Displaying 6 results from an estimated 6 matches for "pam_csock".
2005 Jul 14
1
OpenSSH PAM "thread" buglet
...arg;
sshpam_thread_status = -1;
switch ((pid = fork())) {
@@ -157,10 +158,14 @@
error("fork(): %s", strerror(errno));
return (-1);
case 0:
+ close(ctx->pam_psock);
+ ctx->pam_psock = -1;
thread_start(arg);
_exit(1);
default:
*thread = pid;
+ close(ctx->pam_csock);
+ ctx->pam_csock = -1;
sshpam_oldsig = signal(SIGCHLD, sshpam_sigchld_handler);
return (0);
}
2003 Oct 12
4
[PATCH]: Call pam_chauthtok from keyboard-interactive.
..._authtok_reqd) {
+ sshpam_err = pam_chauthtok(sshpam_handle,
+ PAM_CHANGE_EXPIRED_AUTHTOK);
+ if (sshpam_err != PAM_SUCCESS)
+ goto auth_fail;
+ sshpam_new_authtok_reqd = 0; /* XXX: reset fwd flags */
+ }
+ }
buffer_put_cstring(&buffer, "OK");
ssh_msg_send(ctxt->pam_csock, sshpam_err, &buffer);
buffer_free(&buffer);
@@ -532,11 +544,16 @@ finish_pam(void)
u_int
do_pam_account(void)
{
+ if (sshpam_account_status != -1)
+ return (sshpam_account_status);
+
sshpam_err = pam_acct_mgmt(sshpam_handle, 0);
debug3("%s: pam_acct_mgmt = %d", __func__...
2004 Feb 27
0
PAM patch for openssh 3.7.1p2
...de so that the PAM conversation is
single threaded.
The second patch is for the solaris package builder to turn allow pam
to be automatically turned on for install.
--- auth-pam.c 2004/02/26 19:35:52 1.1.1.1
+++ auth-pam.c 2004/02/27 00:26:00
@@ -124,7 +124,10 @@
int pam_csock;
int pam_done;
};
+static struct pam_ctxt *sshpam_ctxt; /* hack for pam library not
passing back
+ ctxt */
+
static void sshpam_free_ctx(void *);
/*
@@ -142,6 +145,10 @@
*resp = NULL;
ctxt = data;
+ if ( c...
2003 Nov 13
0
[PATCH] Perform do_pam_chauthtok via SSH2 keyboard-interactive.
..._reqd) {
+ sshpam_err = pam_chauthtok(sshpam_handle,
+ PAM_CHANGE_EXPIRED_AUTHTOK);
+ if (sshpam_err != PAM_SUCCESS)
+ goto auth_fail;
+ sshpam_new_authtok_reqd = 0; /* XXX: reset fwd flags */
+ }
+ }
+#endif
buffer_put_cstring(&buffer, "OK");
ssh_msg_send(ctxt->pam_csock, sshpam_err, &buffer);
buffer_free(&buffer);
@@ -532,11 +546,16 @@ finish_pam(void)
u_int
do_pam_account(void)
{
+ if (sshpam_account_status != -1)
+ return (sshpam_account_status);
+
sshpam_err = pam_acct_mgmt(sshpam_handle, 0);
debug3("%s: pam_acct_mgmt = %d", __func__...
2003 Oct 29
4
Fix for USE_POSIX_THREADS in auth-pam.c
...0);
if (sshpam_err != PAM_SUCCESS)
goto auth_fail;
buffer_put_cstring(&buffer, "OK");
@@ -238,7 +301,7 @@
auth_fail:
buffer_put_cstring(&buffer,
- pam_strerror(sshpam_handle, sshpam_err));
+ pam_strerror(grab_pamh(0, NULL), sshpam_err));
ssh_msg_send(ctxt->pam_csock, PAM_AUTH_ERR, &buffer);
buffer_free(&buffer);
pthread_exit(NULL);
@@ -274,20 +337,31 @@
sshpam_cleanup(void)
{
debug("PAM: cleanup");
- if (sshpam_handle == NULL)
- return;
- pam_set_item(sshpam_handle, PAM_CONV, (const void *)&null_conv);
- if (sshpam_cred_establish...
2004 Jun 01
1
Sending immediate PAM auth failure messages via kbd-int
Hi.
One thing that people seem to want to do with PAM is to deny a login
immediately without interacting but return a message to the user. (Some
platforms implement, eg, /etc/nologin via PAM this way.) Currently, sshd
will just deny the login and the user will not be told why.
Attached it a patch that return a keyboard-interactive packet with the
message in the "instruction"