Bug 647 - Setting "UsePAM no" in sshd_config gives error if not config'ed w/ --with-pam
Summary: Setting "UsePAM no" in sshd_config gives error if not config'ed w/ --with-pam
Status: CLOSED FIXED
Alias: None
Product: Portable OpenSSH
Classification: Unclassified
Component: sshd (show other bugs)
Version: -current
Hardware: SPARC SunOS
: P4 minor
Assignee: OpenSSH Bugzilla mailing list
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2003-09-17 13:44 AEST by Ken Pon
Modified: 2004-04-14 12:24 AEST (History)
1 user (show)

See Also:

Attachments
Set options->use_pam to 0 if USE_PAM is not set (585 bytes, patch)
2003-09-18 17:47 AEST, Darren Tucker 		no flags Details | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Ken Pon 2003-09-17 13:44:35 AEST 
For OpenSSH_3.7p1, if one does NOT use the "--with-pam" configuration
option, setting the default "#UsePAM yes" flag in sshd_config to
"UsePam no" will cause the following error:
 init.d [111]# ./openssh start
/etc/ssh/sshd_config line 75: Unsupported option UsePAM

However, if one does use the "--with-pam" configuration option,
setting the flag "UsePam no" is acceptable.

Seems a bit confusing to me. Perhaps "#UsePAM no" should be the default?

Thanks.
Comment 1 Darren Tucker 2003-09-18 17:47:51 AEST 
Created attachment 422 [details]
Set options->use_pam to 0 if USE_PAM is not set

On a related note, options.use_pam is set even unless overridden by the UsePAM
directive, which doesn't happen if PAM support isn't compiled in.

This means, for example, that things like this (from auth.c) don't happen when
PAM support is disabled:
#if defined(HAVE_SHADOW_H) && !defined(DISABLE_SHADOW)
	if (!options.use_pam)
		spw = getspnam(pw->pw_name);

Hey!  That might be the cause of some of our mystery segfaults on Solaris 2.6!
Comment 2 Damien Miller 2003-09-18 18:40:16 AEST 
Maybe it should just default to 0
Comment 3 Darren Tucker 2003-09-18 18:57:42 AEST 
That was my first thought, but most of the options go through this "-1 = unset"
-> set from config -> apply default if -1 process.  I assumed there was a reason
for it, so left it that way.
Comment 4 Darren Tucker 2003-10-07 16:57:17 AEST 
As of 3.7.1p2 UsePAM defaults to "no".
Comment 5 Damien Miller 2004-04-14 12:24:19 AEST 
Mass change of RESOLVED bugs to CLOSED