similar to: [patch] sshd with re-exec disabled causes stdin to get closed.

Hello All. Attached is an update to my previous patch to make do_pam_chauthtok and privsep play nicely together. First, a question: does anybody care about these or the password expiration patches? Anyway, the "PRIVSEP(do_pam_hauthtok())" has been moved to just after the pty has been allocated but before it's made the controlling tty. This allows the child running chauthtok to

The primary purpose of the attached patches is for portable OpenSSH to support changing expired passwords as specified in shadow password files. To support that, I did a couple enhancements to the base OpenBSD OpenSSH code. They are: 1. Consolidated the handling of "forced_command" into a do_exec() function in session.c. These were being handled inconsistently and allocated

http://bugzilla.mindrot.org/show_bug.cgi?id=245 ------- Additional Comments From dtucker at zip.com.au 2002-12-14 00:36 ------- Did some digging on this. Carson seems to be correct in that the problem is due to missing controlling terminal. I uncommented the setsid() in sshd.c and added some debugging log() calls to sshd, which generated the following: sshd[21690]: main: before setsid

http://bugzilla.mindrot.org/show_bug.cgi?id=87 Summary: Last logon that gets reported upon login is the current login time Product: Portable OpenSSH Version: 3.0.2p1 Platform: UltraSparc OS/Version: Solaris Status: NEW Severity: normal Priority: P2 Component: sshd AssignedTo:

http://bugzilla.mindrot.org/show_bug.cgi?id=83 djm at mindrot.org changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|fork() fails when there are |PAM limits applied |PAM limits set |incorrectly ------- You are receiving this mail because: ------- You

FYI-- session.c fails from openSSH 2.9.9p2 with SunPro C compiler on Solaris 7, 8. The function do_pre_login had to be moved to before its use in do_exec_pty (a predeclaration would work). It does appear to work correctly, given the above fix. Still having the largefile problem (argh), so if anyone can help with /that/ ... -- Austin David -- Sr. Systems Architect Wink Communications

http://bugzilla.mindrot.org/show_bug.cgi?id=178 Summary: Content of /etc/nologin isn't shown to users, fix triggers probably AIX bug Product: Portable OpenSSH Version: 3.1p1 Platform: PPC OS/Version: AIX Status: NEW Severity: normal Priority: P2 Component: sshd AssignedTo:

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Greetings, I am not sure if this is the correct place to ask these question, if I am at the wrong place please advise. I am currently working on some modifications to openssh which record the users rsa/dsa identity comment file to a log file when the user logs in (password authentication is disabled). The ssh1 portion of the modification works

http://bugzilla.mindrot.org/show_bug.cgi?id=83 ------- Additional Comments From djm at mindrot.org 2003-03-10 15:49 ------- Created an attachment (id=247) --> (http://bugzilla.mindrot.org/attachment.cgi?id=247&action=view) Call pam_session after child fork() Hopefully this patch will allow people to gather the feedback necessary to close this bug. ------- You are receiving this

Hi, I'm trying to compile openssh2.3.0p1 on aix3.2.5. Can I ignore this list of warning messages? bsd-bindresvport.c: In function `bindresvport_af': bsd-bindresvport.c:94: warning: implicit declaration of function `bind' bsd-rresvport.c: In function `rresvport_af': bsd-rresvport.c:64: warning: implicit declaration of function `bzero' bsd-rresvport.c:82: warning: implicit

I am not 100% positive of the security implications of this, but I really can't see any potential for harm. If this patch is applied (I coded it against the now-current openssh-2.2.0p1), then if (a) the authorized_keys entry has command="whatever" to force a specific command, and also (b) the invoker specified some command on their ssh cmdline, then the invoked command will be

Hi All, I was assigned a project to port the openssh 5.4p1 to Windows.? There has been discussion about Cygwin and SUA on Windows, but the conclusion is to avoid a unix layer.? So came the project.? I was being assigned not because I am familir with openssh, but because I am a Windows application developer.? BTW, the objective is to have a windows sshd daemon, no client is needed at this stage.

do_pre_login() in session.c is used (in do_exec_pty()) before it's declared, which is causing some problems for me. please move it up a couple hundred lines in the file. patch included for 0807 snapshot. thanks, wendy % diff -u session.c.orig session.c.mod --- session.c.orig Tue Aug 7 13:11:51 2001 +++ session.c.mod Tue Aug 7 16:21:07 2001 @@ -397,6 +397,34 @@ } }

-- | ``We've all heard that a million monkeys banging on | Damien Miller - | a million typewriters will eventually reproduce the | <djm at mindrot.org> | works of Shakespeare. Now, thanks to the Internet, / | we know this is not true.'' - Robert Wilensky UCB / http://www.mindrot.org ---------- Forwarded message ---------- Date: Tue, 14 Nov 2000 16:33:18 +0100 From: System

For root sessions pam_open_session is called, but not pam_close_session. sshd behavior is broken for root logins because if pam session is run from the child, close is never called due to exec: on open since use_privsep is not set, parent calls do_exec_pty(), which does not open session. then, it skips calling do_setusercontext(), so it does not open session. child calls

I was having problems getting the UseLogin option to work on Solaris. I would recieve this error: No utmpx entry. You must exec "login" from the lowest level "shell". This led me to believe that Solaris login wants a utmpx entry in order to function. I put together a patch that calls record_login on Solaris when using the system login. I also noticed that writing a wtmpx

http://bugzilla.mindrot.org/show_bug.cgi?id=423 ------- Additional Comments From djm at mindrot.org 2003-03-10 12:06 ------- The patch looks good, but the only thing that makes me wary is the use of signals for IPC. Would it not be possible to do the chauthtok call earlier? E.g. after the call to do_pam_session() in do_exec_pty()? ------- You are receiving this mail because: ------- You

Can we do this? Or should we drop the whole char *tty; ? There will be no way of setting the TTY= correctly while using privsep (Mainly for multiple streams over single session). The only thing we really could do is do: In do_setusercontext() if (use_privsep) aix_usrinfo(pw, NULL); and back in the old spot put: if (!use_privsep) aix_usrinfo(pw, s->ttyfd == -1 ? NULL : s->tty);

hi hpa, etal I found a patch against 2.06 that turned off console when serial was in use. http://centerclick.org/net4801/pxelinux/syslinux.patch This patch works, but appears to turn off the console unconditionally. I went to see how it would fit in 2.11, and it seems youve already started adding this feature. If so great, but how do I control it from a config-file ? I didnt see any new

Hello, Recently I have discovered a problem with serial console output when net-booting a Soekris net5501 board via pxe. When using pxelinux.0 from syslinux 4.04 package I get only 15 characters from the output, then the carriage returns back to the same line over and over again, making it impossible to read the output. What is more the booting process (trying configuration files with