Hello, I am developing a PAM module that is called from OpenSSH server when a ssh-client wants to login in the machine. I want my module PAM to send a message to the ssh-client as soon as the PAM module is called by using the pam_info function, but I have checked that the message is not instantly shown in the client unless I send a prompt. I would like to find a way to send the message instantly from my PAM module without prompting. Any suggestions? Thanks a lot
Josele Lerele wrote:> Hello, > > I am developing a PAM module that is called from OpenSSH server when a > ssh-client wants to login in the machine. I want my module PAM to send a > message to the ssh-client as soon as the PAM module is called by using the > pam_info function, but I have checked that the message is not instantly > shown in the client unless I send a prompt. > > I would like to find a way to send the message instantly from my PAM module > without prompting. Any suggestions?What version of OpenSSH are you using? Modern versions will send a SSH2 banner message if they get a conversation request from PAM without a prompt. -- Darren Tucker (dtucker at zip.com.au) GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4 37C9 C982 80C7 8FF4 FA69 Good judgement comes with experience. Unfortunately, the experience usually comes from bad judgement.
I am using version 5.1. I know you can send information through the banner, but I would like to send dynamic information from the PAM module. Do you think this is possible without prompting something in the client? 2008/11/6 Darren Tucker <dtucker at zip.com.au>> Josele Lerele wrote: > >> Hello, >> >> I am developing a PAM module that is called from OpenSSH server when a >> ssh-client wants to login in the machine. I want my module PAM to send a >> message to the ssh-client as soon as the PAM module is called by using the >> pam_info function, but I have checked that the message is not instantly >> shown in the client unless I send a prompt. >> >> I would like to find a way to send the message instantly from my PAM >> module >> without prompting. Any suggestions? >> > > What version of OpenSSH are you using? Modern versions will send a SSH2 > banner message if they get a conversation request from PAM without a prompt. > > -- > Darren Tucker (dtucker at zip.com.au) > GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4 37C9 C982 80C7 8FF4 FA69 > Good judgement comes with experience. Unfortunately, the experience > usually comes from bad judgement. >
Julián de Navascués
2008-Nov-06 16:31 UTC
Keyboard-interactive authentication from a PAM module
Hi again, Im working in the same PAM module that Josele is working. First of all thank you for your reply. I would like to answer your questions:> - what platform is this running on? Probably will not make a difference > but it might help.We are developing under linux (lastest Ubuntu desktop, OpenSSH 5.1) but in the future we would like to support any unix.> - what does your PAM config look like for sshd?We have a very fool temp config... just for testing: auth optional our_pam_module.so auth sufficient pam_succeed_if.so uid >= 0> - is the module source publicly available? (ie can I reproduce this configuration?)I guess you think we have a complex module... but the only thing we do is: PAM_EXTERN int pam_sm_authenticate ( args... ) { pam_info ( pamh, "Hello\n" ); // shouldn't it work as a fprintf on the ssh client side? sleep ( n_seconds ); return PAM_SUCCESS; } If we use this module in other PAM aware application ( like the switch user command "su" ) we see first the message "Hello", then wait n_seconds, then return PAM_SUCCESS... and auth depends on /etc/pam.d/su and other modules. BUT, if we try the same with our sshd (keyboard interactive authentication via PAM) we only see our "Hello" message after the n_secondsa and the PAM auth is finished. Also if we prompt something after the pam_info call (prompt for a password, for example). we can see the "Hello" message. So... we know its possible to do it with "su", but... we are not sure if its possible to send a message to SSH client, I mean: SSH Client <----- "Hello" ---------| sshd | <-------- "Hello" ------------ | PAM module says Hello and sleeps... Facts: Keyboard interactive ( RFC: http://www.rfc-archive.org/getrfc.php?rfc=4256 ) authentication allows to send to the SSH client without prompting, as RFC says: 1. In the case that the server sends a `0' num-prompts field in the request message, the client MUST send a response message with a `0' num-responses field to complete the exchange. 2. The num-prompts field may be `0', in which case there will be no prompt/echo fields in the message, but the client SHOULD still display the name and instruction fields (as described below) Question: Is the sshd able to recieve a info message from PAM (as a PAM aware app in a PAM conversation) and send it immediately to the SSH client (as a SSH server in the middle of a keyboard interactive authentication) ??? Has anybody did this before? I know it sounds complicated or even absurd, but we want it (and we dont want to patch SSH server or client). Thanks again for your help and sorry for my bad English, Julian Josele Lerele wrote:> I am using version 5.1. I know you can send information through the > banner, but I would like to send dynamic information from the PAM > module.I wasn't refering to the banner file. The PAM code uses the banner protocol message to send data provided by PAM under some conditions when there's no prompt.> Do you think this is possible without prompting something in the > client?Depends on what PAM passes sshd. Could you please you compile and run (as root) this little test program to show what PAM's doing and post the output? (Sanity checking the code first is recommended. It doesn't set noecho so you want to make sure there's nobody watching over shoulders, and obviously clip any sensitive bits from the output.) http://www.zip.com.au/~dtucker/patch...test-harness.c A few other random questions: - what platform is this running on? Probably will not make a difference but it might help. - what does your PAM config look like for sshd? - is the module source publicly available? (ie can I reproduce this configuration?) -- Darren Tucker (dtucker at zip.com.au) GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4 37C9 C982 80C7 8FF4 FA69 Good judgement comes with experience. Unfortunately, the experience usually comes from bad judgement. _______________________________________________ openssh-unix-dev mailing list openssh-unix-dev at mindrot.org https://lists.mindrot.org/mailman/li...enssh-unix-dev