I am writing to report a bug in openssh-2.3.0p1, and to suggest
a fix.
I have OpenSSH installed on a Solaris 8 box. The output of
uname -a is:
> SunOS dipper.csi.cam.ac.uk 5.8 Generic_108528-06 sun4u sparc
SUNW,Ultra-5_10
OpenSSH was configured with the following options:
> ./configure --prefix=/jackdaw --with-default-path=/jackdaw/bin:/usr/bin
On this OS, with this configuration, it uses PAM.
I have a passwordless account. and passwordless login is
permitted, both by 'PASSREQ=NO' in /etc/default/login and
'PermitEmptyPasswords yes' in sshd_config.
The symptom of the bug is that interactive ssh to the
passwordless account fails. The sshd session process takes
a SIGSEGV just after the debugging message 'PAM setting tty to ...'.
I think that the SIGSEGV is inside pam_open_session. Truss
shows that the lastlog file has just been opened for writing.
Non-interactive uses of ssh work.
The cause is that, on this route through the code,
do_pam_account is _not_ called, but do_pam_session is.
This results in pam_open_session being called with PAM_TTY
set but PAM_RHOST not set. (In the non-interactive case,
PAM_TTY is not set either, so the PAM module does not try
to update lastlog, and so does not look at PAM_RHOST).
The SIGSEGV might be regarded as a bug in Sun's code, but the
failure to set PAM_RHOST in the case of a passwordless login
is a bug in OpenSSH.
I have applied the following patch to my copy. It seems to
fix the problem.
*** auth1.c Thu Mar 1 17:33:31 2001
--- auth1.c.patched Thu Mar 1 17:33:18 2001
***************
*** 455,461 ****
(!options.kerberos_authentication ||
options.kerberos_or_local_passwd) &&
#endif /* KRB4 */
#ifdef USE_PAM
! auth_pam_password(pw, "")) {
#elif defined(HAVE_OSF_SIA)
(sia_validate_user(NULL, saved_argc, saved_argv,
get_canonical_hostname(), pw->pw_name, NULL, 0,
--- 455,461 ----
(!options.kerberos_authentication ||
options.kerberos_or_local_passwd) &&
#endif /* KRB4 */
#ifdef USE_PAM
! auth_pam_password(pw, "") &&
do_pam_account(pw->pw_name, NULL)) {
#elif defined(HAVE_OSF_SIA)
(sia_validate_user(NULL, saved_argc, saved_argv,
get_canonical_hostname(), pw->pw_name, NULL, 0,
--
Charles Jardine - Computing Service, University of Cambridge
cj10 at cam.ac.uk Tel: +44 1223 334506, Fax: +44 1223 334679