Keyboard-interactive authentication from a PAM module

[Darren Tucker]

Julián de Navascués wrote:
[...]
> Is the sshd able to recieve a info message from PAM  (as a PAM aware
> app in a PAM conversation) and send it immediately to the SSH client
> (as a SSH server in the middle of a keyboard interactive
> authentication) ???

It should, but having said that it would only work for 
keyboard-interactive and PAM can be invoked for other auth types 
(password, for the auth stack or any, for the account stack).  Banner 
messages can be sent at any time before authentication is complete 
(that's why they're used for this).

> Has anybody did this before?  I know it sounds complicated or even
> absurd, but we want it (and we dont want to patch SSH server or
> client).
[...]

I will look at this but it would be easier if you can supply the output 
from the diag tool I asked for:

> Could you please you compile and run (as root) this little test program
> to show what PAM's doing and post the output? (Sanity checking the code
> first is recommended. It doesn't set noecho so you want to make sure
> there's nobody watching over shoulders, and obviously clip any sensitive
> bits from the output.)
> 
> http://www.zip.com.au/~dtucker/patch...test-harness.c

(addendum: if the timing is important to you please add the -v option to 
enable timestamps)

-- 
Darren Tucker (dtucker at zip.com.au)
GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4  37C9 C982 80C7 8FF4 FA69
     Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.