Bug 463 - PrintLastLog doesn't work in privsep mode
Summary: PrintLastLog doesn't work in privsep mode
Status: CLOSED FIXED
Alias: None
Product: Portable OpenSSH
Classification: Unclassified
Component: sshd (show other bugs)
Version: -current
Hardware: All All
: P2 trivial
Assignee: OpenSSH Bugzilla mailing list
URL:
Keywords: openbsd, patch
Depends on:
Blocks: 822
  Show dependency treegraph
 
Reported: 2003-01-07 16:45 AEDT by Damien Miller
Modified: 2006-11-01 13:18 AEDT (History)
0 users

See Also:


Attachments
Generate login message as part of login recording. (12.65 KB, patch)
2003-02-22 16:01 AEDT, Darren Tucker
no flags Details | Diff
Generate loginmsg as part of login recording (against OpenBSD -current) (9.18 KB, patch)
2003-05-10 19:34 AEST, Darren Tucker
no flags Details | Diff
Generate loginmsg as part of login recording (against OpenBSD -current, take 2) (9.42 KB, patch)
2003-05-11 19:52 AEST, Darren Tucker
no flags Details | Diff
Simpler OpenBSD patch based on feedback from Markus (8.47 KB, patch)
2004-07-03 15:19 AEST, Darren Tucker
no flags Details | Diff
Patch 676 against Portable, plus AIX loginsuccess() support. (11.58 KB, patch)
2004-07-03 16:42 AEST, Darren Tucker
no flags Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Damien Miller 2003-01-07 16:45:00 AEDT
The call to get_last_login_time() in session.c happens in the child without
being wrapped in the monitor. Only root gets the lastlog time printed if the
lastlog file isn't world-readable.
Comment 1 Darren Tucker 2003-01-07 23:43:00 AEDT
Generate the message earlier in the login process and store for display after 
session startup?

Rather than another variable for this (eg aixloginmsg, maybe __pam_msg), what 
about using a single Buffer for storing all of the messages to be displayed 
after login?

I've started doing something like this (see 
http://www.zip.com.au/~dtucker/openssh/openssh-passexpire9.patch) and a (as yet 
unpublished) update to this makes things neater (eg the patch removes 3 
#ifdefs).
Comment 2 Markus Friedl 2003-01-27 20:27:18 AEDT
hm, yes, this would make sense. something like Buffer loginmsg;
Comment 3 Darren Tucker 2003-02-01 20:21:29 AEDT
AIX has a related problem with loginsuccess(), which generates the equivalent of 
the LastLogin message.  At the moment it's only called for password 
authentication, so public-key logins don't get the messages or have the 
/etc/security/lastlog file updated.

The patch I'm about to attach to bug #14 fixes this for AIX and PrintLastLog 
along with fixing #14, however if someone wants to merge this separately I'll 
split it.
Comment 4 Darren Tucker 2003-02-22 16:01:39 AEDT
Created attachment 235 [details]
Generate login message as part of login recording.

This patch moves the generation of the generic last login message to
sshlogin.c, the AIX loginsuccess call to loginrec.c and provides a monitor call
to get the login message.  (The AIX problem was that loginsuccess did not get
called for non-password auth).

The reason the monitor call is necessary is that on AIX, the last login message
is generated as a side-effect of calling loginsuccess().  This needs root privs
 (as it does some logging too).  Now if you have a postponed authentication,
you can't safely call loginsuccess() before the post-auth privsep split (since
the postponed authentication may not actually succeed).  Hence, the only
guaranteed safe place to call it is from the post-auth monitor, and therefore a
monitor call is necessary to retrieve the login message).

As a minor bonus (?) this also allows correct recording of ptys in the AIX
login info.
Comment 5 Darren Tucker 2003-05-10 12:59:26 AEST
I've had a look at the OpenBSD source and I don't think OpenBSD *needs* a 
"Buffer loginmsg" right now.  PrintLastLog can be easily fixed by updating 
s->last_login_time before the privsep split.

So, is there another reason OpenBSD needs (or wants) a "Buffer loginmsg"?  Or 
should it be -portable only?  Have I overlooked something?  And what's the 
feeling on the montitor call in attachment #235 [details]?
Comment 6 Damien Miller 2003-05-10 16:40:50 AEST
Yes, the privsep split occurs post-auth, not once per session. Remember that a
SSH2 connection may have multiple sessions (the ssh.com windows client allows
this). 

If you collect the last login time at the time of the privsep split, then that
would be displayed for all sessions.
Comment 7 Darren Tucker 2003-05-10 17:49:14 AEST
OK, so if I understand correctly, the only guaranteed way to get the last login 
time is via a monitor call, so I hopefully won't get accused of bloat for 
proposing one...
Comment 8 Damien Miller 2003-05-10 18:59:44 AEST
Certainly not!
Comment 9 Darren Tucker 2003-05-10 19:34:29 AEST
Created attachment 287 [details]
Generate loginmsg as part of login recording (against OpenBSD -current)

OK, here's the proposed patch against OpenBSD.	The call to
store_lastlog_message is where it is in record_login because under AIX the
login message is generated as a side effect of loginsuccess().	The location
under OpenBSD is not critical since it's a read-only operation.
Comment 10 Darren Tucker 2003-05-10 22:22:11 AEST
Hmm, this will probably give multiple "Last login" messages if used with 
multiple sessions (none of my clients support it so I'm not sure about that).

With my current plan for password expiry, loginmsg needs to be initialised 
before allowed_user() where it accumulates all of the "Your password/account 
will expire.." messages.

Might need to clear the message after retrieving/printing it.
Comment 11 Darren Tucker 2003-05-11 19:52:25 AEST
Created attachment 288 [details]
Generate loginmsg as part of login recording (against OpenBSD -current, take 2)

Simpler patch, removes many of the Buffer->string->Buffer contortions.	Works
with multiple sessions (ie most recent login time is displayed each time).
Comment 12 Damien Miller 2003-06-28 17:48:01 AEST
I have committed a similar patch which reports the error() on failure to create
the pidfile, but not the "sshd -t" tests. There are just too many ways for an
admin to break a system to test for them all. Besides, pidfile creation failure
is non-fatal.
Comment 13 Damien Miller 2003-06-28 17:50:08 AEST
gah! I am a moron, sending changes to the wrong bug...
Comment 14 Darren Tucker 2004-07-03 15:19:17 AEST
Created attachment 676 [details]
Simpler OpenBSD patch based on feedback from Markus
Comment 15 Darren Tucker 2004-07-03 16:42:07 AEST
Created attachment 677 [details]
Patch 676 against Portable, plus AIX loginsuccess() support.
Comment 16 Darren Tucker 2004-07-17 18:11:11 AEST
This has now been fixed (both in OpenBSD and Portable) with a variant of #676. 
The AIX-specific parts of 677 aren't in yet, I'll commit that as soon as it's
tested OK.
Comment 17 Magosányi Árpád 2006-10-27 23:31:23 AEST
PrintLastLog does not seem to work yet.

  openssh.base.server     4.1.0.5301  COMMITTED  Open Secure Shell Server

It is an AIX 5.3
# oslevel -r
5300-01

Are AIX specific parts are in yet?
Comment 18 Darren Tucker 2006-10-28 00:36:47 AEST
(In reply to comment #17)
> PrintLastLog does not seem to work yet.
> 
>   openssh.base.server     4.1.0.5301  COMMITTED  Open Secure Shell
> Server

That looks like the IBM package on sourceforge.  I don't really know what's in that so if you're having trouble with it you'll need to ask them.  If you compile it from the source from openssh.com does it still misbehave?

> Are AIX specific parts are in yet?

Yes, and have been for some time.  On AIX, the system library call loginsuccess() generates the "last logged in at" message not sshd, so PrintLastLog yes/no won't have any effect but as long as the library calls work then you should see the messages.

$ ssh aixbox
Last unsuccessful login: Fri Sep 29 17:07:04 EET 2006 on ssh from [...]
Last login: Sat Oct 28 00:27:06 EET 2006 on /dev/pts/1 from [...]
$ oslevel
5.1.0.0
$ ssh -V
OpenSSH_4.4p1, OpenSSL 0.9.7l 28 Sep 2006
Comment 19 Darren Tucker 2006-11-01 13:17:51 AEDT
Since this has been resolved for quite some time and seems to be against a third-party binary I'm re-closing this bug.  If you experience problems with the current version of the code from openssh.com on AIX then please open a new bug for it and we'll do what we can to help you.