Since openssh version 3.7p1 the pam support is kind of broken. The
attached patch is for version 3.7.1p1 and helps with the following
problems.
1) Login via gssapi and obtaining AFS tokens via a session module from
the transferred credential. The problem arises because the session
module gets executed befor the krb5 credentials are stored.
2) Interactive keyboard login with pam_krb5 as auth module and
obtaining AFS tokens via a session module from the krb5 ticket
during auth. Since the authentication via pam_authenticate() is
done in a separate thread, environment variables set by the pam
auth modules never get stored properly for the pam session modules
and for the user.
regards,
Christian Pfaffel
diff -ur openssh-3.7.1p1/auth-pam.c openssh-3.7.1p1.new/auth-pam.c
--- openssh-3.7.1p1/auth-pam.c Tue Sep 16 08:00:52 2003
+++ openssh-3.7.1p1.new/auth-pam.c Mon Sep 22 13:06:37 2003
@@ -202,6 +202,7 @@
struct pam_conv sshpam_conv;
#ifndef USE_POSIX_THREADS
const char *pam_user;
+ char **envp;
pam_get_item(sshpam_handle, PAM_USER, (const void **)&pam_user);
setproctitle("%s [pam]", pam_user);
@@ -218,6 +219,15 @@
sshpam_err = pam_authenticate(sshpam_handle, 0);
if (sshpam_err != PAM_SUCCESS)
goto auth_fail;
+ do_pam_setcred(0);
+ envp = fetch_pam_environment();
+ if(envp)
+ while(*envp){
+ buffer_clear(&buffer);
+ buffer_put_cstring(&buffer, *(envp++));
+ ssh_msg_send(ctxt->pam_csock, PAM_SEND_ENVIRONMENT, &buffer);
+ }
+ buffer_clear(&buffer);
buffer_put_cstring(&buffer, "OK");
ssh_msg_send(ctxt->pam_csock, sshpam_err, &buffer);
buffer_free(&buffer);
@@ -401,6 +411,9 @@
plen += snprintf(**prompts + plen, len, "%s", msg);
xfree(msg);
break;
+ case PAM_SEND_ENVIRONMENT:
+ pam_putenv(sshpam_handle, msg);
+ break;
case PAM_SUCCESS:
case PAM_AUTH_ERR:
if (**prompts != NULL) {
diff -ur openssh-3.7.1p1/auth-pam.h openssh-3.7.1p1.new/auth-pam.h
--- openssh-3.7.1p1/auth-pam.h Tue Sep 2 15:18:53 2003
+++ openssh-3.7.1p1.new/auth-pam.h Mon Sep 22 12:58:26 2003
@@ -31,6 +31,8 @@
# define SSHD_PAM_SERVICE __progname
#endif
+#define PAM_SEND_ENVIRONMENT 9
+
void start_pam(const char *);
void finish_pam(void);
u_int do_pam_account(void);
diff -ur openssh-3.7.1p1/session.c openssh-3.7.1p1.new/session.c
--- openssh-3.7.1p1/session.c Tue Sep 16 03:52:19 2003
+++ openssh-3.7.1p1.new/session.c Fri Sep 19 19:24:51 2003
@@ -396,6 +396,7 @@
#if defined(USE_PAM)
if (options.use_pam) {
+ do_pam_session();
do_pam_setcred(1);
if (is_pam_password_change_required())
packet_disconnect("Password change required but no "
@@ -525,6 +526,7 @@
#if defined(USE_PAM)
if (options.use_pam) {
do_pam_set_tty(s->tty);
+ do_pam_session();
do_pam_setcred(1);
}
#endif
--
Christian Pfaffel <[EMAIL PROTECTED]>
Technische Universit�t Graz Telefon: +43 / 316 / 873 - 81 90
Institut f�r Theoretische Physik Telefax: +43 / 316 / 873 - 86 78
Petersgasse 16, A-8010 Graz http://fubphpc.tu-graz.ac.at/~flash/pubkey.gpg
________________________________________________
Kerberos mailing list [EMAIL PROTECTED]
https://mailman.mit.edu/mailman/listinfo/kerberos
