Bug 2502

Summary:	using AuthenticationMethods to require s/key and pam doesn't work
Product:	Portable OpenSSH	Reporter:	Kevin Korb <kmk>
Component:	sshd	Assignee:	Assigned to nobody <unassigned-bugs>
Status:	CLOSED FIXED
Severity:	normal	CC:	djm
Priority:	P5
Version:	7.1p1
Hardware:	amd64
OS:	Linux
Bug Depends on:
Bug Blocks:	2451

Description Kevin Korb 2015-11-20 08:42:34 AEDT

If I put in sshd_config:
UsePAM yes
AuthenticationMethods keyboard-interactive:skey,keyboard-interactive:pam
ChallengeResponseAuthentication yes
(PasswordAuthentication yes or no doesn't matter)

I would expect to be prompted for an s/key challenge then whatever is supported by pam.  The intention is to make pam require google authenticator but I have tried this with Gentoo's stock password setup too.

When I connect I get partial authentication success from s/key but then the server hangs up on me.  When I put sshd in debug mode I get this:
...
debug1: authentication methods list 0: keyboard-interactive:skey,keyboard-interactive:pam
debug1: authentication methods list 0: keyboard-interactive:skey,keyboard-interactive:pam [preauth]
debug1: PAM: initializing for "kmk"
debug1: PAM: setting PAM_RHOST to "172.22.100.17"
debug1: PAM: setting PAM_TTY to "ssh"
debug1: userauth-request for user kmk service ssh-connection method keyboard-interactive [preauth]
debug1: attempt 1 failures 0 [preauth]
debug1: keyboard-interactive devs  [preauth]
debug1: auth2_challenge: user=kmk devs= [preauth]
debug1: kbdint_alloc: devices 'pam,skey' [preauth]
debug1: auth2_challenge_start: trying authentication method 'skey' [preauth]
Postponed keyboard-interactive for kmk from 172.22.100.17 port 56339 ssh2 [preauth]
auth2_update_methods_lists: method not in AuthenticationMethods
debug1: do_cleanup
debug1: PAM: cleanup
debug1: Killing privsep child 1596

I see in the source above that error message:
/* This should not happen, but would be bad if it did */
So maybe this is an unhandled use case?

Comment 1 Kevin Korb 2015-11-20 10:13:09 AEDT

I worked with feandil_ in IRC on this issue and he came up with this patch which appears to solve my problem:
--- a/monitor.c
+++ b/monitor.c
@@ -1044,7 +1044,8 @@ mm_answer_skeyrespond(int sock, Buffer *m)
        debug3("%s: sending authenticated: %d", __func__, authok);
        mm_request_send(sock, MONITOR_ANS_SKEYRESPOND, m);

-       auth_method = "skey";
+       auth_method = "keyboard-interactive";
+       auth_submethod = "skey";

        return (authok != 0);
 }

Also, we discovered that the problem doesn't happen if UsePrivilegeSeparation is off.

Comment 2 Damien Miller 2015-11-20 12:47:50 AEDT

Patch applied: 

https://anongit.mindrot.org/openssh.git/commit/?id=ac9473580dcd401f8281305af98635cdaae9bf96

This will be in OpenSSH 7.2 - thanks!

Comment 3 Kevin Korb 2015-11-21 05:45:23 AEDT

Excellent.  Thank you.

Comment 4 Damien Miller 2016-08-02 10:41:53 AEST

Close all resolved bugs after 7.3p1 release