openssh bugs - Nov 2025 - [Bug 3893] New: behavior change in adding pid to utmp

https://bugzilla.mindrot.org/show_bug.cgi?id=3893

            Bug ID: 3893
           Summary: behavior change in adding pid to utmp
           Product: Portable OpenSSH
           Version: 9.9p2
          Hardware: PPC
                OS: AIX
            Status: NEW
          Severity: normal
          Priority: P5
         Component: sshd
          Assignee: unassigned-bugs at mindrot.org
          Reporter: sanumesh at in.ibm.com

Issue:

We see a change in behavior between openssh 9.7 and 9.9 version.

OpenSSH 9.7 adds the ksh pid entry into the utmp file whereas 9.9
version adds sshd-session pid into the utmp file.

OpenSSH 9.9 behavior:

# ps -ef | grep "pts\/1"
    root  9568528 12583224   0 10:39:16  pts/1  0:00 ps -ef
    root 12583224 15401470   0 10:37:39  pts/1  0:00 -ksh     
    root 15401470 11010486   0 10:37:35      -  0:00 sshd-session:
root at pts/1.

# /usr/sbin/acct/fwtmp  <  /etc/utmp > /tmp/utmp.out

# grep 15401470 /tmp/utmp.out
root     pts/1          pts/1         7 15401470 0000 25721 1762274259
10.230.41.116

The utmp entry is created for 15401470 (corresponding to sshd-session),
however the lower pid is ksh (12583224)

Impact:
Functionality break in exeuction of login command after ssh:
# login root
/dev/pts/1: 3004-004 You must "exec" login from the lowest login
shell.


Analysis:
This could possibly be due to execution of getpid() and adding utmp
entry after the sshd-session process is exec'd unlike in 9.7 version
where getpid was called after authentication.

-- 
You are receiving this mail because:
You are watching the assignee of the bug.