components/network/hpn-ssh/patches/0003-lastlog-pam_open_session.patch

   1 The session management in sshd aims to display the (previous) last login
   2 information and to record the current login info of an user into the lastlog
   3 database for future use.  This is achieved primarily using the direct access to
   4 the /var/adm/lastlog file.
   5
   6 There is an option to disable the lastlog handling in sshd and leave the
   7 session management (including the last login info storage and display) to some
   8 other facility.  Typically the PAM session management is used for that on some
   9 operating systems.  The lastlog handling could be disabled during the configure
  10 phase using the --disable-lastlog configure option.
  11
  12 The PAM session management is invoked before the direct lastlog handling is
  13 called in sshd.  So it is expected than when both PAM support and lastlog
  14 support are enabled in sshd then PAM does not do the last login handling at
  15 all.  Otherwise we would get the last login information displayed twice on
  16 login.
  17
  18 On illumos there is only pam_unix_session(7) PAM session management module
  19 configured by default - see /etc/pam.conf.  This module updates the
  20 /var/adm/lastlog file on open and does basically nothing on close - see the
  21 pam_unix_session(7) man page.  There was an attempt in the past to change that,
  22 but it failed - see https://www.illumos.org/issues/6057 for details.
  23
  24 Given all of the above we are in unfortunate situation:
  25
  26 A) With PAM enabled and the lastlog feature disabled we would get the
  27 /var/adm/lastlog file updated, but the information about the last login
  28 wouldn't be displayed.
  29
  30 B) With both PAM and the lastlog feature enabled we would get the
  31 /var/adm/lastlog file updated right before the last login information is
  32 displayed (directly by sshd).  This would lead to seeing the current login info
  33 as the last login info.
  34
  35 C) With both PAM and the lastlog feature disabled we would get neither the last
  36 login information recorded nor displayed.
  37
  38 D) With PAM disabled and the lastlog feature enabled we would get what we want
  39 (regarding the last login information handling).  However the PAM disable is
  40 not an option because PAM constitutes substantial piece in our operating system
  41 security architecture.
  42
  43 To solve the issue we opted for enabling both PAM and lastlog with patched out
  44 PAM session management calls.  The USE_LASTLOG guards are used to make it safe
  45 to disable the native lastlog handling in sshd without removing this patch.
  46
  47 --- hpn-ssh-hpn-18.4.2/auth-pam.c.orig
  48 +++ hpn-ssh-hpn-18.4.2/auth-pam.c
  49 @@ -674,7 +674,9 @@
  50         pam_set_item(sshpam_handle, PAM_CONV, (const void *)&null_conv);
  51         if (sshpam_session_open) {
  52                 debug("PAM: closing session");
  53 +#ifndef USE_LASTLOG
  54                 pam_close_session(sshpam_handle, PAM_SILENT);
  55 +#endif /* USE_LASTLOG */
  56                 sshpam_session_open = 0;
  57         }
  58         if (sshpam_cred_established) {
  59 @@ -1216,7 +1218,11 @@
  60         if (sshpam_err != PAM_SUCCESS)
  61                 fatal("PAM: failed to set PAM_CONV: %s",
  62                     pam_strerror(sshpam_handle, sshpam_err));
  63 +#ifdef USE_LASTLOG
  64 +       sshpam_err = PAM_SUCCESS;
  65 +#else /* USE_LASTLOG */
  66         sshpam_err = pam_open_session(sshpam_handle, 0);
  67 +#endif /* USE_LASTLOG */
  68         if (sshpam_err == PAM_SUCCESS)
  69                 sshpam_session_open = 1;
  70         else {