| Summary: | Solaris 8 sshd seg fault with 4.2p1 & PAM | ||
|---|---|---|---|
| Product: | Portable OpenSSH | Reporter: | John Devitofranceschi <jdvf> |
| Component: | sshd | Assignee: | Darren Tucker <dtucker> |
| Status: | CLOSED WORKSFORME | ||
| Severity: | normal | ||
| Priority: | P2 | ||
| Version: | -current | ||
| Hardware: | UltraSPARC | ||
| OS: | Solaris | ||
| Attachments: | |||
|
Description
John Devitofranceschi
2005-09-29 12:36:18 AEST
Created attachment 970 [details]
sshd -ddde output when failure occurs
From Darren Tucker:
From the sshd debug trace, the order of what happens is:
1) ssh "none" auth attempt: fails
2) gssapi-with-mic auth atempt (several?): fails
3) publickey auth attempt (several): fails
4) keyboard-interactive auth attempt: crashes
Created attachment 974 [details]
sshd -ddde with "ssh" using keyboard-interactive only
Debug output of the failure with the client using keyboard-interactive auth
only
Created attachment 975 [details]
sshd -ddde with "ssh" using gssapi-with-mic,publickey,password
Created attachment 976 [details]
sshd -ddde with "ssh" using password only
Failure using password authentication only. "Segmentation Fault" line not
captured, but it was there.
jd
Which compiler and build options are you using? Which options are active in sshd_config? There seems to be some stuff missing from the debug output. For example, there's lines like: "debug3: entering", which should have a function name in the middle. Is that how they appear on the screen? And this one is a wild guess: do you have "PermitEmptyPasswords" set to "yes" and does the behaviour change if it's set to "no"? Created attachment 978 [details] sshd_config for in effect when failure occurs (In reply to comment #5) > Which compiler and build options are you using? SUNWspro C compiler, version 4.2 (patch 1). Only using "-g" and generic libs and default linker directives. >Which options are active in sshd_config? See attached sshd_config. The configure patameters are: > ./configure --prefix=/opt/openssh --localstatedir=/etc/opt/openssh > - --sysconfdir=/etc/opt/openssh --with-kerberos5=../.. --with-zlib=../.. > - --with-ssl-dir=../.. --disable-wtmp --disable-utmp > - --with-random=/dev/random --with-pam --with-ldflags=-ldl > There seems to be some stuff missing from the debug output. For example, > there's lines like: "debug3: entering", which should have a function name in > the middle. Is that how they appear on the screen? Yes > And this one is a wild guess: do you have "PermitEmptyPasswords" set to "yes" > and does the behaviour change if it's set to "no"? It's set to "no" already. (In reply to comment #5) > Which compiler and build options are you using? Which options are active in > sshd_config? > There seems to be some stuff missing from the debug output. For example, > there's lines like: "debug3: entering", which should have a function name in > the middle. Is that how they appear on the screen? > And this one is a wild guess: do you have "PermitEmptyPasswords" set to "yes" > and does the behaviour change if it's set to "no"? Compiling without Kerberos libs (omitting --with-kerberos) yields an sshd binary that does NOT crash. (In reply to comment #7) > Compiling without Kerberos libs (omitting --with-kerberos) yields an sshd > binary that does NOT crash. OK then my guess is it's one of 2 things: 1) There's a block of code in auth-krb5.c that stores the Kerberos Credential Cache where PAM can find it ("do_pam_putenv("KRB5CCNAME", authctxt->krb5_ccname);"). Perhaps this is confusing the PAM modules (but it should only be done on a successful krb authentication). You can try commenting it out. 2) You're linking sshd with self-built MIT krb5 but the PAM modules are built against Solaris' native kerberos and these binary compatible. (In reply to comment #6) > > There seems to be some stuff missing from the debug output. For example, > > there's lines like: "debug3: entering", which should have a function name in > > the middle. Is that how they appear on the screen? > > Yes OK this at least is solved: the missing names are supplied by the __func__ macro. It would appear that your compiler doesn't support it (or needs a flag to enable it or something). (In reply to comment #8) > and these [are not] binary compatible. This is supposition on my part, BTW. I'm not sure what's supposed to happen when name clashes occur between an app and PAM modules or other libraries that they dlopen (but I would have bet on the answer being "nothing good"). It would seem that if this is indeed the cause of the problem then you could a) remove the pam_krb5 modules from the stack and rely on sshd's built-in support or b) build openssh with the Solaris native krb5 libraries (I've not tried this). (In reply to comment #10) > (In reply to comment #8) > a) remove the pam_krb5 modules from the stack and rely on sshd's built-in > support or b) build openssh with the Solaris native krb5 libraries (I've not > tried this). Alas, Solaris provides no native client krb5 libraries (just kadm and the mech_krb5 libs, which are missing a handful of functions) I've recompiled with gcc and the __func__ messages all work much better. I might drop in my own pam_krb5 (compiled with MIT libs) and see if that fares any better. jd Hi, did changing the krb5 libraries help? three months and no reply == no bug Change all RESOLVED bug to CLOSED with the exception of the ones fixed post-4.4. |