https://bugzilla.mindrot.org/show_bug.cgi?id=3778
Bug ID: 3778
Summary: Custom PAM module's pam_info / pam_echo duplicated
output when running on SSH
Product: Portable OpenSSH
Version: 9.9p1
Hardware: Other
OS: Linux
Status: NEW
Severity: normal
Priority: P5
Component: PAM support
Assignee: unassigned-b...@mindrot.org
Reporter: jcasti...@secureauth.com
I'm currently developing a custom PAM module to add MFA to Linux
authentication, and I'm encountering an issue when message printed via
pam_info function are being printed twice if my module is called on ssh
authentication.
I tested this on two ways by using my own simple PAM module but also
using pam_echo module and both throws same behavior.
This was tested on Red Hat Enterprise Linux, Ubuntu and Debian, and
also tested the same module on other auth like sudo or su, and the
issue is not present.
----------
In order to reproduce this the simpler method will be to use
pam_echo.so module.
PAM configuration file ( from Red Hat Enterprise Linux 9) on
/etc/pam.d/sshd
#%PAM-1.0
auth substack password-auth
auth required pam_echo.so hello_echo
auth include postlogin
account required pam_sepermit.so
account required pam_nologin.so
account include password-auth
password include password-auth
# pam_selinux.so close should be the first session rule
session required pam_selinux.so close
session required pam_loginuid.so
# pam_selinux.so open should only be followed by sessions to be
executed in the user context
session required pam_selinux.so open env_params
session required pam_namespace.so
session optional pam_keyinit.so force revoke
#session optional pam_motd.so
session include password-auth
session include postlogin
Using this configuration will throw the following output:
[myuser@rhel9vc ~]$ ssh localhost
(myuser@localhost) Password:
hello_echo
hello_echo
Last login: Sun Jan 19 10:25:57 2025 from ::1
[myuser@rhel9vc ~]$
------------------------------------
--
You are receiving this mail because:
You are watching the assignee of the bug.
_______________________________________________
openssh-bugs mailing list
openssh-bugs@mindrot.org
https://lists.mindrot.org/mailman/listinfo/openssh-bugs
