraged, the server connection will - likely fail authentication if a password is required and this parameter is not enabled. -
    - Note: In some cases, password entry will be echoed to the console (a warning will show at - password prompt). + This option may be specified to allow for interactive password prompting when either a specified + PKI keystore is password protected or the Ghidra Server requires password authentication. + This option should not be used during batch operations where a user will be unable to enter a + password. If the terminal in use is unable to suppress echoing an entered password, a warning will be + issued with the prompt, and the entered password will be echoed to the terminal. Use of this option + is discouraged when such a warning occurs.
    + See here for more information regarding which authentication method to use


    • @@ -641,6 +645,49 @@ The Headless Analyzer uses the command-line parameters discussed below. See Back to Top)
    +

    Headless Analyzer Authentication

    +Use this table to figure out which authentication option to use with the Headless Analyzer, based on your Ghidra Server's +method of authentication, and the type of analysis operation you are performing. +

    +

    Parameter Local Project
    + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Type of OperationAuthentication Method
    SSH Without Password*SSH With PasswordPKI Without PasswordPKI With PasswordUsername/Password
    Interactive
    Command Line    		- keystoreNot Supported- keystore- keystore
    and
    - p    		- p
    Batch/Script Use- keystoreNot Supported- keystoreNot SupportedNot Supported
    + +
    + *NOTE: The use of OpenSSH keys are not supported. The following command can be used to generate + a suitable SSH key while avoiding the unsupported OpenSSH format: ssh-keygen -b 2048 -t rsa -m pem +
    +

    + +(Back to Top) +
    +

    Headless Analyzer Examples