✨ Support passwords in ssh_async

Add password authentication for the `asyncssh` backend, including
passwords passed directly and passwords resolved from authinfo secure
storage. Reject password authentication for the `openssh` backend, which
cannot inject passwords programmatically.

Use `sshpass` for `gotocomputer` only when a stored password and
`sshpass` are available. Otherwise fall back to manual password entry.

Author: agoscinski

.github/workflows/setup_ssh.sh

@@ -7,3 +7,7 @@ ssh-keyscan -H localhost >> "${HOME}/.ssh/known_hosts"
 
 # The permissions on the GitHub runner are 777 which will cause SSH to refuse the keys and cause authentication to fail
 chmod 755 "${HOME}"
+
+# set up ssh by password
+# runner is default user name in github CI, we set password to "password"
+echo "runner:password" | sudo chpasswd

src/aiida/transports/plugins/async_backend.py

@@ -226,11 +226,18 @@ class _AsyncSSH(_AsynchronousSSHBackend):
     Note: This class is not part of the public API and should not be used directly.
     """
 
-    def __init__(self, machine: str, logger: logging.LoggerAdapter, bash_command: str):
+    def __init__(
+        self,
+        machine: str,
+        logger: logging.LoggerAdapter,
+        bash_command: str,
+        connection_options: asyncssh.SSHClientConnectionOptions | None = None,
+    ):
         super().__init__(machine, logger, bash_command)
+        self._connection_options = connection_options
 
     async def open(self):
-        self._conn = await asyncssh.connect(self.machine)
+        self._conn = await asyncssh.connect(self.machine, options=self._connection_options)
         self._sftp = await self._conn.start_sftp_client()
 
     async def close(self):

src/aiida/transports/plugins/ssh_async.py

@@ -13,10 +13,13 @@
 import asyncio
 import glob
 import os
+import shutil
 import subprocess
 from pathlib import Path, PurePath
+from typing import TYPE_CHECKING
 
 import click
+from asyncssh import SSHClientConnectionOptions
 
 from aiida.common.escaping import escape_for_bash
 from aiida.common.exceptions import InvalidOperation
@@ -31,6 +34,38 @@
 __all__ = ('AsyncSshTransport',)
 
 
+if TYPE_CHECKING:
+    from aiida.orm.implementation.authinfos import BackendAuthInfo
+
+
+def validate_os_supports_secure_storage(ctx, param, value: str):
+    """Validate the secure storage is available when configuring a password.
+
+    :param ctx: the click context
+    :param param: the click parameter
+    :param value: the password value to validate
+    :return: the unchanged password value
+    :raises OSError: if the system secure storage cannot be accessed
+    """
+    if not value:
+        return value
+
+    import keyringrs  # type: ignore[import-untyped]
+
+    try:
+        entry = keyringrs.Entry('aiida.transports.ssh_async', 'VALIDATE_OS_SUPPORTS_SECURE_STORAGE')
+        entry.set_password('DUMMY')
+        entry.delete_credential()
+    except Exception as exception:
+        msg = (
+            'Could not access secure storage on your system for storing the password. '
+            'Cannot use password authentication without secure storage.'
+        )
+        raise OSError(msg) from exception
+
+    return value
+
+
 def validate_script(ctx, param, value: str):
     if value == 'None':
         return value
@@ -73,6 +108,18 @@ class AsyncSshTransport(AsyncTransport):
                 'non_interactive_default': True,
             },
         ),
+        (
+            'password',
+            {
+                'type': str,
+                'default': '',
+                'prompt': 'Password',
+                'hide_input': True,
+                'help': 'Login password for the remote machine.',
+                'non_interactive_default': True,
+                'callback': validate_os_supports_secure_storage,
+            },
+        ),
         (
             'max_io_allowed',
             {
@@ -125,7 +172,9 @@ def _get_host_suggestion_string(cls, computer):
         # TODO: an issue is open: https://github.com/aiidateam/aiida-core/issues/6726
         return computer.hostname
 
-    def __init__(self, *args, **kwargs):
+    def __init__(self, *args, secure_storage: 'BackendAuthInfo.SecureStorage | None' = None, **kwargs):
+        from aiida.orm.authinfos import Password
+
         super().__init__(*args, **kwargs)
         # the machine is passed as `machine=computer.hostname` in the codebase
         # 'machine' is immutable.
@@ -142,6 +191,37 @@ def __init__(self, *args, **kwargs):
             # for backward compatibility
             self.auth_script = kwargs.pop('script_before', 'None')
 
+        self._secure_storage: BackendAuthInfo.SecureStorage | None = secure_storage
+        self._password: str | Password | None = kwargs.pop('password', None)
+        if self._password == Password.REDACTED.value:
+            # `AuthInfo.get_auth_params` redacts a stored password with the plain marker string
+            self._password = Password.REDACTED
+
+        if self._password and kwargs.get('backend') == 'openssh':
+            msg = (
+                'Password authentication is not supported by the `openssh` backend. '
+                'Use the default `asyncssh` backend or configure key-based authentication.'
+            )
+            raise ValueError(msg)
+
+        if self._password == Password.REDACTED:
+            if self._secure_storage is None:
+                msg = 'No secure storage manager was provided for the redacted password.'
+                raise ValueError(msg)
+            if (connection_password := self._secure_storage.get_password()) is None:
+                msg = f'No registered password has been found in secure storage for host `{self.machine}`.'
+                raise ValueError(msg)
+        else:
+            connection_password = self._password
+
+        connection_options = None
+        if connection_password:
+            connection_options = SSHClientConnectionOptions(
+                password=connection_password,
+                preferred_auth='password',
+                public_key_auth=False,
+            )
+
         if kwargs.get('backend') == 'openssh':
             from .async_backend import _OpenSSH
 
@@ -150,7 +230,12 @@ def __init__(self, *args, **kwargs):
             # default backend is asyncssh
             from .async_backend import _AsyncSSH
 
-            self.async_backend = _AsyncSSH(self.machine, self.logger, self._bash_command_str)  # type: ignore[assignment]
+            self.async_backend = _AsyncSSH(
+                self.machine,
+                self.logger,
+                self._bash_command_str,
+                connection_options=connection_options,
+            )  # type: ignore[assignment]
 
     @property
     def max_io_allowed(self):
@@ -1300,6 +1385,21 @@ def gotocomputer_command(self, remotedir: TransportPath | None = None):
 
         :type remotedir:  :class:`Path <pathlib.Path>`, :class:`PurePosixPath <pathlib.PurePosixPath>`, or `str`
         """
+        from aiida.orm.authinfos import Password
+
         connect_string = self._gotocomputer_string(remotedir=remotedir)
         cmd = f'ssh -t {self.machine} {connect_string}'
+
+        if self._password == Password.REDACTED:
+            if shutil.which('sshpass') is None:
+                self.logger.info('Command line tool `sshpass` was not found. Continue with manual password entry.')
+            elif self._secure_storage is None or self._secure_storage.get_password() is None:
+                self.logger.info(
+                    f'No registered password has been found in secure storage for host `{self.machine}`. '
+                    'Continue with manual password entry.'
+                )
+            else:
+                cmd_stdout_password = self._secure_storage.get_cmd_stdout_password()
+                cmd = f'sshpass -p "$({cmd_stdout_password})" {cmd}'
+
         return cmd

tests/transports/test_all_plugins.py

@@ -27,6 +27,8 @@
 from aiida.common.warnings import AiidaDeprecationWarning
 from aiida.plugins import SchedulerFactory, TransportFactory
 from aiida.transports import Transport
+from aiida.transports.plugins import ssh_async
+from aiida.transports.plugins.local import LocalTransport
 
 # TODO : test for copy with pattern
 # TODO : test for copy with/without patterns, overwriting folder
@@ -64,23 +66,40 @@ def tmp_path_local(tmp_path_factory):
         ('core.ssh', None),
         ('core.ssh_async', 'asyncssh'),
         ('core.ssh_async', 'openssh'),
+        ('core.ssh_async', 'password-passed'),
+        ('core.ssh_async', 'password-from-keychain'),
     ],
 )
-def custom_transport(request, tmp_path_factory, monkeypatch) -> Transport:
+def custom_transport(request, aiida_localhost) -> Transport:
     """Fixture that parametrizes over all the registered implementations of the transport plugins."""
-    plugin = TransportFactory(request.param[0])
+    plugin_name, use_case = request.param
+    plugin = TransportFactory(plugin_name)
+    auth_info = None
 
-    if request.param[0] == 'core.ssh':
+    if plugin_name == 'core.ssh':
         kwargs = {'machine': 'localhost', 'timeout': 30, 'load_system_host_keys': True, 'key_policy': 'AutoAddPolicy'}
-    elif request.param[0] == 'core.ssh_async':
-        kwargs = {
-            'machine': 'localhost',
-            'backend': request.param[1],
-        }
+    elif plugin_name == 'core.ssh_async':
+        auth_info = aiida_localhost.configure()
+        kwargs = {'machine': 'localhost', 'secure_storage': auth_info.secure_storage}
+        if use_case in {'asyncssh', 'openssh'}:
+            kwargs['backend'] = use_case
+        elif use_case == 'password-passed':
+            kwargs['backend'] = 'asyncssh'
+            kwargs['password'] = 'password'
+        elif use_case == 'password-from-keychain':
+            from aiida.orm.authinfos import Password
+
+            auth_info.secure_storage.set_password('password')
+            kwargs['backend'] = 'asyncssh'
+            kwargs['password'] = Password.REDACTED
     else:
         kwargs = {}
 
-    return plugin(**kwargs)
+    try:
+        yield plugin(**kwargs)
+    finally:
+        if plugin_name == 'core.ssh_async' and use_case == 'password-from-keychain' and auth_info is not None:
+            auth_info.secure_storage.delete_password()
 
 
 def test_is_open(custom_transport):
@@ -1580,3 +1599,36 @@ def test_glob(custom_transport, tmp_path_local):
         g_list = transport.glob(str(tmp_path_local) + '/folder2/aiida.pdos*')
         paths = [str(tmp_path_local.joinpath('folder2/aiida.pdos_atm#2(Al)_wfc#2(p)'))]
         assert sorted(paths) == sorted(g_list)
+
+
+def test_gotocomputer_command(custom_transport):
+    """Test the generated go-to-computer command."""
+    goto_computer_cmd = custom_transport.gotocomputer_command(Path('/path'))
+
+    if isinstance(custom_transport, LocalTransport):
+        assert 'bash' in goto_computer_cmd
+    else:
+        assert 'ssh' in goto_computer_cmd
+
+
+def test_openssh_backend_rejects_password():
+    """A password cannot be used with the ``openssh`` backend, which has no way to inject it."""
+    with pytest.raises(ValueError, match=r'Password authentication is not supported by the `openssh` backend'):
+        TransportFactory('core.ssh_async')(machine='localhost', backend='openssh', password='secret')
+
+
+def test_validate_os_supports_secure_storage(monkeypatch):
+    """Validate password configuration fails if secure storage is unavailable."""
+    import keyringrs
+
+    class FailingEntry:
+        def __init__(self, *args, **kwargs):
+            pass
+
+        def set_password(self, _: str):
+            raise RuntimeError('Could not access secure storage.')
+
+    monkeypatch.setattr(keyringrs, 'Entry', FailingEntry)
+
+    with pytest.raises(OSError, match=r'.*Cannot use password authentication without secure storage.*'):
+        ssh_async.validate_os_supports_secure_storage(None, None, 'pw')