Problems with PAM environments in ssh

[Craig Gallek]

I’ve stumbled across a rather obscure problem with ssh.  My machine is
setup to use Kerberos authentication, i.e., I use the pam_krb5 module in
the ssh auth section of the PAM configuration file and I have sshd
compiled to accept valid Kerberos 5 tickets as well.  I also use OpenAFS,
so I’ve got the pam_openafs_session module in the ssh session section of
the PAM configuration file.

Everything works as expected when I log in as a user that has not yet
obtained any Kerberos credentials.  The pam_krb5 module successfully
authenticates a user by prompting for a user name and password and obtains
tickets.  Then the pam_openafs_session module runs aklog and obtains AFS
tokens.

When connecting to the machine as a user who has already obtained valid
Kerberos credentials, authentication occurs as expected (I’m not prompted
for a password) but pam_openafs_session fails to obtain AFS tokens.  I’m
using ssh protocol 2, so token passing is not possible (as far as I can
tell).  pam_openafs_session fails because the KRB5CCNAME variable is not
set in the PAM environment at the time the module is used.

In the successful case of authenticating with pam_krb5 via a password, the
pam_krb5 module successfully exports the KRB5CCNAME variable into the PAM
environment during the auth phase.  When authenticating with existing
Kerberos credentials, the pam_sm_authenticate function in the auth module
of pam_krb5 is never called by ssh, so it never has a chance to set
KRB5CCNAME.

sshd eventually exports the KRB5CCNAME variable into the PAM environment,
but it doesn’t happen until the ssh_gssapi_krb5_storecred function, which
occurs after the call to do_pam_session is made during the
privsep_postauth process.

Here an outline of the code in the main function of sshd.c that outlines
the problem:

authenticated:
    /*
     * In privilege separation, we fork another child and prepare
     * file descriptor passing.
     */
    if (use_privsep) {
/***** eventually calls do_pam_session *******/
        privsep_postauth(authctxt);
        /* the monitor process [priv] will not return */
        if (!compat20)
            destroy_sensitive_data();
    }

    /* Start session. */
/******** eventually sets KRB5CCNAME in the PAM env ********/
    do_authenticated(authctxt);

    /* The connection has been terminated. */
    verbose("Closing connection to %.100s", remote_ip);

I’m not really sure what the proper solution to this problem is.  Should
the account module of pam_krb5 set this environment variable?  Should sshd
do it before calling the session code in pam_openafs_session??

Any suggestions are greatly appreciated.

Thanks,
Craig