- djm@cvs.openbsd.org 2005/03/02 01:27:41

[openssh.git] / session.c

diff --git a/session.c b/session.c
index 4d7ac9de754519777d15ca9f55ef9ca626ebf73c..df7552334e455f1cb050570bc50862c7ddbf2f87 100644 (file)
--- a/session.c
+++ b/session.c
@@ -665,11 +665,15 @@ do_exec(Session *s, const char *command)
                debug("Forced command '%.900s'", command);
        }
 
-#ifdef GSSAPI
-       if (options.gss_authentication) {
-               temporarily_use_uid(s->pw);
-               ssh_gssapi_storecreds();
-               restore_uid();
+#ifdef SSH_AUDIT_EVENTS
+       if (command != NULL)
+               PRIVSEP(audit_run_command(command));
+       else if (s->ttyfd == -1) {
+               char *shell = s->pw->pw_shell;
+
+               if (shell[0] == '\0')   /* empty shell means /bin/sh */
+                       shell =_PATH_BSHELL;
+               PRIVSEP(audit_run_command(shell));
        }
 #endif
 
@@ -1267,6 +1271,13 @@ do_setusercontext(struct passwd *pw)
 # ifdef __bsdi__
                setpgid(0, 0);
 # endif
+#ifdef GSSAPI
+               if (options.gss_authentication) {
+                       temporarily_use_uid(pw);
+                       ssh_gssapi_storecreds();
+                       restore_uid();
+               }
+#endif
 # ifdef USE_PAM
                if (options.use_pam) {
                        do_pam_session();
@@ -1297,6 +1308,13 @@ do_setusercontext(struct passwd *pw)
                        exit(1);
                }
                endgrent();
+#ifdef GSSAPI
+               if (options.gss_authentication) {
+                       temporarily_use_uid(pw);
+                       ssh_gssapi_storecreds();
+                       restore_uid();
+               }
+#endif
 # ifdef USE_PAM
                /*
                 * PAM credentials may take the form of supplementary groups.
@@ -1334,7 +1352,12 @@ do_pwchange(Session *s)
        if (s->ttyfd != -1) {
                fprintf(stderr,
                    "You must change your password now and login again!\n");
+#ifdef PASSWD_NEEDS_USERNAME
+               execl(_PATH_PASSWD_PROG, "passwd", s->pw->pw_name,
+                   (char *)NULL);
+#else
                execl(_PATH_PASSWD_PROG, "passwd", (char *)NULL);
+#endif
                perror("passwd");
        } else {
                fprintf(stderr,
@@ -2321,6 +2344,10 @@ do_cleanup(Authctxt *authctxt)
        }
 #endif
 
+#ifdef SSH_AUDIT_EVENTS
+       PRIVSEP(audit_event(SSH_CONNECTION_CLOSE));
+#endif
+
        /* remove agent socket */
        auth_sock_cleanup_proc(authctxt->pw);