Bug 2622 - PAM stack sometimes will not run during auth and this causes auths to fail
Summary: PAM stack sometimes will not run during auth and this causes auths to fail
Status: CLOSED INVALID
Alias: None
Product: Portable OpenSSH
Classification: Unclassified
Component: PAM support (show other bugs)
Version: 4.3p2
Hardware: ix86 Linux
: P5 normal
Assignee: Assigned to nobody
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2016-10-08 01:58 AEDT by desaiar
Modified: 2018-04-06 12:26 AEST (History)
1 user (show)

See Also:


Attachments
Config Files and Debug Logs (8.96 KB, application/zip)
2016-10-08 01:58 AEDT, desaiar
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description desaiar 2016-10-08 01:58:53 AEDT
Created attachment 2877 [details]
Config Files and Debug Logs

I am running Centos 5 OpenSSH 4.3p2-82.0.2
This patch for the portable version has caused a bug where my PAM stack is sometimes not being run. Attempting to connect about 70% of the time will give me a failure, but occasionally I will see the password prompt from pam_unix and be allowed to auth successfully.

Upgrading and downgrading between 4.3p2-82.0.1 and 4.3p2-82.0.2 has shown me that the issue is connected to this patch in some way. In 4.3p2-82.0.1 I always get directed to perform PAM authentication and can auth. I've attached the two new patch files for this version to help debugging. Since I'm using challenge response authentication I believe it is more related to the keyboard-interactive patch.

I've also included my sshd_config file. I believe the interesting callouts are:
PasswordAuthentication no
ChallengeResponseAuthentication yes
UsePAM yes

I have included the relevant PAM stack files as well.

For debugging I've attached part of the client logs with -vvv and part of the server logs with -ddd.

The logs seem to suggest that it knows to run the PAM stack but then somewhere the connection does not succeed. 

Please let me know if there is anything else I can do to help troubleshoot this issue.
Comment 1 Darren Tucker 2016-10-09 16:22:08 AEDT
(In reply to desaiar from comment #0)
> I am running Centos 5 OpenSSH 4.3p2-82.0.2

That is a vendor-modified version of a ten year old OpenSSH release.

Can you reproduce the problem with the current release (7.3p1) build from the source available at openssh.com?  If not then you need to talk to the vendor for help.
Comment 2 Darren Tucker 2016-10-15 03:55:09 AEDT
Please reopen if you can reproduce with the current version as available from openssh.com, otherwise please report this problem to the package's vendor.
Comment 3 Damien Miller 2018-04-06 12:26:40 AEST
Close all resolved bugs after release of OpenSSH 7.7.