- Calls to pam_setcred, patch from Nalin Dahyabhai

   <nalin@thermo.stat.ncsu.edu>

diff --git a/ChangeLog b/ChangeLog
index f3a1108fd98b34fbcaad90af463059acd6406f72..2947cc7c0d9ac80073189e0691c5ad5c370bec9e 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -6,6 +6,8 @@
    <drankin@bohemians.lexington.ky.us>
  - Print whether OpenSSH was compiled with RSARef, patch from 
    Nalin Dahyabhai <nalin@thermo.stat.ncsu.edu>
+ - Calls to pam_setcred, patch from Nalin Dahyabhai 
+   <nalin@thermo.stat.ncsu.edu>
 
 19991228
  - Replacement for getpagesize() for systems which lack it

diff --git a/sshd.c b/sshd.c
index 6fdfb9af6036b7a374806a1765856c8d50b57ba0..5401bbe2cacbec62b23c8d873ab683c8cd04abe1 100644 (file)
--- a/sshd.c
+++ b/sshd.c
@@ -149,6 +149,7 @@ static int pamconv(int num_msg, const struct pam_message **msg,
 int do_pam_auth(const char *user, const char *password);
 void do_pam_account(char *username, char *remote_user);
 void do_pam_session(char *username, char *ttyname);
+void do_pam_setcred();
 void pam_cleanup_proc(void *context);
 
 static struct pam_conv conv = {
@@ -230,6 +231,12 @@ void pam_cleanup_proc(void *context)
                        PAM_STRERROR((pam_handle_t *)pamh, pam_retval));
                }
 
+               pam_retval = pam_setcred((pam_handle_t *)pamh, PAM_DELETE_CRED);
+               if (pam_retval != PAM_SUCCESS) {
+                       log("Cannot delete credentials: %.200s", 
+                       PAM_STRERROR((pam_handle_t *)pamh, pam_retval));
+               }
+
                pam_retval = pam_end((pam_handle_t *)pamh, pam_retval);
                if (pam_retval != PAM_SUCCESS) {
                        log("Cannot release PAM authentication: %.200s", 
@@ -301,6 +308,16 @@ void do_pam_session(char *username, char *ttyname)
        if (pam_retval != PAM_SUCCESS)
                fatal("PAM session setup failed: %.200s", PAM_STRERROR((pam_handle_t *)pamh, pam_retval));
 }
+ 
+void do_pam_setcred()
+{
+       int pam_retval;
+ 
+       debug("PAM establishing creds");
+       pam_retval = pam_setcred((pam_handle_t *)pamh, PAM_ESTABLISH_CRED);
+       if (pam_retval != PAM_SUCCESS)
+               fatal("PAM setcred failed: %.200s", PAM_STRERROR((pam_handle_t *)pamh, pam_retval));
+}
 #endif /* USE_PAM */
 
 /*
@@ -1906,6 +1923,9 @@ do_authenticated(struct passwd * pw)
                        packet_set_interactive(have_pty || display != NULL,
                                               options.keepalives);
 
+#ifdef USE_PAM
+                       do_pam_setcred();
+#endif
                        if (forced_command != NULL)
                                goto do_forced_command;
                        debug("Forking shell.");
@@ -1921,6 +1941,9 @@ do_authenticated(struct passwd * pw)
                        packet_set_interactive(have_pty || display != NULL,
                                               options.keepalives);
 
+#ifdef USE_PAM
+                       do_pam_setcred();
+#endif
                        if (forced_command != NULL)
                                goto do_forced_command;
                        /* Get command from the packet. */