What I'm seeing: ---------------- When a user login hits a "Match" section, the pam modules seem to be unable to use stdout. Steps to repro: --------------- I'm running an almost vanilla openssh installation inside a ubuntu:bionic container. In here, I append the following to the bottom of the file: ``` Match Group foobar ForceCommand bash ``` Next, I add 2 users to the system, named `foobar` and `bazbaz` . Next, I add some text to the MOTD file (/etc/motd). Next, I also modify the /etc/pam.d/sshd config to contain these: ``` session optional pam_motd.so noupdate session optional pam_exec.so stdout /bin/echo ECHOECHO ``` So when I log in using `bazbaz` I see that the motd and the stdout message appears (as emitted by the PAM module). Also the PrintLastLog directive kicks in and the last login is also printed. However when I log in using `foobar` (where the Match directive kicks in) then I see neither the motd, nor the stdout message, nor the lastlog. This leads me to believe that stdout handling is somehow different when the Match is hit. I would have suspected the pam modules (or libpam) but since the LastLog is an `sshd` function, I'm inclined to believing this is somehow related to stdout (hence marking the component as 'sshd'). Not sure if this is a bug or a case of missing documentation.
Bumping up importance (P = priority?) to see if I can get some visibility.
stdout isn't attached in any case. The session modules record the output of the PAM conversation functions at the end of the authentication phase and it is replayed later when the user has an actual channel over which to send them. The difference is not stdout, but that the login messages are suppressed when a command is executed so as not to pollute the command's stdout.
> The difference is not stdout, but that the login messages are suppressed when a command is executed so as not to pollute the command's stdout. Gotcha. In that case, is there a way to un-suppress those messages? I'm looking to use a `Match` clause along with a ForceCommand to force a particular login shell. When used this way, the login messages cease to work. (I guess I'm in the need for a `ForceShell` if one exists).
I'm not sure - you *might* be able to use a PAM session session - the messages for these are queued and displayed at login time.
workaround provided. Please reopen if it doesn't work
close bugs that were resolved in OpenSSH 8.5 release cycle