search for: auth2_update_methods_list

https://bugzilla.mindrot.org/show_bug.cgi?id=983 Damien Miller <djm at mindrot.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |ASSIGNED Assignee|pgsery at swcp.com |djm at mindrot.org --- Comment #58 from Damien Miller

Dear OpenSSH Developers, I would like to propose a patch to OpenSSH for Linux. In the recent few months, I have encountered a scenario where a PAM module used for authentication in SSH should be informed about the previous successful authentication methods. I described the complete scenario here:

...ctive devs [preauth] debug1: auth2_challenge: user=kmk devs= [preauth] debug1: kbdint_alloc: devices 'pam,skey' [preauth] debug1: auth2_challenge_start: trying authentication method 'skey' [preauth] Postponed keyboard-interactive for kmk from 172.22.100.17 port 56339 ssh2 [preauth] auth2_update_methods_lists: method not in AuthenticationMethods debug1: do_cleanup debug1: PAM: cleanup debug1: Killing privsep child 1596 I see in the source above that error message: /* This should not happen, but would be bad if it did */ So maybe this is an unhandled use case? -- You are receiving this mail because:...

...mm_auth_password: user authenticated [preauth] However all I can see from the "password_change_required" is code in auth-pam.c to set the auth token to PAM_CHANGE_EXPIRED_AUTHTOK, but no RFC4252 style communication. Then later. debug2: ## DH: userauth_finish [preauth] debug3: auth2_update_methods_lists: updating methods list after "password" [preauth] debug2: authentication methods list 0 complete [preauth] debug2: ## DH: about to do_pam_account [preauth] debug3: mm_do_pam_account entering [preauth] debug3: mm_request_send entering: type 102 [preauth] debug3: mm_request_receive_ex...