* [gentoo-dev] openssh 3.6.1_p2 problem with pam (fwd)
@ 2003-05-03 10:16 99% Andrea Barisani
0 siblings, 0 replies; 1+ results
From: Andrea Barisani @ 2003-05-03 10:16 UTC (permalink / raw
To: gentoo-dev
Hi folks, I'm having problems with pam and openssh 3.6.1_p2, I've contacted
openssh-dev and I've received some replies, could someone confirm that I am
not the only one to exeprience this problem?
I'm including my original post to openssh-dev and the reply with a patch.
What do you think?
Bye
----------------------------------------------------------------------------------------
Andrea Barisani wrote:
>
> ----- Forwarded message from Andrea Barisani <lcars@infis.univ.trieste.it> -----
>
> Date: Fri, 2 May 2003 14:01:33 +0200
> From: Andrea Barisani <lcars@infis.univ.trieste.it>
> To: openssh@openssh.com
> Subject: openssh 3.6.1_p2 problem with pam
>
> Hi, I've just updated to openssh 3.6.1_p2 and I notice this behaviour:
>
> # ssh -l lcars mybox
> [2 seconds delay]
> lcars@mybox's password:
>
> In the logs I have:
>
> May 2 13:57:11 sole sshd(pam_unix)[19663]: authentication failure; logname= uid=0 euid=0 tty=NODEVssh ruser= rhost=homer.infis.univ.trieste.it user=lcars
> May 2 13:57:13 sole sshd(pam_unix)[19665]: session opened for user lcars by (uid=817)
>
> The first line is logged _before_ sshd prompt the password and that's the
> cause of the delay since I'm not using nodelay option in system-auth.
>
> The second one is logged after I enter the correct password.
>
> I don't suppose that this is a correct beahviour, what do you think?
>
> Thanks a lot.
>
> Bye
>
Yes, it's not correct behavior. However, this isn't new to 3.6.1.
Not sure why you're only seeing it now.
This should help you out:
--- openssh/auth1.c Sun Feb 23 16:59:27 2003
+++ openssh/auth1.c Thu May 1 22:27:29 2003
@@ -80,7 +80,7 @@
authctxt->valid ? "" : "illegal user ", authctxt->user);
/* If the user has no password, accept authentication immediately. */
- if (options.password_authentication &&
+ if (options.password_authentication && options.permit_empty_passwd &&
#if defined(KRB4) || defined(KRB5)
(!options.kerberos_authentication || options.kerberos_or_local_passwd) &&
#endif
--- openssh/auth2-none.c Tue Apr 29 02:12:08 2003
+++ openssh/auth2-none.c Thu May 1 22:27:29 2003
@@ -100,6 +100,25 @@
if (check_nt_auth(1, authctxt->pw) == 0)
return(0);
#endif
+
+ /*
+ * REDACTED
+ * REDACTED
+ * REDACTED
+ * REDACTED
+ * REDACTED
+ * REDACTED
+ * REDACTED
+ * REDACTED
+ * REDACTED
+ * REDACTED
+ * REDACTED
+ * REDACTED
+ * REDACTED
+ */
+ if (!options.permit_empty_passwd)
+ return(0);
+
return PRIVSEP(auth_password(authctxt, "")) && authctxt->valid;
}
----------------------------------------------------------------------------------------
On Sat, May 03, 2003 at 12:24:44AM +0200, Andrea Barisani wrote:
> I suppose that we'll be seeing this patch in the next version, am I right?
I don't think so. The openssh team has been generally resistant[1] to most
of my pam suggestions. I have stopped submitting them at this point.
/fc
[1] Not that I fault them for it. PAM is hard to wedge into openssh
nicely. Esp. now with privsep.
--
gentoo-dev@gentoo.org mailing list
^ permalink raw reply [relevance 99%]
Results 1-1 of 1 | reverse | options above
-- pct% links below jump to the message on this page, permalinks otherwise --
2003-05-03 10:16 99% [gentoo-dev] openssh 3.6.1_p2 problem with pam (fwd) Andrea Barisani
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox