PAM session setup and environment variables

Michal Sekletar msekleta at redhat.com
Wed Dec 18 02:16:43 AEDT 2024


On Tue, Dec 17, 2024 at 5:40 AM Damien Miller <djm at mindrot.org> wrote:

> User-specified environment variables are not propogated to the
> environment where sshd invokes PAM modules because the SSH protocol
> sends them at the time a session is opened, well after authentication
> has completed. At best, they could be made available to the PAM
> session modules but there's no way to make user-specified environment
> available to auth and account modules.

I am interested in pam_systemd.so which is a session module. Hence,
would you accept a patch that exposes these variables during this
phase of a session setup?

> Similarly, environment variables _set by_ PAM override anything the
> user set by SetEnv/SendEnv, on the basis that admin-specified
> environment shouldn't be manipuable by a (usually) unprivileged
> user.

I think this makes sense and shouldn't be changed.

Michal
>
> -d
>



More information about the openssh-unix-dev mailing list