Bug 1799 - Unable to login through PAM on Solaris 8 x86 due to PAM_TTY
Summary: Unable to login through PAM on Solaris 8 x86 due to PAM_TTY
Status: CLOSED WORKSFORME
Alias: None
Product: Portable OpenSSH
Classification: Unclassified
Component: PAM support (show other bugs)
Version: 5.5p1
Hardware: ix86 Solaris
: P2 major
Assignee: Assigned to nobody
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2010-07-17 05:32 AEST by Kyle Stemen
Modified: 2021-04-23 15:10 AEST (History)
3 users (show)

See Also:


Attachments
test program that shows what kind of ttys are accepted (6.92 KB, application/rss+xml)
2010-07-17 05:32 AEST, Kyle Stemen
no flags Details
output of 'showrev -p' on solaris system (26.56 KB, text/plain)
2010-07-17 05:35 AEST, Kyle Stemen
no flags Details
openssh-pam_tty.patch (786 bytes, text/plain)
2010-07-20 12:01 AEST, Darren Tucker
no flags Details
showrev -p from my solaris 8/sparc machine (48.60 KB, text/plain)
2010-07-23 15:04 AEST, Darren Tucker
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description Kyle Stemen 2010-07-17 05:32:49 AEST
Created attachment 1899 [details]
test program that shows what kind of ttys are accepted

I downloaded openssh 5.5p1 for Solaris 8 x86 from Sunfreeware at ftp://ftp.sunfreeware.com/pub/freeware/intel/8/openssh-5.5p1-sol8-x86-local.gz .

If I set the UsePAM setting to yes, then no user is able to login. When the server is running with debugging, the client shows:
$ ssh testuser@10.100.3.175 
Password: 
Last login: Fri Jul 16 19:17:14 2010 from kyle-vmserver.c
Sun Microsystems Inc.   SunOS 5.8       Generic February 2000
debug3: PAM session not opened, exiting
Connection to 10.100.3.175 closed.
$ 

The error on the server is:
debug3: PAM: opening session
PAM: pam_open_session(): Can not make/remove entry for session

I have determined the problem is that pam_unix.so.1 does not like the value of PAM_TTY. I see this in the source code:
#ifdef PAM_TTY_KLUDGE
	/*
	 * Some silly PAM modules (e.g. pam_time) require a TTY to operate.
	 * sshd doesn't set the tty until too late in the auth process and
	 * may not even set one (for tty-less connections)
	 */
	debug("PAM: setting PAM_TTY to \"ssh\"");
	sshpam_err = pam_set_item(sshpam_handle, PAM_TTY, "ssh");
	if (sshpam_err != PAM_SUCCESS) {
		pam_end(sshpam_handle, sshpam_err);
		sshpam_handle = NULL;
		return (-1);
	}
#endif


I can tell that Sunfreeware did define PAM_TTY_KLUDGE, because I see this in the server's debug output:
debug1: PAM: setting PAM_TTY to "ssh"

I wrote a test program to show that Solaris 8 does not like this value (attached). Here is the output from the program:
bash-2.03# gcc -Wall -Werror -lpam try_tty.c -o try_tty
bash-2.03# ./try_tty  
Trying without PAM_TTY set
opensession: Can not make/remove entry for session
Trying with PAM_TTY set to 'ssh'
opensession: Can not make/remove entry for session
Trying with PAM_TTY set to '/dev/ssh'
opensession: Success
bash-2.03# ls -l /dev/ssh
/dev/ssh: No such file or directory
bash-2.03# cat /etc/release 
                       Solaris 8 2/02 s28x_u7wos_08a INTEL
           Copyright 2002 Sun Microsystems, Inc.  All Rights Reserved.
                           Assembled 18 December 2001
Comment 1 Kyle Stemen 2010-07-17 05:35:18 AEST
Created attachment 1900 [details]
output of 'showrev -p' on solaris system
Comment 2 Darren Tucker 2010-07-19 13:29:09 AEST
Can you reproduce the problem with the vanilla source from www.openssh.com or is it specific to the build supplied by sunfreeware?
Comment 3 Kyle Stemen 2010-07-20 02:18:04 AEST
Sunfreeware has applied no patches. I compared their source tarball against the one on openssh.com.
Comment 4 Darren Tucker 2010-07-20 12:01:19 AEST
Your test program works fine on my solaris 8 (sparc) machine but it doesn't have recent patches.  I suspect the problem is either introduced in a patch or specific to the x86 version (unlikely).

Changing the kludge to /dev/ssh is a possibility but I am concerned this may impact other platforms negatively.
Comment 5 Darren Tucker 2010-07-20 12:01:45 AEST
Created attachment 1906 [details]
openssh-pam_tty.patch

PAM_TTY_KLUDGE ssh -> /dev/ssh
Comment 6 Kyle Stemen 2010-07-21 02:03:34 AEST
My Solaris machine does not have the latest patches either.

Could you attach the output of 'showrev -p' from your Solaris 8 machine? That command lists the installed patches on the machine. I could compare it with the patches from my system.
Comment 7 Darren Tucker 2010-07-23 15:04:05 AEST
Created attachment 1907 [details]
showrev -p from my solaris 8/sparc machine
Comment 8 Kyle Stemen 2010-07-24 02:20:11 AEST
I am not having trouble on Solaris 8 Sparc either. The difficulty is that different patches apply to Sparc and x86.

Do you have a Solaris 8 x86 machine to try it on?
Comment 9 Damien Miller 2019-07-19 13:56:22 AEST
we were unable to reproduce this; in the unlikely event that you're still using Solaris 8 on x64 and can reproduce this then we might be able to take another look. If this is the case then please reopen the bug
Comment 10 Damien Miller 2021-04-23 15:10:23 AEST
closing resolved bugs as of 8.6p1 release