Bug 890 - Allow users to see output from failing PAM session modules.
Summary: Allow users to see output from failing PAM session modules.
Status: CLOSED FIXED
Alias: None
Product: Portable OpenSSH
Classification: Unclassified
Component: PAM support (show other bugs)
Version: -current
Hardware: Other All
: P2 normal
Assignee: OpenSSH Bugzilla mailing list
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2004-07-03 18:54 AEST by Darren Tucker
Modified: 2006-10-07 11:36 AEST (History)
0 users

See Also:

Attachments
If do_pam_session fails, end output to user then close session. (1.95 KB, patch)
2004-07-03 18:57 AEST, Darren Tucker 		no flags Details | Diff
Make work for privsep=no too (1.95 KB, patch)
2004-07-04 11:21 AEST, Darren Tucker 		djm: ok+
Details | Diff
Show Obsolete (1) View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Darren Tucker 2004-07-03 18:54:21 AEST 
Because a failure in do_pam_session causes an immediate fatal(), the connection
exits uncleanly, eg, with the following PAM config:
session required pam_motd.so motd=/etc/mynologin
session required pam_deny.so

Attempting to log in will result in:
testuser@localhost's password:
Read from remote host localhost: Connection reset by peer
Connection to localhost closed.
Comment 1 Darren Tucker 2004-07-03 18:57:31 AEST 
Created attachment 678 [details]
If do_pam_session fails, end output to user then close session.

Patch to fix.  If a PAM session module fails, this is what happens:
$ ssh testuser@localhost
testuser@localhost's password:
No user logins right now.

Connection to localhost closed.
Comment 2 Darren Tucker 2004-07-04 11:21:34 AEST 
Created attachment 679 [details]
Make work for privsep=no too
Comment 3 Damien Miller 2004-09-11 18:43:02 AEST 
Comment on attachment 679 [details]
Make work for privsep=no too

ok
Comment 4 Darren Tucker 2004-09-11 22:17:56 AEST 
Thanks, applied.
Comment 5 Darren Tucker 2006-10-07 11:36:27 AEST 
Change all RESOLVED bug to CLOSED with the exception of the ones fixed post-4.4.