[Bug 1534] New: openssh calls pam functions in the wrong order on logout

[bugzilla-daemon at bugzilla.mindrot.org]

https://bugzilla.mindrot.org/show_bug.cgi?id=1534

           Summary: openssh calls pam functions in the wrong order on
                    logout
           Product: Portable OpenSSH
           Version: 5.1p1
          Platform: Other
        OS/Version: Linux
            Status: NEW
          Severity: normal
          Priority: P2
         Component: PAM support
        AssignedTo: unassigned-bugs at mindrot.org
        ReportedBy: anicka at suse.cz


Created an attachment (id=1577)
 --> (http://bugzilla.mindrot.org/attachment.cgi?id=1577)
openssh pam fix for calling functions in the right order on logout

Copied from original bugreport by Andreas Schwab in Novell bugzilla:

openssh calls the pam functions on logout in the wrong order.

pam_setcred with the DELETE_CRED flag is called before
pam_close_session is called.

This means that e.g. a kerberos aware module can't use the kerberos
credentials cache to close it's session, cause the tickets are already
gone.

pam_setcred with DELETE_CRED should be called after pam_close_session.

See attached patch.

-- 
Configure bugmail: https://bugzilla.mindrot.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching the assignee of the bug.