1 From d6bad830599b2a95150370954576800b4c6e8947 Mon Sep 17 00:00:00 2001
2 From: oracle <solaris@oracle.com>
3 Date: Mon, 3 Aug 2015 14:38:26 -0700
4 Subject: [PATCH 18/36] PAM setcred failures
5
6 #
7 # This patch contains bug fixes to the PAM credential and session operations.
8 # In the original OpenSSH, the server only gives warnings and still allows
9 # users to log in when pam_setcred() or pam_open_session() fail, if user auth
10 # method is not keyboard-interactive or password. This is not a correct
11 # behavior. The server should just fatal out, when these functions fail.
12 #
13 # We have contributed back these bug fixes to the OpenSSH upstream community.
14 # For more information, see https://bugzilla.mindrot.org/show_bug.cgi?id=2399
15 # In the future, if these bug fixes are accepted by the upsteam in a later
16 # release, we will remove this patch when we upgrade to that release.
17 #
18 ---
19 auth-pam.c | 13 +++++++++++++
20 1 file changed, 13 insertions(+)
21
22 diff --git a/auth-pam.c b/auth-pam.c
23 index 6470d5e..2124546 100644
24 --- a/auth-pam.c
25 +++ b/auth-pam.c
26 @@ -1083,12 +1083,19 @@ do_pam_setcred(int init)
27 sshpam_cred_established = 1;
28 return;
29 }
30 +
31 +#ifdef PAM_BUGFIX
32 + /* Server will fatal out when pam_setcred() failed. */
33 + fatal("PAM: pam_setcred(): %s", pam_strerror(sshpam_handle,
34 + sshpam_err));
35 +#else /* orig */
36 if (sshpam_authenticated)
37 fatal("PAM: pam_setcred(): %s",
38 pam_strerror(sshpam_handle, sshpam_err));
39 else
40 debug("PAM: pam_setcred(): %s",
41 pam_strerror(sshpam_handle, sshpam_err));
42 +#endif /* PAM_BUGFIX */
43 }
44
45 static int
46 @@ -1181,10 +1188,16 @@ do_pam_session(void)
47 if (sshpam_err == PAM_SUCCESS)
48 sshpam_session_open = 1;
49 else {
50 +#ifdef PAM_BUGFIX
51 + /* Server will fatal out when pam_open_session() failed */
52 + fatal("PAM: pam_open_session(): %s",
53 + pam_strerror(sshpam_handle, sshpam_err));
54 +#else /* orig */
55 sshpam_session_open = 0;
56 disable_forwarding();
57 error("PAM: pam_open_session(): %s",
58 pam_strerror(sshpam_handle, sshpam_err));
59 +#endif /* PAM_BUGFIX */
60 }
61
62 }
63 --
64 2.5.4 (Apple Git-61)
65