X-Git-Url: http://andersk.mit.edu/gitweb/openssh.git/blobdiff_plain/e6abba319782c213254dca0f0c3b930f6cfd716a..8fbc356de176c10b7d4503b6c6bbbe9954f95b77:/session.c

diff --git a/session.c b/session.c
index 9f472a22..1e9e3228 100644
--- a/session.c
+++ b/session.c
@@ -9,7 +9,7 @@
  * called by a name other than "ssh" or "Secure Shell".
  *
  * SSH2 support by Markus Friedl.
- * Copyright (c) 2000 Markus Friedl.  All rights reserved.
+ * Copyright (c) 2000, 2001 Markus Friedl.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -33,7 +33,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: session.c,v 1.83 2001/06/07 22:25:02 markus Exp $");
+RCSID("$OpenBSD: session.c,v 1.100 2001/08/16 19:18:34 jakob Exp $");
 
 #include "ssh.h"
 #include "ssh1.h"
@@ -99,7 +99,8 @@ typedef struct Session Session;
 struct Session {
 	int	used;
 	int	self;
-	struct	passwd *pw;
+	struct passwd *pw;
+	Authctxt *authctxt;
 	pid_t	pid;
 	/* tty */
 	char	*term;
@@ -120,24 +121,23 @@ struct Session {
 /* func */
 
 Session *session_new(void);
-void	session_set_fds(Session *s, int fdin, int fdout, int fderr);
-void	session_pty_cleanup(Session *s);
-void	session_proctitle(Session *s);
-int	session_setup_x11fwd(Session *s);
-void	session_close(Session *s);
-void	do_exec_pty(Session *s, const char *command);
-void	do_exec_no_pty(Session *s, const char *command);
-void	do_login(Session *s, const char *command);
-#ifdef LOGIN_NEEDS_UTMPX
-void	do_pre_login(Session *s);
-#endif
-void	do_child(Session *s, const char *command);
+void	session_set_fds(Session *, int, int, int);
+static void	session_pty_cleanup(void *);
+void	session_proctitle(Session *);
+int	session_setup_x11fwd(Session *);
+void	do_exec_pty(Session *, const char *);
+void	do_exec_no_pty(Session *, const char *);
+void	do_exec(Session *, const char *);
+void	do_login(Session *, const char *);
+void	do_child(Session *, const char *);
 void	do_motd(void);
-int	check_quietlogin(Session *s, const char *command);
-void	xauthfile_cleanup_proc(void *pw);
+int	check_quietlogin(Session *, const char *);
+
+static void do_authenticated1(Authctxt *);
+static void do_authenticated2(Authctxt *);
 
-void	do_authenticated1(Authctxt *authctxt);
-void	do_authenticated2(Authctxt *authctxt);
+static void session_close(Session *);
+static int session_pty_req(Session *);
 
 /* import */
 extern ServerOptions options;
@@ -148,11 +148,8 @@ extern u_int utmp_len;
 extern int startup_pipe;
 extern void destroy_sensitive_data(void);
 
-/* Local Xauthority file. */
-static char *xauthfile;
-
 /* original command from peer. */
-char *original_command = NULL;
+const char *original_command = NULL;
 
 /* data */
 #define MAX_SESSIONS 10
@@ -200,56 +197,17 @@ do_authenticated(Authctxt *authctxt)
 	else
 		do_authenticated1(authctxt);
 
-	/* remote user's local Xauthority file and agent socket */
-	if (xauthfile)
-		xauthfile_cleanup_proc(authctxt->pw);
+	/* remove agent socket */
 	if (auth_get_socket_name())
 		auth_sock_cleanup_proc(authctxt->pw);
-}
-
-/*
- * Remove local Xauthority file.
- */
-void
-xauthfile_cleanup_proc(void *_pw)
-{
-	struct passwd *pw = _pw;
-	char *p;
-
-	debug("xauthfile_cleanup_proc called");
-	if (xauthfile != NULL) {
-		temporarily_use_uid(pw);
-		unlink(xauthfile);
-		p = strrchr(xauthfile, '/');
-		if (p != NULL) {
-			*p = '\0';
-			rmdir(xauthfile);
-		}
-		xfree(xauthfile);
-		xauthfile = NULL;
-		restore_uid();
-	}
-}
-
-/*
- * Function to perform cleanup if we get aborted abnormally (e.g., due to a
- * dropped connection).
- */
-void
-pty_cleanup_proc(void *session)
-{
-	Session *s=session;
-	if (s == NULL)
-		fatal("pty_cleanup_proc: no session");
-	debug("pty_cleanup_proc: %s", s->tty);
-
-	if (s->pid != 0) {
-		/* Record that the user has logged out. */
-		record_logout(s->pid, s->tty);
-	}
-
-	/* Release the pseudo-tty. */
-	pty_release(s->tty);
+#ifdef KRB4
+	if (options.kerberos_ticket_cleanup)
+		krb4_cleanup_proc(authctxt);
+#endif
+#ifdef KRB5
+	if (options.kerberos_ticket_cleanup)
+		krb5_cleanup_proc(authctxt);
+#endif
 }
 
 /*
@@ -258,16 +216,17 @@ pty_cleanup_proc(void *session)
  * terminals are allocated, X11, TCP/IP, and authentication agent forwardings
  * are requested, etc.
  */
-void
+static void
 do_authenticated1(Authctxt *authctxt)
 {
 	Session *s;
 	char *command;
-	int success, type, n_bytes, plen, screen_flag, have_pty = 0;
+	int success, type, plen, screen_flag;
 	int compression_level = 0, enable_compression_after_reply = 0;
 	u_int proto_len, data_len, dlen;
 
 	s = session_new();
+	s->authctxt = authctxt;
 	s->pw = authctxt->pw;
 
 	/*
@@ -296,51 +255,7 @@ do_authenticated1(Authctxt *authctxt)
 			break;
 
 		case SSH_CMSG_REQUEST_PTY:
-			if (no_pty_flag) {
-				debug("Allocating a pty not permitted for this authentication.");
-				break;
-			}
-			if (have_pty)
-				packet_disconnect("Protocol error: you already have a pty.");
-
-			debug("Allocating pty.");
-
-			/* Allocate a pty and open it. */
-			if (!pty_allocate(&s->ptyfd, &s->ttyfd, s->tty,
-			    sizeof(s->tty))) {
-				error("Failed to allocate pty.");
-				break;
-			}
-			fatal_add_cleanup(pty_cleanup_proc, (void *)s);
-			pty_setowner(s->pw, s->tty);
-
-			/* Get TERM from the packet.  Note that the value may be of arbitrary length. */
-			s->term = packet_get_string(&dlen);
-			packet_integrity_check(dlen, strlen(s->term), type);
-			/* packet_integrity_check(plen, 4 + dlen + 4*4 + n_bytes, type); */
-			/* Remaining bytes */
-			n_bytes = plen - (4 + dlen + 4 * 4);
-
-			if (strcmp(s->term, "") == 0) {
-				xfree(s->term);
-				s->term = NULL;
-			}
-			/* Get window size from the packet. */
-			s->row = packet_get_int();
-			s->col = packet_get_int();
-			s->xpixel = packet_get_int();
-			s->ypixel = packet_get_int();
-			pty_change_window_size(s->ptyfd, s->row, s->col, s->xpixel, s->ypixel);
-
-			/* Get tty modes from the packet. */
-			tty_parse_modes(s->ttyfd, &n_bytes);
-			packet_integrity_check(plen, 4 + dlen + 4 * 4 + n_bytes, type);
-
-			session_proctitle(s);
-
-			/* Indicate that we now have a pty. */
-			success = 1;
-			have_pty = 1;
+			success = session_pty_req(s);
 			break;
 
 		case SSH_CMSG_X11_REQUEST_FORWARDING:
@@ -364,6 +279,8 @@ do_authenticated1(Authctxt *authctxt)
 			if (!success) {
 				xfree(s->auth_proto);
 				xfree(s->auth_data);
+				s->auth_proto = NULL;
+				s->auth_data = NULL;
 			}
 			break;
 
@@ -394,28 +311,70 @@ do_authenticated1(Authctxt *authctxt)
 			if (packet_set_maxsize(packet_get_int()) > 0)
 				success = 1;
 			break;
+			
+#if defined(AFS) || defined(KRB5)
+		case SSH_CMSG_HAVE_KERBEROS_TGT:
+			if (!options.kerberos_tgt_passing) {
+				verbose("Kerberos TGT passing disabled.");
+			} else {
+				char *kdata = packet_get_string(&dlen);
+				packet_integrity_check(plen, 4 + dlen, type);
+				
+				/* XXX - 0x41, see creds_to_radix version */
+				if (kdata[0] != 0x41) {
+#ifdef KRB5
+					krb5_data tgt;
+					tgt.data = kdata;
+					tgt.length = dlen;
+					
+					if (auth_krb5_tgt(s->authctxt, &tgt))
+						success = 1;
+					else
+						verbose("Kerberos v5 TGT refused for %.100s", s->authctxt->user);
+#endif /* KRB5 */
+				} else {
+#ifdef AFS
+					if (auth_krb4_tgt(s->authctxt, kdata))
+						success = 1;
+					else
+						verbose("Kerberos v4 TGT refused for %.100s", s->authctxt->user);
+#endif /* AFS */
+				}
+				xfree(kdata);
+			}
+			break;
+#endif /* AFS || KRB5 */
+			
+#ifdef AFS
+		case SSH_CMSG_HAVE_AFS_TOKEN:
+			if (!options.afs_token_passing || !k_hasafs()) {
+				verbose("AFS token passing disabled.");
+			} else {
+				/* Accept AFS token. */
+				char *token = packet_get_string(&dlen);
+				packet_integrity_check(plen, 4 + dlen, type);
+				
+				if (auth_afs_token(s->authctxt, token))
+					success = 1;
+				else
+					verbose("AFS token refused for %.100s",
+					    s->authctxt->user);
+				xfree(token);
+			}
+			break;
+#endif /* AFS */
 
 		case SSH_CMSG_EXEC_SHELL:
 		case SSH_CMSG_EXEC_CMD:
 			if (type == SSH_CMSG_EXEC_CMD) {
 				command = packet_get_string(&dlen);
 				debug("Exec command '%.500s'", command);
-				packet_integrity_check(plen, 4 + dlen, type);
+				do_exec(s, command);
+				xfree(command);
 			} else {
-				command = NULL;
-				packet_integrity_check(plen, 0, type);
+				do_exec(s, NULL);
 			}
-			if (forced_command != NULL) {
-				original_command = command;
-				command = forced_command;
-				debug("Forced command '%.500s'", forced_command);
-			}
-			if (have_pty)
-				do_exec_pty(s, command);
-			else
-				do_exec_no_pty(s, command);
-			if (command != NULL)
-				xfree(command);
+			packet_done();
 			session_close(s);
 			return;
 
@@ -468,6 +427,7 @@ do_exec_no_pty(Session *s, const char *command)
 	session_proctitle(s);
 
 #if defined(USE_PAM)
+	do_pam_session(s->pw->pw_name, NULL);
 	do_pam_setcred(1);
 #endif /* USE_PAM */
 
@@ -588,9 +548,9 @@ do_exec_pty(Session *s, const char *command)
 
 	/* Fork the child. */
 	if ((pid = fork()) == 0) {
+
 		/* Child.  Reinitialize the log because the pid has changed. */
 		log_init(__progname, options.log_level, options.log_facility, log_stderr);
-
 		/* Close the master side of the pseudo tty. */
 		close(ptyfd);
 
@@ -690,6 +650,27 @@ do_pre_login(Session *s)
 }
 #endif
 
+/*
+ * This is called to fork and execute a command.  If another command is
+ * to be forced, execute that instead.
+ */
+void
+do_exec(Session *s, const char *command)
+{
+	if (forced_command) {
+		original_command = command;
+		command = forced_command;
+		debug("Forced command '%.900s'", command);
+	}
+
+	if (s->ttyfd != -1)
+		do_exec_pty(s, command);
+	else
+		do_exec_no_pty(s, command);
+
+	original_command = NULL;
+}
+
 /* administrative, login(1)-like work */
 void
 do_login(Session *s, const char *command)
@@ -796,7 +777,7 @@ int
 check_quietlogin(Session *s, const char *command)
 {
 	char buf[256];
-	struct passwd * pw = s->pw;
+	struct passwd *pw = s->pw;
 	struct stat st;
 
 	/* Return 1 if .hushlogin exists or a command given. */
@@ -817,7 +798,7 @@ check_quietlogin(Session *s, const char *command)
  * Sets the value of the given variable in the environment.  If the variable
  * already exists, its value is overriden.
  */
-void
+static void
 child_set_env(char ***envp, u_int *envsizep, const char *name,
 	      const char *value)
 {
@@ -858,7 +839,7 @@ child_set_env(char ***envp, u_int *envsizep, const char *name,
  * Otherwise, it must consist of empty lines, comments (line starts with '#')
  * and assignments of the form name=value.  No other forms are allowed.
  */
-void
+static void
 read_environment_file(char ***env, u_int *envsize,
 		      const char *filename)
 {
@@ -897,7 +878,7 @@ read_environment_file(char ***env, u_int *envsize,
 /*
  * Sets any environment variables which have been specified by PAM
  */
-void do_pam_environment(char ***env, int *envsize)
+void do_pam_environment(char ***env, u_int *envsize)
 {
 	char *equals, var_name[512], var_val[512];
 	char **pam_env;
@@ -926,7 +907,7 @@ void do_pam_environment(char ***env, int *envsize)
 #endif /* USE_PAM */
 
 #ifdef HAVE_CYGWIN
-void copy_environment(char ***env, int *envsize)
+void copy_environment(char ***env, u_int *envsize)
 {
 	char *equals, var_name[512], var_val[512];
 	int i;
@@ -1038,7 +1019,7 @@ void
 do_child(Session *s, const char *command)
 {
 	const char *shell, *hostname = NULL, *cp = NULL;
-	struct passwd * pw = s->pw;
+	struct passwd *pw = s->pw;
 	char buf[256];
 	char cmd[1024];
 	FILE *f = NULL;
@@ -1047,7 +1028,7 @@ do_child(Session *s, const char *command)
 	extern char **environ;
 	struct stat st;
 	char *argv[10];
-	int do_xauth = s->auth_proto != NULL && s->auth_data != NULL;
+	int do_xauth;
 #ifdef WITH_IRIX_PROJECT
 	prid_t projid;
 #endif /* WITH_IRIX_PROJECT */
@@ -1059,6 +1040,9 @@ do_child(Session *s, const char *command)
 #endif /* WITH_IRIX_ARRAY */
 #endif /* WITH_IRIX_JOBS */
 
+	do_xauth =
+	    s->display != NULL && s->auth_proto != NULL && s->auth_data != NULL;
+
 	/* remove hostkey from the child's memory */
 	destroy_sensitive_data();
 
@@ -1066,7 +1050,7 @@ do_child(Session *s, const char *command)
 	if (options.use_login && command != NULL)
 		options.use_login = 0;
 
-#if !defined(USE_PAM) && !defined(HAVE_OSF_SIA)
+#if !defined(HAVE_OSF_SIA)
 	if (!options.use_login) {
 # ifdef HAVE_LOGIN_CAP
 		if (!login_getcapbool(lc, "ignorenologin", 0) && pw->pw_uid)
@@ -1084,7 +1068,7 @@ do_child(Session *s, const char *command)
 			exit(254);
 		}
 	}
-#endif /* USE_PAM || HAVE_OSF_SIA */
+#endif /* HAVE_OSF_SIA */
 
 	/* Set login name, uid, gid, and groups. */
 	/* Login(1) does this as well, and it needs uid 0 for the "-h"
@@ -1214,10 +1198,10 @@ do_child(Session *s, const char *command)
 	/* Try to get AFS tokens for the local cell. */
 	if (k_hasafs()) {
 		char cell[64];
-
+		
 		if (k_afs_cell_of_file(pw->pw_dir, cell, sizeof(cell)) == 0)
 			krb_afslog(cell, 0);
-
+		
 		krb_afslog(0, 0);
 	}
 #endif /* AFS */
@@ -1301,23 +1285,21 @@ do_child(Session *s, const char *command)
 		child_set_env(&env, &envsize, "KRB5CCNAME", cp);
 	read_environment_file(&env, &envsize, "/etc/environment");
 #endif
-
 #ifdef KRB4
-	{
-		extern char *ticket;
-
-		if (ticket)
-			child_set_env(&env, &envsize, "KRBTKFILE", ticket);
-	}
-#endif /* KRB4 */
-
+	if (s->authctxt->krb4_ticket_file)
+		child_set_env(&env, &envsize, "KRBTKFILE",
+		    s->authctxt->krb4_ticket_file);
+#endif
+#ifdef KRB5
+	if (s->authctxt->krb5_ticket_file)
+		child_set_env(&env, &envsize, "KRB5CCNAME",
+		    s->authctxt->krb5_ticket_file);
+#endif
 #ifdef USE_PAM
 	/* Pull in any environment variables that may have been set by PAM. */
 	do_pam_environment(&env, &envsize);
 #endif /* USE_PAM */
 
-	if (xauthfile)
-		child_set_env(&env, &envsize, "XAUTHORITY", xauthfile);
 	if (auth_get_socket_name() != NULL)
 		child_set_env(&env, &envsize, SSH_AUTHSOCKET_ENV_NAME,
 			      auth_get_socket_name());
@@ -1477,25 +1459,6 @@ do_child(Session *s, const char *command)
 		if (!options.use_login) {
 			char buf[256];
 
-			/*
-			 * Check for mail if we have a tty and it was enabled
-			 * in server options.
-			 */
-			if (s->ttyfd != -1 && options.check_mail) {
-				char *mailbox;
-				struct stat mailstat;
-
-				mailbox = getenv("MAIL");
-				if (mailbox != NULL) {
-					if (stat(mailbox, &mailstat) != 0 ||
-					    mailstat.st_size == 0)
-						printf("No mail.\n");
-					else if (mailstat.st_mtime < mailstat.st_atime)
-						printf("You have mail.\n");
-					else
-						printf("You have new mail.\n");
-				}
-			}
 			/* Start the shell.  Set initial character to '-'. */
 			buf[0] = '-';
 			strncpy(buf + 1, cp, sizeof(buf) - 1);
@@ -1517,7 +1480,7 @@ do_child(Session *s, const char *command)
 #ifdef LOGIN_NEEDS_TERM
 			     s->term? s->term : "unknown",
 #endif
-			     "-p", "-f", "--", pw->pw_name, NULL);
+			     "-p", "-f", "--", pw->pw_name, (char *)NULL);
 
 			/* Login couldn't be executed, die. */
 
@@ -1547,7 +1510,6 @@ session_new(void)
 		debug("session_new: init");
 		for(i = 0; i < MAX_SESSIONS; i++) {
 			sessions[i].used = 0;
-			sessions[i].self = i;
 		}
 		did_init = 1;
 	}
@@ -1559,6 +1521,7 @@ session_new(void)
 			s->ptyfd = -1;
 			s->ttyfd = -1;
 			s->used = 1;
+			s->self = i;
 			debug("session_new: session %d", i);
 			return s;
 		}
@@ -1566,7 +1529,7 @@ session_new(void)
 	return NULL;
 }
 
-void
+static void
 session_dump(void)
 {
 	int i;
@@ -1582,7 +1545,7 @@ session_dump(void)
 }
 
 int
-session_open(int chanid)
+session_open(Authctxt *authctxt, int chanid)
 {
 	Session *s = session_new();
 	debug("session_open: channel %d", chanid);
@@ -1590,7 +1553,8 @@ session_open(int chanid)
 		error("no more sessions");
 		return 0;
 	}
-	s->pw = auth_get_user();
+	s->authctxt = authctxt;
+	s->pw = authctxt->pw;
 	if (s->pw == NULL)
 		fatal("no user for session %d", s->self);
 	debug("session_open: session %d: link with channel %d", s->self, chanid);
@@ -1598,7 +1562,7 @@ session_open(int chanid)
 	return 1;
 }
 
-Session *
+static Session *
 session_by_channel(int id)
 {
 	int i;
@@ -1614,7 +1578,7 @@ session_by_channel(int id)
 	return NULL;
 }
 
-Session *
+static Session *
 session_by_pid(pid_t pid)
 {
 	int i;
@@ -1629,7 +1593,7 @@ session_by_pid(pid_t pid)
 	return NULL;
 }
 
-int
+static int
 session_window_change_req(Session *s)
 {
 	s->col = packet_get_int();
@@ -1641,19 +1605,30 @@ session_window_change_req(Session *s)
 	return 1;
 }
 
-int
+static int
 session_pty_req(Session *s)
 {
 	u_int len;
 	int n_bytes;
 
-	if (no_pty_flag)
+	if (no_pty_flag) {
+		debug("Allocating a pty not permitted for this authentication.");
 		return 0;
-	if (s->ttyfd != -1)
+	}
+	if (s->ttyfd != -1) {
+		packet_disconnect("Protocol error: you already have a pty.");
 		return 0;
+	}
+
 	s->term = packet_get_string(&len);
-	s->col = packet_get_int();
-	s->row = packet_get_int();
+
+	if (compat20) {
+		s->col = packet_get_int();
+		s->row = packet_get_int();
+	} else {
+		s->row = packet_get_int();
+		s->col = packet_get_int();
+	}
 	s->xpixel = packet_get_int();
 	s->ypixel = packet_get_int();
 
@@ -1661,9 +1636,12 @@ session_pty_req(Session *s)
 		xfree(s->term);
 		s->term = NULL;
 	}
+
 	/* Allocate a pty and open it. */
+	debug("Allocating pty.");
 	if (!pty_allocate(&s->ptyfd, &s->ttyfd, s->tty, sizeof(s->tty))) {
-		xfree(s->term);
+		if (s->term)
+			xfree(s->term);
 		s->term = NULL;
 		s->ptyfd = -1;
 		s->ttyfd = -1;
@@ -1671,25 +1649,28 @@ session_pty_req(Session *s)
 		return 0;
 	}
 	debug("session_pty_req: session %d alloc %s", s->self, s->tty);
+
+	/* for SSH1 the tty modes length is not given */
+	if (!compat20)
+		n_bytes = packet_remaining();
+	tty_parse_modes(s->ttyfd, &n_bytes);
+
 	/*
 	 * Add a cleanup function to clear the utmp entry and record logout
 	 * time in case we call fatal() (e.g., the connection gets closed).
 	 */
-	fatal_add_cleanup(pty_cleanup_proc, (void *)s);
+	fatal_add_cleanup(session_pty_cleanup, (void *)s);
 	pty_setowner(s->pw, s->tty);
-	/* Get window size from the packet. */
+
+	/* Set window size from the packet. */
 	pty_change_window_size(s->ptyfd, s->row, s->col, s->xpixel, s->ypixel);
 
-	/* Get tty modes from the packet. */
-	tty_parse_modes(s->ttyfd, &n_bytes);
 	packet_done();
-
 	session_proctitle(s);
-
 	return 1;
 }
 
-int
+static int
 session_subsystem_req(Session *s)
 {
 	u_int len;
@@ -1716,7 +1697,7 @@ session_subsystem_req(Session *s)
 	return success;
 }
 
-int
+static int
 session_x11_req(Session *s)
 {
 	int success;
@@ -1731,44 +1712,32 @@ session_x11_req(Session *s)
 	if (!success) {
 		xfree(s->auth_proto);
 		xfree(s->auth_data);
+		s->auth_proto = NULL;
+		s->auth_data = NULL;
 	}
 	return success;
 }
 
-int
+static int
 session_shell_req(Session *s)
 {
-	/* if forced_command == NULL, the shell is execed */
-	char *shell = forced_command;
 	packet_done();
-	if (s->ttyfd == -1)
-		do_exec_no_pty(s, shell);
-	else
-		do_exec_pty(s, shell);
+	do_exec(s, NULL);
 	return 1;
 }
 
-int
+static int
 session_exec_req(Session *s)
 {
 	u_int len;
 	char *command = packet_get_string(&len);
 	packet_done();
-	if (forced_command) {
-		original_command = command;
-		command = forced_command;
-		debug("Forced command '%.500s'", forced_command);
-	}
-	if (s->ttyfd == -1)
-		do_exec_no_pty(s, command);
-	else
-		do_exec_pty(s, command);
-	if (forced_command == NULL)
-		xfree(command);
+	do_exec(s, command);
+	xfree(command);
 	return 1;
 }
 
-int
+static int
 session_auth_agent_req(Session *s)
 {
 	static int called = 0;
@@ -1857,19 +1826,27 @@ session_set_fds(Session *s, int fdin, int fdout, int fderr)
 	    1);
 }
 
-void
-session_pty_cleanup(Session *s)
+/*
+ * Function to perform pty cleanup. Also called if we get aborted abnormally
+ * (e.g., due to a dropped connection).
+ */
+static void
+session_pty_cleanup(void *session)
 {
-	if (s == NULL || s->ttyfd == -1)
+	Session *s = session;
+
+	if (s == NULL) {
+		error("session_pty_cleanup: no session");
+		return;
+	}
+	if (s->ttyfd == -1)
 		return;
 
 	debug("session_pty_cleanup: session %d release %s", s->self, s->tty);
 
-	/* Cancel the cleanup function. */
-	fatal_remove_cleanup(pty_cleanup_proc, (void *)s);
-
 	/* Record that the user has logged out. */
-	record_logout(s->pid, s->tty);
+	if (s->pid != 0)
+		record_logout(s->pid, s->tty);
 
 	/* Release the pseudo-tty. */
 	pty_release(s->tty);
@@ -1883,7 +1860,7 @@ session_pty_cleanup(Session *s)
 		error("close(s->ptymaster): %s", strerror(errno));
 }
 
-void
+static void
 session_exit_message(Session *s, int status)
 {
 	Channel *c;
@@ -1891,7 +1868,7 @@ session_exit_message(Session *s, int status)
 		fatal("session_close: no session");
 	c = channel_lookup(s->chanid);
 	if (c == NULL)
-		fatal("session_close: session %d: no channel %d",
+		fatal("session_exit_message: session %d: no channel %d",
 		    s->self, s->chanid);
 	debug("session_exit_message: session %d channel %d pid %d",
 	    s->self, s->chanid, s->pid);
@@ -1932,10 +1909,14 @@ session_exit_message(Session *s, int status)
 	s->chanid = -1;
 }
 
-void
-session_free(Session *s)
+static void
+session_close(Session *s)
 {
-	debug("session_free: session %d pid %d", s->self, s->pid);
+	debug("session_close: session %d pid %d", s->self, s->pid);
+	if (s->ttyfd != -1) {
+		fatal_remove_cleanup(session_pty_cleanup, (void *)s);
+		session_pty_cleanup(s);
+	}
 	if (s->term)
 		xfree(s->term);
 	if (s->display)
@@ -1945,13 +1926,6 @@ session_free(Session *s)
 	if (s->auth_proto)
 		xfree(s->auth_proto);
 	s->used = 0;
-}
-
-void
-session_close(Session *s)
-{
-	session_pty_cleanup(s);
-	session_free(s);
 	session_proctitle(s);
 }
 
@@ -1960,7 +1934,7 @@ session_close_by_pid(pid_t pid, int status)
 {
 	Session *s = session_by_pid(pid);
 	if (s == NULL) {
-		debug("session_close_by_pid: no session for pid %d", s->pid);
+		debug("session_close_by_pid: no session for pid %d", pid);
 		return;
 	}
 	if (s->chanid != -1)
@@ -1968,6 +1942,22 @@ session_close_by_pid(pid_t pid, int status)
 	session_close(s);
 }
 
+int
+session_have_children(void)
+{
+	int i;
+
+	for(i = 0; i < MAX_SESSIONS; i++) {
+		Session *s = &sessions[i];
+		if (s->used && s->pid != -1) {
+			debug("session_have_children: id %d pid %d", i, s->pid);
+			return 1;
+		}
+	}
+	debug("session_have_children: no more children");
+	return 0;
+}
+
 /*
  * this is called when a channel dies before
  * the session 'child' itself dies
@@ -1996,7 +1986,7 @@ session_close_by_channel(int id, void *arg)
 	}
 }
 
-char *
+static char *
 session_tty_list(void)
 {
 	static char buf[1024];
@@ -2027,7 +2017,6 @@ session_proctitle(Session *s)
 int
 session_setup_x11fwd(Session *s)
 {
-	int fd;
 	struct stat st;
 
 	if (no_x11_forwarding_flag) {
@@ -2043,37 +2032,25 @@ session_setup_x11fwd(Session *s)
 		packet_send_debug("No xauth program; cannot forward with spoofing.");
 		return 0;
 	}
-	if (s->display != NULL || xauthfile != NULL) {
-		debug("X11 display already set.");
+	if (options.use_login) {
+		packet_send_debug("X11 forwarding disabled; "
+		    "not compatible with UseLogin=yes.");
 		return 0;
 	}
-	xauthfile = xmalloc(MAXPATHLEN);
-	strlcpy(xauthfile, "/tmp/ssh-XXXXXXXX", MAXPATHLEN);
-	temporarily_use_uid(s->pw);
-	if (mkdtemp(xauthfile) == NULL) {
-		error("private X11 dir: mkdtemp %s failed: %s",
-		    xauthfile, strerror(errno));
-		restore_uid();
-		xfree(xauthfile);
-		xauthfile = NULL;
+	if (s->display != NULL) {
+		debug("X11 display already set.");
 		return 0;
 	}
-	strlcat(xauthfile, "/cookies", MAXPATHLEN);
-	fd = open(xauthfile, O_RDWR|O_CREAT|O_EXCL, 0600);
-	if (fd >= 0)
-		close(fd);
-	restore_uid();
 	s->display = x11_create_display_inet(s->screen, options.x11_display_offset);
 	if (s->display == NULL) {
-		xauthfile_cleanup_proc(s->pw);
+		debug("x11_create_display_inet failed.");
 		return 0;
 	}
-	fatal_add_cleanup(xauthfile_cleanup_proc, s->pw);
 	return 1;
 }
 
-void
+static void
 do_authenticated2(Authctxt *authctxt)
 {
-	server_loop2();
+	server_loop2(authctxt);
 }