2.9.9p2 bug in PAM support

[Nicolas Williams]

On Tue, Oct 02, 2001 at 12:04:42AM +1000, Andrew Bartlett wrote:
> Nicolas Williams wrote:
> > 
> > Perhaps OpenSSH should use a different PAM_SERVICE name for non-tty
> > sessions so its PAM stack could be configured differently than for tty
> > sessions.
> > 
> > This may not be possible, if OpenSSH's sshd doesn't know what kind of
> > session to run when it calls pam_start(). Is this so?
> 
> Indeed, this is unknown that the time pam_start() is called.

That's too bad.

> > Alternatively, using 'ssh' as the PAM_TTY might do, but then, should
> > pam_close_session() be called right away after pam_open_session()?
> 
> Why?

I'm thinking of things like UTMP, where ttys are expected to be accessed
in exclusive manner. Perhaps some PAM modules expect the same.

Alternatively, cons up a fake TTY name, like ssh-<session id>...

> -- 
> Andrew Bartlett                                 abartlet at pcug.org.au
> Samba Team member, Build Farm maintainer        abartlet at samba.org
> Student Network Administrator, Hawker College   abartlet at hawkerc.net
> http://samba.org     http://build.samba.org     http://hawkerc.net


Nico
--
-DISCLAIMER: an automatically appended disclaimer may follow. By posting-
-to a public e-mail mailing list I hereby grant permission to distribute-
-and copy this message.-

Visit our website at http://www.ubswarburg.com

This message contains confidential information and is intended only 
for the individual named.  If you are not the named addressee you 
should not disseminate, distribute or copy this e-mail.  Please 
notify the sender immediately by e-mail if you have received this 
e-mail by mistake and delete this e-mail from your system.

E-mail transmission cannot be guaranteed to be secure or error-free 
as information could be intercepted, corrupted, lost, destroyed, 
arrive late or incomplete, or contain viruses.  The sender therefore 
does not accept liability for any errors or omissions in the contents 
of this message which arise as a result of e-mail transmission.  If 
verification is required please request a hard-copy version.  This 
message is provided for informational purposes and should not be 
construed as a solicitation or offer to buy or sell any securities or 
related financial instruments.