fix: ubuntu sudo failed

Author: LeeEirc

pkg/proxy/server.go

@@ -689,11 +689,15 @@ func (s *Server) getSSHConn() (srvConn *srvconn.SSHConnection, err error) {
 			account 是最终 su 的登录用户
 		*/
 		suUsername := s.account.Username
-		suPassword := s.account.Secret
 		sudoType := srvconn.SuMethodSu
 		if platform.SuMethod != nil {
 			sudoType = srvconn.NewSuMethodType(platform.SuMethod.Value)
 		}
+		suPassword := s.account.Secret
+		if sudoType.IsSudo() {
+			// sudo authenticates the invoking user by default.
+			suPassword = s.suFromAccount.Secret
+		}
 		cfg := srvconn.SuConfig{
 			MethodType:   sudoType,
 			SudoUsername: suUsername,
@@ -794,11 +798,15 @@ func (s *Server) getTelnetConn() (srvConn *srvconn.TelnetConnection, err error)
 	}
 	if s.suFromAccount != nil {
 		suUsername := s.account.Username
-		suPassword := s.account.Secret
 		sudoType := srvconn.SuMethodSu
 		if platform.SuMethod != nil {
 			sudoType = srvconn.NewSuMethodType(platform.SuMethod.Value)
 		}
+		suPassword := s.account.Secret
+		if sudoType.IsSudo() {
+			// sudo authenticates the invoking user by default.
+			suPassword = s.suFromAccount.Secret
+		}
 		cfg := srvconn.SuConfig{
 			MethodType:   sudoType,
 			SudoUsername: suUsername,

pkg/srvconn/conn_ssh_su.go

@@ -89,10 +89,10 @@ const (
 	SuCommandSuperH3C = "super level-15"
 
 	/*
-	 \b: word boundary 即: 匹配某个单词边界
+		只匹配完整的密码提示行，避免将 banner 或密码过期信息误判为认证提示。
 	*/
 
-	passwordMatchPattern = "(?i)\\bpassword\\b\\s*[:：]|密码\\s*[:：]|password\\s*[:：]\\s*"
+	passwordMatchPattern = `(?i)^\s*(?:\[[^\r\n]*\]\s*)?(?:password(?:\s+for\s+[^:：\r\n]+)?|[^\s:：\r\n]+['’]s\s+password|(?:[^:：\r\n]*的\s*)?密码)\s*[:：]\s*$`
 
 	usernameMatchPattern = "(?i)username:?\\s*$|name:?\\s*$|用户名:?\\s*$"
 )
@@ -150,6 +150,11 @@ func NewSuMethodType(suMethod string) SUMethodType {
 	return SuMethodSu
 }
 
+// IsSudo reports whether the switch method authenticates through sudo.
+func (s SUMethodType) IsSudo() bool {
+	return s == SuMethodSudo || s == SuMethodOnlySudo
+}
+
 type SuConfig struct {
 	MethodType   SUMethodType
 	SudoUsername string

pkg/srvconn/conn_telnet_su.go

@@ -142,6 +142,7 @@ func (s *SuSwitchService) loginUsernameOrPassword(resultChan chan<- error) {
 			continue
 		case StatusFailed:
 			resultChan <- fmt.Errorf("failed login: %s", recStr.String())
+			return
 		case StatusUnMatch:
 		default:
 
@@ -169,6 +170,10 @@ func (s *SuSwitchService) handleResult(p []byte) matchStatus {
 	if s.passwordRegexp != nil {
 		for _, line := range lineBytes {
 			if s.passwordRegexp.Match(line) {
+				if s.inputAuthOnce {
+					logger.Debugf("Su switch step password pattern matched again: %s", p)
+					return StatusFailed
+				}
 				_, _ = s.SrvConn.Write([]byte(s.cfg.SudoPassword + "\r"))
 				s.inputAuthOnce = true
 				logger.Debugf("Su switch step password pattern ok: %s", p)