freebsd security - Jul 2007 - sudo + pam_lastlog causes user to appear logged out in logs.

Hi, this was originally reported on ports@. [1]  Someone noticed that
after after running sudo their session disappeared when running `w`
afterwards.  I've done a little experimenting and this is caused when
pam_lastlog.so is included in sudo's pam file.  This results in the user
still being logged in though according to the system logs the user has
logged out.  Here's an example:

[tom@releng-7-fbsd tom]$ w
12:50AM  up 6 days, 12:30, 2 users, load averages: 0.24, 0.31, 0.30
USER             TTY      FROM              LOGIN@  IDLE WHAT
tom              p0       bofh             12:50AM     - w

[tom@releng-7-fbsd tom]$ last
tom              ttyp0    bofh             Mon Jul 23 00:50   still logged in
...

[tom@releng-7-fbsd tom]$ sudo kill
...

[tom@releng-7-fbsd tom]$ w
12:53AM  up 6 days, 12:34, 1 user, load averages: 0.17, 0.22, 0.25
USER             TTY      FROM              LOGIN@  IDLE WHAT

[tom@releng-7-fbsd tom]$ last
root             ttyp0                     Mon Jul 23 00:53 - 00:53  (00:00)
tom              ttyp0    bofh             Mon Jul 23 00:50 - 00:53  (00:03)

I can confirm this on -CURRENT and -STABLE.  I tested on a CentOS 5.0
box and their pam_lastlog does not cause this with sudo so it appears to
be an issue specific to ours.  Can someone take a look into this?  Also,
is there any way sudo can work around this?  Right now I've commented
out the session line in the pam file that is installed by the port so
most users will not be affected.  Thanks.

[1] http://lists.freebsd.org/pipermail/freebsd-ports/2007-July/042746.html

tom
-- 
| tmclaugh at sdf.lonestar.org             tmclaugh at FreeBSD.org |
| FreeBSD                                   http://www.FreeBSD.org |

Tom McLaughlin <tmclaugh@sdf.lonestar.org> writes:
> Hi, this was originally reported on ports@. [1]  Someone noticed that
> after after running sudo their session disappeared when running `w`
> afterwards.  I've done a little experimenting and this is caused when
> pam_lastlog.so is included in sudo's pam file.  This results in the
user
> still being logged in though according to the system logs the user has
> logged out.
There can only be one user at a time on a tty; if sudo records the
target user in wtmp, information about the invoking user being logged in
is overwritten.  When sudo "logs out" the target user, it is as if
nobody is logged in on that tty.  Therefore neither su nor sudo should
invoke pam_lastlog; FreeBSD's PAM configuration for su does not, and
neither do e.g. Debian's or Ubuntu's PAM configurations for su and sudo.
> I can confirm this on -CURRENT and -STABLE.  I tested on a CentOS 5.0
> box and their pam_lastlog does not cause this with sudo so it appears to
> be an issue specific to ours.  Can someone take a look into this?  Also,
> is there any way sudo can work around this?  Right now I've commented
> out the session line in the pam file that is installed by the port so
> most users will not be affected.  Thanks.
It is bad form to leave a service unconfigured in a PAM stack, as PAM
will fall back to the default stack (if one exists) which may not be
what you want.  Instead, use pam_permit.

DES
-- 
Dag-Erling Sm?rgrav - des@des.no