Dean Anderson wrote:
On Mon, 26 Jan 2004, Jeffrey Hutzelman wrote:Sadly, this doesn't make any difference. OpenSSH 3.7.1 and later run PAM session modules in a subprocess unrelated to the eventual user shell,
That is not correct. Even with privsep, the session modules are run in the shell's immediate parent (as root). (This is trivial to test: add a debug call at the start of do_pam_session() to output its pid, then compare it with the ppid of the shell.)
It is true that pam_authenticate() is called in a process that's not a direct ancestor of the shell, and because of that, sshd now (ie post-3.7.1p2) goes to some length to export the state set by that process. This is true with or without privsep.
Nope. OpenSSH 3.7.1p1 works for me with privsep turned off. When privsep is turned off, there is no subprocess.
There are other differences in behaviour which may be the cause of what you're seeing, eg pam_setcred will be called as non-root when privsep is off. See:
http://bugzilla.mindrot.org/show_bug.cgi?id=789
> 3.7.1p1 has some additional
breakage, in that if your ssh client doesn't support 'interactive/pam' as a method, then it won't send anything to pam. This means that only openssh clients work with pam on openssh servers. E.g., putty won't work.
That is not correct either. For SSHv2, PAM on 3.7p1 and up uses keyboard-interactive (which is an internet-draft, the same as the rest of SSHv2, see [1]) which is supported by most clients, including PuTTY.
For SSHv1, PAM uses TIS challenge-response authentication, which is also supported by PuTTY, but is disabled by default. To enable it, click the little checkbox at Connection -> SSH -> Auth -> Attempt TIS or Cryptocard authentication (SSH1).
If, however, you do not disable PasswordAuthentication as per the UsePAM man page entry then it's possible to authenticate without going through PAM. To fix this, set "PasswordAuthentication no" in sshd_config like the man page says.
[1] http://www.ietf.org/internet-drafts/draft-ietf-secsh-auth-kbdinteract-05.txt
--
Darren Tucker (dtucker at zip.com.au)
GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4 37C9 C982 80C7 8FF4 FA69
Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.
________________________________________________
Kerberos mailing list [EMAIL PROTECTED]
https://mailman.mit.edu/mailman/listinfo/kerberos
