openssh unix dev - Apr 2004 - OpenSSH bug: server debug output sent to client

Hello SSH developers,

When using the sshd '-d' switch, then the following problem occurs
when a connecting client uses the ssh1 protocol: part of the server's
debug output is not printed to (the server's) stderr, but delivered
to the client (to the client's stderr). Verified with the FreeBSD
version of sshd, and with sshd-3.7.1p2

--snip--server:
# /usr/sbin/sshd -ddd
debug1: sshd version OpenSSH_3.5p1 FreeBSD-20030924
...
debug1: Server will not fork when running in debugging mode.
debug1: res_init()
Connection from 127.0.0.1 port 2959
debug1: Client protocol version 1.5; client software version OpenSSH_3.5p1
FreeBSD-20030924
...
Found matching RSA1 key: 6e:b3:aa:3c:0a:8e:74:f3:de:da:f2:0c:39:d6:f0:19
Accepted rsa for martin from 127.0.0.1 port 2959
...
debug1: session_new: init
debug1: session_new: session 0
debug1: Installing crc compensation attack detector.
debug1: Exec command 'id'
debug1: PAM: setting PAM_TTY to "(null)"
debug1: PAM: establishing credentials
debug1: Entering interactive session.
debug1: fd 8 setting O_NONBLOCK
debug2: fd 8 is O_NONBLOCK
debug1: fd 10 setting O_NONBLOCK
debug1: Received SIGCHLD.
debug1: fd 4 setting O_NONBLOCK
debug1: fd 9 setting O_NONBLOCK
debug1: server_init_dispatch_13
debug1: server_init_dispatch_15
debug1: End of interactive session; stdin 0, stdout (read 147, sent 147), stderr
649 bytes.
...
--snip--

--snip--client:
$ ssh -1 localhost id
debug3: Copy environment:
PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/games:/usr/local/sbin:/usr/local/bin:/usr/X11R6/bin:/home/martin/bin
debug3: Copy environment: MAIL=/var/mail/martin
debug3: Copy environment: BLOCKSIZE=K
debug3: Copy environment: FTP_PASSIVE_MODE=YES
debug1: PAM: retrieving environment
Environment:
  USER=martin
  LOGNAME=martin
  HOME=/home/martin
  MAIL=/var/mail/martin
 
PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/games:/usr/local/sbin:/usr/local/bin:/usr/X11R6/bin:/home/martin/bin
  TERM=su
  BLOCKSIZE=K
  FTP_PASSIVE_MODE=YES
  SHELL=/bin/tcsh
  SSH_CLIENT=127.0.0.1 2959 22
  SSH_CONNECTION=127.0.0.1 2959 127.0.0.1 22
uid=2800(martin) gid=1001(kraemer) groups=1001(kraemer), 0(wheel), 5(operator),
68(dialer), 1005(com5), 2000(cvs), 3000(machines), 3001(domainadm)
--snip--

The expected output would have been just the "uid=2800..." line

   Martin
-- 
<Martin.Kraemer at Fujitsu-Siemens.com>         |     Fujitsu Siemens
Fon: +49-89-636-46021, FAX: +49-89-636-47655 | 81730  Munich,  Germany

Martin Kraemer wrote:
> When using the sshd '-d' switch, then the following problem occurs
> when a connecting client uses the ssh1 protocol: part of the server's
> debug output is not printed to (the server's) stderr, but delivered
> to the client (to the client's stderr). Verified with the FreeBSD
> version of sshd, and with sshd-3.7.1p2
Those debugs are from after the daemon has forked and set up its 
stdin/stdout/stderr descriptors but before it's exec's the shell.

-- 
Darren Tucker (dtucker at zip.com.au)
GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4  37C9 C982 80C7 8FF4 FA69
     Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.