Bug 114

Summary: Invalid users vs. PAM (protocol 1 only (?))
Product: Portable OpenSSH Reporter: Pavel Kankovsky <peak>
Component: sshdAssignee: OpenSSH Bugzilla mailing list <openssh-bugs>
Status: CLOSED FIXED    
Severity: minor    
Priority: P2    
Version: -current   
Hardware: All   
OS: Linux   
Attachments:
Description Flags
Fake username for invalid ssh protocol 1 users none

Description Pavel Kankovsky 2002-02-13 12:10:56 AEDT 
do_authentication() in auth1.c does not call start_pam() for invalid users but
auth_pam_password() calls do_pam_set_conv() before it checks user validity. This
means pam_set_item() is called will NULL pamh and Linux PAM is unhappy and
syslogs a complaint (see
http://archives.neohapsis.com/archives/pam-list/2001-04/0111.html).
Comment 1 Damien Miller 2002-02-13 23:00:14 AEDT 
Created attachment 24 [details]
Fake username for invalid ssh protocol 1 users
Comment 2 Damien Miller 2002-02-13 23:00:45 AEDT 
Does the attached patch help?
Comment 3 Damien Miller 2002-02-14 20:39:02 AEDT 
It works for me - committing.
Comment 4 Andrew Bartlett 2002-02-15 00:06:15 AEDT 
Why NOUSER?

What is wrong with the user they specified?  Why can't we do the full auth for
the user - let PAM do its thing and then bail?

This would allow users who use pam_unix's 'audit' flag (for example) to get
accurate and consistant failed password logs across all deamons on a system.

Then, if for some reason PAM still thinks they are perfectly valid (despite no
/etc/passwd entry) *then* we kill it off.  

How does this sound?

I'll propose a patch if required.
Comment 5 Damien Miller 2002-02-15 00:26:39 AEDT 
NOUSER hides disclosure of passwords from users who accidentally type their
password into a login prompt.

please open another buf if you want to change the functionality.
Comment 6 Pavel Kankovsky 2002-02-15 01:21:48 AEDT 
Well, when a user types his/her password as a login name, it will probably
appear in the log anyway (in a message generated by sshd itself:
Feb 14 15:07:14 kunhuta sshd[17775]: Failed password for illegal user blabla
from 127.0.0.1 port 2995).
Nevertheless, the patch appears to solve the problem I reported.
Comment 7 Damien Miller 2004-04-14 12:24:18 AEST 
Mass change of RESOLVED bugs to CLOSED