When the last conversation from PAM module is of type PAM_TEXT_INFO, the last message "User admin has authenticated successfully" is displayed twice as can be seen in the output from our module: $ ssh ascz@client.vm.scz-vm.net (ascz@client.vm.scz-vm.net) Please sign in to: https://sbs.scz-vm.net/weblogin/weblogin/d8b054d3-8082-4278-8947-82973ffffb77 Verification code: User admin has authenticated successfully User admin has authenticated successfully Last login: Mon Oct 10 13:27:31 2022 from 172.20.1.1 The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright. Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. However, when I add a conversation "Press Enter to continue" of type PAM_PROMPT_ECHO_OFF just before the PAM module returns, I get this: $ ssh ascz@client.vm.scz-vm.net (ascz@client.vm.scz-vm.net) Please sign in to: https://sbs.scz-vm.net/weblogin/weblogin/fd0cc5e5-a0f4-4eb6-a14b-68196ed7110f Verification code: (ascz@client.vm.scz-vm.net) User admin has authenticated successfully Press Enter to continue Last login: Mon Oct 10 13:33:12 2022 from 172.20.1.1 The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright. Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. Pamtester does not exhibit this behaviour. The PAM module code, for reference: https://github.com/SURFscz/pam-weblogin
Created attachment 3677 [details] Minimal test case Attached is a minimal test case that shows the observed behaviour in all it's glory. It includes the tty_output() in the same we include it in our module. It was compiled on ubuntu 22.10 using: $ gcc pam_test.c -shared -o pam_test.so -lpam copied to /usr/local/lib/security $ sudo cp pam_test.so /usr/local/lib/security/pam_test.so activated as a pam module in /etc/pam.d/sshd just above common-account ... auth required /usr/local/lib/security/pam_test.so # Standard Un*x authorization. @include common-account tested using pamtester: $ pamtester sshd martin authenticate Password: Info pamtester: successfully authenticated tested using sshd: $ ssh localhost (martin@localhost) Password: Info Info Welcome to Ubuntu 22.10 (GNU/Linux 6.1.11 x86_64) Which clearly shows the double output of the last (and only) PAM_TEXT_INFO message.