[Libguestfs] [PATCH nbdkit] ssh: Improve the error message when all authentication methods fail

[Richard W.M. Jones]

The current error message:

  nbdkit: ssh[1]: error: all possible authentication methods failed

is confusing and non-actionable.  It's hard even for experts to
understand the relationship between the authentication methods offered
by a server and what we require.

Try to improve the error message in some common situations, especially
where password authentication on the server side is disabled but the
client supplied a password=... parameter.  After this change, you will
see an actionable error:

  nbdkit: ssh[1]: error: the server does not offer password
  authentication, but you tried to use a password; if you have root
  access to the server, try editing 'sshd_config' and setting
  'PasswordAuthentication yes'; otherwise try using an SSH agent with
  a passphrase

Also remove an incidental comment left over when I copied the libssh
example code.

See-also: https://bugzilla.redhat.com/show_bug.cgi?id=2158300
---
 plugins/ssh/ssh.c | 35 ++++++++++++++++++++++++++++-------
 1 file changed, 28 insertions(+), 7 deletions(-)

diff --git a/plugins/ssh/ssh.c b/plugins/ssh/ssh.c
index 6cf40c26f..23c0b46f9 100644
--- a/plugins/ssh/ssh.c
+++ b/plugins/ssh/ssh.c
@@ -355,14 +355,35 @@ authenticate (struct ssh_handle *h)
     rc = authenticate_pubkey (h->session);
     if (rc == SSH_AUTH_SUCCESS) return 0;
   }
+  else if (password == NULL) {
+    /* Because the password method below requires a password, we know
+     * that it will fail, so print an actionable error message and
+     * bail now.
+     */
+    nbdkit_error ("the server does not offer SSH agent authentication; "
+                  "try using a password=... parameter, see the "
+                  "nbdkit-ssh-plugin(1) manual page");
+    return -1;
+  }
 
-  /* Example code tries keyboard-interactive here, but we cannot use
-   * that method from a server.
-   */
-
-  if (password != NULL && (method & SSH_AUTH_METHOD_PASSWORD)) {
-    rc = authenticate_password (h->session, password);
-    if (rc == SSH_AUTH_SUCCESS) return 0;
+  if (password != NULL) {
+    if (method & SSH_AUTH_METHOD_PASSWORD) {
+      rc = authenticate_password (h->session, password);
+      if (rc == SSH_AUTH_SUCCESS) return 0;
+      else {
+        nbdkit_error ("password authentication failed, "
+                      "is the username and password correct?");
+        return -1;
+      }
+    }
+    else {
+      nbdkit_error ("the server does not offer password authentication, "
+                    "but you tried to use a password; if you have root access "
+                    "to the server, try editing 'sshd_config' and setting "
+                    "'PasswordAuthentication yes'; otherwise try using "
+                    "an SSH agent with a passphrase");
+      return -1;
+    }
   }
 
   nbdkit_error ("all possible authentication methods failed");
-- 
2.37.3