[openssh-commits] [openssh] 28/87: upstream: clean up Kerberos ccache if KerberosAuthentication

[git+noreply at mindrot.org]

This is an automated email from the git hooks/post-receive script.

djm pushed a commit to branch master
in repository openssh.

commit ea2111b5622c37616b9c3350934c0692ab052010
Author: djm at openbsd.org <djm at openbsd.org>
AuthorDate: Fri Oct 30 02:31:35 2026 +0000

    upstream: clean up Kerberos ccache if KerberosAuthentication
    
    password authentication succeeds but the session is subsequently refused.
    
    Anthropic ANT-2026-JGFGOUGS
    
    OpenBSD-Commit-ID: 1dfdb0a8eab7270f62273b42e831ab40ffbdf4dd
---
 auth-krb5.c    |  5 ++++-
 auth-passwd.c  |  8 ++++++--
 monitor_wrap.c | 18 +++++++++++++++++-
 session.c      | 13 +++++++++----
 4 files changed, 36 insertions(+), 8 deletions(-)

diff --git a/auth-krb5.c b/auth-krb5.c
index 3c6dc0622..afdccb285 100644
--- a/auth-krb5.c
+++ b/auth-krb5.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth-krb5.c,v 1.26 2026/02/08 19:54:31 dtucker Exp $ */
+/* $OpenBSD: auth-krb5.c,v 1.27 2026/10/30 02:31:35 djm Exp $ */
 /*
  *    Kerberos v5 authentication and ticket-passing routines.
  *
@@ -228,6 +228,9 @@ krb5_cleanup_proc(Authctxt *authctxt)
 		krb5_cc_destroy(authctxt->krb5_ctx, authctxt->krb5_fwd_ccache);
 		authctxt->krb5_fwd_ccache = NULL;
 	}
+	authctxt->krb5_ticket_file = NULL;
+	free(authctxt->krb5_ccname);
+	authctxt->krb5_ccname = NULL;
 	if (authctxt->krb5_user) {
 		krb5_free_principal(authctxt->krb5_ctx, authctxt->krb5_user);
 		authctxt->krb5_user = NULL;
diff --git a/auth-passwd.c b/auth-passwd.c
index a9d768891..37dba168c 100644
--- a/auth-passwd.c
+++ b/auth-passwd.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth-passwd.c,v 1.49 2025/05/08 17:32:53 tedu Exp $ */
+/* $OpenBSD: auth-passwd.c,v 1.50 2026/10/30 02:31:36 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo at cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo at cs.hut.fi>, Espoo, Finland
@@ -96,8 +96,12 @@ auth_password(struct ssh *ssh, const char *password)
 #ifdef KRB5
 	if (options.kerberos_authentication == 1) {
 		int ret = auth_krb5_password(authctxt, password);
-		if (ret == 1 || ret == 0)
+		if (ret == 1 || ret == 0) {
+			/* Don't keep a ticket cache for a refused login. */
+			if (ret && !ok)
+				krb5_cleanup_proc(authctxt);
 			return ret && ok;
+		}
 		/* Fall back to ordinary passwd authentication. */
 	}
 #endif
diff --git a/monitor_wrap.c b/monitor_wrap.c
index c828fce04..46e73bba2 100644
--- a/monitor_wrap.c
+++ b/monitor_wrap.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: monitor_wrap.c,v 1.151 2026/09/16 06:23:16 djm Exp $ */
+/* $OpenBSD: monitor_wrap.c,v 1.152 2026/10/30 02:31:36 djm Exp $ */
 /*
  * Copyright 2002 Niels Provos <provos at citi.umich.edu>
  * Copyright 2002 Markus Friedl <markus at openbsd.org>
@@ -683,7 +683,23 @@ mm_session_pty_cleanup2(Session *s)
 		error("close(s->ptymaster/%d): %s",
 		    s->ptymaster, strerror(errno));
 
+	/*
+	 * If no command was started on this pty then do_exec_pty() never
+	 * took over the descriptors received in mm_pty_allocate(), so close
+	 * them here. Otherwise the channel owns the master and the slave was
+	 * closed after the fork.
+	 */
+	if (s->pid == 0) {
+		if (close(s->ptyfd) == -1)
+			error("close(s->ptyfd/%d): %s",
+			    s->ptyfd, strerror(errno));
+		if (close(s->ttyfd) == -1)
+			error("close(s->ttyfd/%d): %s",
+			    s->ttyfd, strerror(errno));
+	}
+
 	/* unlink pty from session */
+	s->ptyfd = s->ptymaster = -1;
 	s->ttyfd = -1;
 }
 
diff --git a/session.c b/session.c
index 0c0bd8084..dca2304d2 100644
--- a/session.c
+++ b/session.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: session.c,v 1.353 2026/10/30 02:11:00 djm Exp $ */
+/* $OpenBSD: session.c,v 1.354 2026/10/30 02:31:36 djm Exp $ */
 /*
  * Copyright (c) 1995 Tatu Ylonen <ylo at cs.hut.fi>, Espoo, Finland
  *                    All rights reserved
@@ -2649,9 +2649,14 @@ do_cleanup(struct ssh *ssh, Authctxt *authctxt)
 		return;
 
 #ifdef KRB5
-	if (options.kerberos_ticket_cleanup &&
-	    authctxt->krb5_ctx)
-		krb5_cleanup_proc(authctxt);
+	/*
+	 * Remove the ticket cache written by Kerberos password
+	 * authentication; if the login never completed there is no
+	 * session that could use it, regardless of KerberosTicketCleanup.
+	 */
+	if (authctxt->krb5_ctx && (options.kerberos_ticket_cleanup ||
+	    !authctxt->authenticated))
+ 		krb5_cleanup_proc(authctxt);
 #endif
 
 #ifdef GSSAPI

-- 
To stop receiving notification emails like this one, please contact
djm at mindrot.org.