CentOS - Feb 2015 - CentOS 6.5 OpenSSH PAM config

Sorry - without the signing this time.


Hello.

Our products use CentOS 6.5 and we would like to deploy them with custom
openssh RPMs. I have downloaded the sources from
http://athena.caslab.queensu.ca/pub/OpenBSD/OpenSSH/portable and built
the RPMs, but the PAM  configuration file is wrong after installation.

When I install the default openssh-5.3p1 RPMs from the CentOS 6.5
repository, the configuration looks like this:

    # cat /etc/pam.d/sshd

    #%PAM-1.0
    auth       required    pam_sepermit.so
    auth       include      password-auth
    account    required     pam_nologin.so
    account    include      password-auth
    password   include      password-auth
    # pam_selinux.so close should be the first session rule
    session    required     pam_selinux.so close
    session    required     pam_loginuid.so
    # pam_selinux.so open should only be followed by sessions to be executed
    in the
    user context
    session    required     pam_selinux.so open env_params
    session    optional     pam_keyinit.so force revoke
    session    include      password-auth

However, when I rebuild this exact RPM from the source and install it, I
get the following:

    # cat /etc/pam.d/sshd

    #%PAM-1.0
    auth       required     pam_stack.so service=system-auth
    account    required     pam_nologin.so
    account    required     pam_stack.so service=system-auth
    password   required     pam_stack.so service=system-auth
    session    required     pam_stack.so service=system-auth

I was wondering if there are any build logs that would show how the
openssh RPMs were built from the source for CentOS 6.5. Perhaps there is
some type of configuration I am missing that would ensure that I get the
same PAM configuration.

Thanks!

On Feb 20, 2015 3:21 PM, "Christian Kittlitz" <ckittlitz at
gmail.com> wrote:
>
>
> I was wondering if there are any build logs that would show how the
> openssh RPMs were built from the source for CentOS 6.5. Perhaps there is
> some type of configuration I am missing that would ensure that I get the
> same PAM configuration.
>
>
Get the source rpm and look at the spec file:

http://vault.centos.org/6.6/updates/Source/SPackages/openssh-5.3p1-104.el6_6.1.src.rpm

Incidentally why do you have a need to rebuild on upstream ... And the
mandatory get on 6.6 since you are heavily exploitable on with no updates
on 6.5 ;)