- (djm) Return of the dreaded PAM_TTY_KLUDGE, which went missing in

   recent merge

diff --git a/ChangeLog b/ChangeLog
index bfd94bd4ce4a23b9b802e0e6c23be75fac74245c..112c26823a7c5f8c2c99f5dc760be2050467129a 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,7 @@
+20030517
+ - (djm) Return of the dreaded PAM_TTY_KLUDGE, which went missing in 
+   recent merge
+
 20030517
  - (bal) strcat -> strlcat on openbsd-compat/realpath.c (rev 1.8 OpenBSD)
 

diff --git a/auth-pam.c b/auth-pam.c
index dc4116175d8c1a248fa28e25b007c6ecf6ebbd98..79fd97de8b3d1adece16570bdbb659e35d812267 100644 (file)
--- a/auth-pam.c
+++ b/auth-pam.c
@@ -29,8 +29,9 @@
  * SUCH DAMAGE.
  */
 
+/* Based on $FreeBSD: src/crypto/openssh/auth2-pam-freebsd.c,v 1.11 2003/03/31 13:48:18 des Exp $ */
 #include "includes.h"
-RCSID("$FreeBSD: src/crypto/openssh/auth2-pam-freebsd.c,v 1.11 2003/03/31 13:48:18 des Exp $");
+RCSID("$Id$");
 
 #ifdef USE_PAM
 #include <security/pam_appl.h>
@@ -293,17 +294,34 @@ sshpam_init(const char *user)
        }
        debug("PAM: initializing for \"%s\"", user);
        sshpam_err = pam_start("sshd", user, &null_conv, &sshpam_handle);
-       if (sshpam_err != PAM_SUCCESS)
+       if (sshpam_err != PAM_SUCCESS) {
+               pam_end(sshpam_handle, sshpam_err);
+               sshpam_handle = NULL;
                return (-1);
+       }
+       debug("PAM: setting PAM_RHOST to \"%s\"", pam_rhost);
        pam_rhost = get_remote_name_or_ip(utmp_len,
            options.verify_reverse_mapping);
-       debug("PAM: setting PAM_RHOST to \"%s\"", pam_rhost);
        sshpam_err = pam_set_item(sshpam_handle, PAM_RHOST, pam_rhost);
+       if (sshpam_err != PAM_SUCCESS) {
+       pam_end(sshpam_handle, sshpam_err);
+               sshpam_handle = NULL;
+               return (-1);
+       }
+#ifdef PAM_TTY_KLUDGE
+        /*
+         * Some silly PAM modules (e.g. pam_time) require a TTY to operate.
+         * sshd doesn't set the tty until too late in the auth process and 
+        * may not even set one (for tty-less connections)
+         */
+       debug("PAM: setting PAM_TTY to \"ssh\"");
+       sshpam_err = pam_set_item(sshpam_handle, PAM_TTY, "ssh");
        if (sshpam_err != PAM_SUCCESS) {
                pam_end(sshpam_handle, sshpam_err);
                sshpam_handle = NULL;
                return (-1);
        }
+#endif
        fatal_add_cleanup(sshpam_cleanup, NULL);
        return (0);
 }