openssh unix dev - Nov 2004 - conversation function for pam_acct_mgmt failing?

I'm trying to use PAM on Solaris 8 with sshd (openssh 3.9p1) to run
the pam_acct_mgmt function and give some feedback to the user
if/when their account doesn't meet the necessary local requirements.

Things work fine when I use rlogin, i.e. a user gets authenticated
by typing in their password, and if their account has been suspended
(locally written programs maintain a database which a pam module checks),
they receive a nice message that tells them why their login failed.  
When I use sshd, the functionality is correct (logins fail after authentication
if account is suspended), except that the message to the user never makes it
to their screen.  I've used debugging to show that the message does make it 
to the conversation function, but the message never prints out.

I found some archived email to this list with:

 Subject:  PATCH: Public key authentication defeats passwd age warning.

that sounds like it is closely related from Sep. 2004, but applying the
patch found there hasn't helped my situation.  I tried forcing the use
of various conversation functions, (sshpam_store_conv, sshpam_tty_conv,
sshpam_passwd_conv) but can't get anything to print to the users
terminal.

I've seen other posts which suggest that using posix_threads may work,
but only if all other modules are thread-safe, and that this is not
the preferred workaround.

I'm running out of things to try, hence this post.

Brian Parent wrote:
> I'm trying to use PAM on Solaris 8 with sshd (openssh 3.9p1) to run
> the pam_acct_mgmt function and give some feedback to the user
> if/when their account doesn't meet the necessary local requirements.
> 
> Things work fine when I use rlogin, i.e. a user gets authenticated
> by typing in their password, and if their account has been suspended
> (locally written programs maintain a database which a pam module checks),
> they receive a nice message that tells them why their login failed.  
> When I use sshd, the functionality is correct (logins fail after
authentication
> if account is suspended), except that the message to the user never makes
it
> to their screen.  I've used debugging to show that the message does
make it
> to the conversation function, but the message never prints out.
Funny you should mention that, it's been fixed in -current.  Well, mostly.

The problem is that although the conversation works, there wasn't an 
easy way to get the messages to the user.  Post-3.9, we added some code 
to pass the message from the monitor to the slave, and to send it (in 
one of several ways) to the user if the auth or session modules fail. 
(The attached "pam-merged" patch contains a backport of those changes
to
3.9p1.)

At the moment, for auth modules, it'll return the message but won't 
terminate the connection, so the user can try to reauthenticate 
(although it will never succeed).  There's still a patch pending to fix 
this ("pam-disconnect", attached, which applies on top of
"pam-merged").

It won't fix the SSHv2 keyboard-interactive (which needs some additional 
work), so you'll need to disable it and enable PasswordAuthentication, 
but it should work for all other auth types.

Try them (either both on 3.9p1, or just "pam-disconnect" on a
snapshot)
and let us know how it goes.

-- 
Darren Tucker (dtucker at zip.com.au)
GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4  37C9 C982 80C7 8FF4 FA69
     Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: openssh-pam-merged.patch
Url:
http://lists.mindrot.org/pipermail/openssh-unix-dev/attachments/20041116/99460003/attachment.ksh
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: openssh-pam-disconnect.patch
Url:
http://lists.mindrot.org/pipermail/openssh-unix-dev/attachments/20041116/99460003/attachment-0001.ksh