1 |
Hi folks, I'm having problems with pam and openssh 3.6.1_p2, I've contacted |
2 |
openssh-dev and I've received some replies, could someone confirm that I am |
3 |
not the only one to exeprience this problem? |
4 |
|
5 |
I'm including my original post to openssh-dev and the reply with a patch. |
6 |
|
7 |
What do you think? |
8 |
|
9 |
Bye |
10 |
|
11 |
---------------------------------------------------------------------------------------- |
12 |
|
13 |
Andrea Barisani wrote: |
14 |
> |
15 |
> ----- Forwarded message from Andrea Barisani <lcars@××××××××××××××××××.it> ----- |
16 |
> |
17 |
> Date: Fri, 2 May 2003 14:01:33 +0200 |
18 |
> From: Andrea Barisani <lcars@××××××××××××××××××.it> |
19 |
> To: openssh@×××××××.com |
20 |
> Subject: openssh 3.6.1_p2 problem with pam |
21 |
> |
22 |
> Hi, I've just updated to openssh 3.6.1_p2 and I notice this behaviour: |
23 |
> |
24 |
> # ssh -l lcars mybox |
25 |
> [2 seconds delay] |
26 |
> lcars@mybox's password: |
27 |
> |
28 |
> In the logs I have: |
29 |
> |
30 |
> May 2 13:57:11 sole sshd(pam_unix)[19663]: authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser= rhost=homer.infis.univ.trieste.it user=lcars |
31 |
> May 2 13:57:13 sole sshd(pam_unix)[19665]: session opened for user lcars by (uid=817) |
32 |
> |
33 |
> The first line is logged _before_ sshd prompt the password and that's the |
34 |
> cause of the delay since I'm not using nodelay option in system-auth. |
35 |
> |
36 |
> The second one is logged after I enter the correct password. |
37 |
> |
38 |
> I don't suppose that this is a correct beahviour, what do you think? |
39 |
> |
40 |
> Thanks a lot. |
41 |
> |
42 |
> Bye |
43 |
> |
44 |
|
45 |
|
46 |
Yes, it's not correct behavior. However, this isn't new to 3.6.1. |
47 |
Not sure why you're only seeing it now. |
48 |
|
49 |
This should help you out: |
50 |
|
51 |
--- openssh/auth1.c Sun Feb 23 16:59:27 2003 |
52 |
+++ openssh/auth1.c Thu May 1 22:27:29 2003 |
53 |
@@ -80,7 +80,7 @@ |
54 |
authctxt->valid ? "" : "illegal user ", authctxt->user); |
55 |
|
56 |
/* If the user has no password, accept authentication immediately. */ |
57 |
- if (options.password_authentication && |
58 |
+ if (options.password_authentication && options.permit_empty_passwd && |
59 |
#if defined(KRB4) || defined(KRB5) |
60 |
(!options.kerberos_authentication || options.kerberos_or_local_passwd) && |
61 |
#endif |
62 |
--- openssh/auth2-none.c Tue Apr 29 02:12:08 2003 |
63 |
+++ openssh/auth2-none.c Thu May 1 22:27:29 2003 |
64 |
@@ -100,6 +100,25 @@ |
65 |
if (check_nt_auth(1, authctxt->pw) == 0) |
66 |
return(0); |
67 |
#endif |
68 |
+ |
69 |
+ /* |
70 |
+ * REDACTED |
71 |
+ * REDACTED |
72 |
+ * REDACTED |
73 |
+ * REDACTED |
74 |
+ * REDACTED |
75 |
+ * REDACTED |
76 |
+ * REDACTED |
77 |
+ * REDACTED |
78 |
+ * REDACTED |
79 |
+ * REDACTED |
80 |
+ * REDACTED |
81 |
+ * REDACTED |
82 |
+ * REDACTED |
83 |
+ */ |
84 |
+ if (!options.permit_empty_passwd) |
85 |
+ return(0); |
86 |
+ |
87 |
return PRIVSEP(auth_password(authctxt, "")) && authctxt->valid; |
88 |
} |
89 |
|
90 |
---------------------------------------------------------------------------------------- |
91 |
|
92 |
On Sat, May 03, 2003 at 12:24:44AM +0200, Andrea Barisani wrote: |
93 |
> I suppose that we'll be seeing this patch in the next version, am I right? |
94 |
|
95 |
I don't think so. The openssh team has been generally resistant[1] to most |
96 |
of my pam suggestions. I have stopped submitting them at this point. |
97 |
|
98 |
/fc |
99 |
[1] Not that I fault them for it. PAM is hard to wedge into openssh |
100 |
nicely. Esp. now with privsep. |
101 |
|
102 |
|
103 |
|
104 |
-- |
105 |
gentoo-dev@g.o mailing list |