- djm@cvs.openbsd.org 2010/01/30 02:54:53

[openssh.git] / auth-pam.c

diff --git a/auth-pam.c b/auth-pam.c
index bfd8f3270bb13ab2fbbd4fdc22fd948f5ba2da7c..675006e6fb25cbb7f48bb8115b8d32cb2897c2d8 100644 (file)
--- a/auth-pam.c
+++ b/auth-pam.c
@@ -161,9 +161,9 @@ sshpam_sigchld_handler(int sig)
            WTERMSIG(sshpam_thread_status) == SIGTERM)
                return; /* terminated by pthread_cancel */
        if (!WIFEXITED(sshpam_thread_status))
-               fatal("PAM: authentication thread exited unexpectedly");
+               sigdie("PAM: authentication thread exited unexpectedly");
        if (WEXITSTATUS(sshpam_thread_status) != 0)
-               fatal("PAM: authentication thread exited uncleanly");
+               sigdie("PAM: authentication thread exited uncleanly");
 }
 
 /* ARGSUSED */
@@ -598,18 +598,20 @@ static struct pam_conv store_conv = { sshpam_store_conv, NULL };
 void
 sshpam_cleanup(void)
 {
-       debug("PAM: cleanup");
-       if (sshpam_handle == NULL)
+       if (sshpam_handle == NULL || (use_privsep && !mm_is_monitor()))
                return;
+       debug("PAM: cleanup");
        pam_set_item(sshpam_handle, PAM_CONV, (const void *)&null_conv);
-       if (sshpam_cred_established) {
-               pam_setcred(sshpam_handle, PAM_DELETE_CRED);
-               sshpam_cred_established = 0;
-       }
        if (sshpam_session_open) {
+               debug("PAM: closing session");
                pam_close_session(sshpam_handle, PAM_SILENT);
                sshpam_session_open = 0;
        }
+       if (sshpam_cred_established) {
+               debug("PAM: deleting credentials");
+               pam_setcred(sshpam_handle, PAM_DELETE_CRED);
+               sshpam_cred_established = 0;
+       }
        sshpam_authenticated = 0;
        pam_end(sshpam_handle, sshpam_err);
        sshpam_handle = NULL;
@@ -984,7 +986,8 @@ sshpam_tty_conv(int n, sshpam_const struct pam_message **msg,
                        break;
                case PAM_PROMPT_ECHO_ON:
                        fprintf(stderr, "%s\n", PAM_MSG_MEMBER(msg, i, msg));
-                       fgets(input, sizeof input, stdin);
+                       if (fgets(input, sizeof input, stdin) == NULL)
+                               input[0] = '\0';
                        if ((reply[i].resp = strdup(input)) == NULL)
                                goto fail;
                        reply[i].resp_retcode = PAM_SUCCESS;