Debian Bug report logs - #150968
libpam-modules: pam_mkhomedir fails with new ssh (3.3p1) - pam_session not run as root

Package: ssh; Maintainer for ssh is Debian OpenSSH Maintainers <debian-ssh@lists.debian.org>; Source for ssh is src:openssh (PTS, buildd, popcon).

Reported by: "Richard A Nelson" <cowboy@vnet.ibm.com>

Date: Tue, 25 Jun 2002 16:03:01 UTC

Severity: important

Tags: fixed-upstream, patch

Fixed in version openssh/1:3.8p1-1

Done: Colin Watson <cjwatson@debian.org>

Bug is archived. No further changes may be made.

Toggle useless messages

View this report as an mbox folder, status mbox, maintainer mbox

Report forwarded to debian-bugs-dist@lists.debian.org, Sam Hartman <hartmans@debian.org>, pam@packages.qa.debian.org:
Bug#150968; Package libpam-modules. (full text, mbox, link).

Acknowledgement sent to "Richard A Nelson" <cowboy@vnet.ibm.com>:
New Bug report received and forwarded. Copy sent to Sam Hartman <hartmans@debian.org>, pam@packages.qa.debian.org. (full text, mbox, link).

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

Package: libpam-modules
Version: 0.72-35
Severity: grave

This is grave because failures in these PAM modules will prevent access
to the system.

The new ssh with split priviledge throws a big monkeywrench in the usage
of PAM session helpers... They are no longer run suid, but rather run
under the authenticated UID !

I've personally been hit by pam_tmpdir and pam_mkhomedir, but I've not
yet looked to see what other session modules may be impacted.

We may want to coordinate with upstream (although we're fairly
downlevel) - and with other PAM packages (like pam_tmpdir) on the
best ways to solve this problem!  Potential avenues are separate
suid helpers (yuck), modification of an extant helper, or something
along the lines of the 'userv' package (I've not yet looked to see
how apropos it is for this problem).

-- System Information
Debian Release: 3.0
Architecture: i386
Kernel: Linux badlands.lexington.ibm.com 2.4.19-pre10-ac2 #8 Wed Jun 5 15:00:08 EDT 2002 i686
Locale: LANG=C, LC_CTYPE=C

Versions of packages libpam-modules depends on:
ii  libc6                         2.2.5-7    GNU C Library: Shared libraries an
ii  libcap1                       1:1.10-12  support for getting/setting POSIX.
ii  libdb3                        3.2.9-16   Berkeley v3 Database Libraries [ru
ii  libpam0g                      0.72-35    Pluggable Authentication Modules l

-- no debconf information

Bug reassigned from package `libpam-modules' to `ssh'. Request was from Sam Hartman <hartmans@debian.org> to control@bugs.debian.org. (full text, mbox, link).

Information forwarded to debian-bugs-dist@lists.debian.org, debian-ssh@lists.debian.org, Matthew Vernon <matthew@debian.org>, openssh@packages.qa.debian.org:
Bug#150968; Package ssh. (full text, mbox, link).

Acknowledgement sent to hartmans@mit.edu (Sam Hartman):
Extra info received and forwarded to list. Copy sent to debian-ssh@lists.debian.org, Matthew Vernon <matthew@debian.org>, openssh@packages.qa.debian.org. (full text, mbox, link).

Message #12 received at 150968@bugs.debian.org (full text, mbox, reply):

tags 150968 patch
thanks

Here's a patch for 3.3p1-0.0.woody1 to do the PAM session and setcred
handling in the parent rather than the child; seems to work for me.

Thanks to Steve Langasek for help with the patch .


Index: auth-pam.c
===================================================================
RCS file: /afs/sipb/project/debian/cvs/openssh-krb5/auth-pam.c,v
retrieving revision 1.4
diff -u -r1.4 auth-pam.c
--- auth-pam.c	25 Jun 2002 00:45:33 -0000	1.4
+++ auth-pam.c	25 Jun 2002 20:33:41 -0000
@@ -286,6 +286,8 @@
 			    pam_retval, PAM_STRERROR(__pamh, pam_retval));
 	}
 
+	if (session_opened)
+	  return; /*Be idempotent so we can be called in monitor and child*/
 	pam_retval = pam_open_session(__pamh, 0);
 	if (pam_retval != PAM_SUCCESS)
 		fatal("PAM session setup failed[%d]: %.200s",
@@ -304,6 +306,8 @@
 
 	do_pam_set_conv(&conv);
 
+	if (init&&creds_set)
+	  return; /*be idempotent so we can be called in monitor and child*/
 	debug("PAM establishing creds");
 	pam_retval = pam_setcred(__pamh, 
 	    init ? PAM_ESTABLISH_CRED : PAM_REINITIALIZE_CRED);
Index: monitor.c
===================================================================
RCS file: /afs/sipb/project/debian/cvs/openssh-krb5/monitor.c,v
retrieving revision 1.1.1.1
diff -u -r1.1.1.1 monitor.c
--- monitor.c	24 Jun 2002 23:29:52 -0000	1.1.1.1
+++ monitor.c	25 Jun 2002 20:33:41 -0000
@@ -278,6 +278,8 @@
 #ifdef USE_PAM
 			if (!do_pam_account(authctxt->pw->pw_name, NULL))
 				authenticated = 0;
+			do_pam_session(authctxt->pw->pw_name, NULL);
+			do_pam_setcred(1);
 #endif
 		}

Tags added: patch Request was from hartmans@mit.edu (Sam Hartman) to control@bugs.debian.org. (full text, mbox, link).