Expose authentication information to PAM [Bug 2408] #47
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Whenever the pam device is called, update the "SSH_USER_AUTH" PAM environment variable (Doing it outside this module exposes us to a NULL sshpam_handle). When a session will be later created, this variable, still part of the PAM environment variable will be copied to the child environment before being overriden by the latest value stored in auth_details. As a result, using the same variable name as the final one is key to prevent the final environment to be poluted with an outdated value.
Unfortunately, in the monitor thread, not the same amount of data is available when an key-base authentication succeed. It could be possible to extract the key information of all key that pass through mm_answer_keyverify, but linking it to the authentication success would be dangerous. Simply exposing the successul methods would already be a progress
Bug introduced by c087cdf
last_details is supposed to be only filled on authentication success, but may be incorrectly filled in the future. This patch make sure that this field is cleaned even on authentication failures to make sure than even incorrect authentication modules cannot polute the SSH_USER_AUTH string for another module
|
Something similar has been committed |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
This PR is a code proposal to resolve bug 2408
It contains the same code as the patch attached to the bug on 2016/07/01, but as atomic patches, for a simpler review.