PAM session setup and environment variables
Michal Sekletar
msekleta at redhat.com
Wed Dec 18 02:16:43 AEDT 2024
On Tue, Dec 17, 2024 at 5:40 AM Damien Miller <djm at mindrot.org> wrote:
> User-specified environment variables are not propogated to the
> environment where sshd invokes PAM modules because the SSH protocol
> sends them at the time a session is opened, well after authentication
> has completed. At best, they could be made available to the PAM
> session modules but there's no way to make user-specified environment
> available to auth and account modules.
I am interested in pam_systemd.so which is a session module. Hence,
would you accept a patch that exposes these variables during this
phase of a session setup?
> Similarly, environment variables _set by_ PAM override anything the
> user set by SetEnv/SendEnv, on the basis that admin-specified
> environment shouldn't be manipuable by a (usually) unprivileged
> user.
I think this makes sense and shouldn't be changed.
Michal
>
> -d
>
More information about the openssh-unix-dev
mailing list