Bug 680722

Summary: ssh flooding audit log with USER_END messages
Product: Red Hat Enterprise Linux 6 Reporter: Miroslav Vadkerti <mvadkert>
Component: opensshAssignee: Jan F. Chadima <jchadima>
Status: CLOSED DUPLICATE QA Contact: BaseOS QE Security Team <qe-baseos-security>
Severity: high Docs Contact:
Priority: high    
Version: 6.1CC: jgalipea, michal.kosciowski, mitr, pvrabec
Target Milestone: rcKeywords: Regression
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2011-03-01 14:31:09 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description Miroslav Vadkerti 2011-02-27 11:14:48 UTC 
Description of problem:
After I login/logout with to a SSHv1 ssh server processes like

11385 ?        Rs     1:33 sshd: root@notty 

Start flooding audit log with messages below. 

type=USER_END msg=audit(1298804960.636:894587): user pid=11385 uid=0 auid=0 ses=5536 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=localhost addr=::1 terminal=ssh res=success'
type=USER_END msg=audit(1298804960.646:894588): user pid=11385 uid=0 auid=0 ses=5536 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=localhost addr=::1 terminal=ssh res=success'
type=USER_END msg=audit(1298804960.646:894589): user pid=11385 uid=0 auid=0 ses=5536 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=localhost addr=::1 terminal=ssh res=success'
type=USER_END msg=audit(1298804960.646:894590): user pid=11385 uid=0 auid=0 ses=5536 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=localhost addr=::1 terminal=ssh res=success'
type=USER_END msg=audit(1298804960.646:894591): user pid=11385 uid=0 auid=0 ses=5536 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=localhost addr=::1 terminal=ssh res=success'
type=USER_END msg=audit(1298804960.646:894592): user pid=11385 uid=0 auid=0 ses=5536 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=localhost addr=::1 terminal=ssh res=success'
type=USER_END msg=audit(1298804960.646:894593): user pid=11385 uid=0 auid=0 ses=5536 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=localhost addr=::1 terminal=ssh res=success'


Version-Release number of selected component (if applicable):
openssh-5.3p1-40.el6.x86_64

How reproducible:
100% on all archs

Steps to Reproduce:
1. set Protocol 1 in /etc/sshd_config
2. service sshd restart
3. ssh -1 root@localhost
4. exit
5. tailf /var/log/audit/audit.log 

Actual results:
audit.log flooded by never ending USER_END messages
sshd: root@notty processes hanging on the machine

Expected results:
audit.log not flooded, no sshd: root@notty processes hanging on the machine

Additional info:
Comment 1 Miroslav Vadkerti 2011-02-27 11:16:47 UTC 
Important note:
This does not happen with SSHv2 (Protocol 2 in sshd_config)
Comment 2 Miroslav Vadkerti 2011-02-27 11:27:45 UTC 
The processes cannot be killed by SIG_TERM - you have to send SIG_KILL
Comment 3 Miroslav Vadkerti 2011-02-28 08:02:34 UTC 
Corrected description:
After I login/logout to a SSHv1 ssh server, processes like
[snip]
Comment 6 Miroslav Vadkerti 2011-02-28 15:05:34 UTC 
This is a regression as this problem cannot be reproduced with openssh-5.3p1-40.el6.x86_64
Comment 8 Miroslav Vadkerti 2011-03-01 14:31:09 UTC 
This bug is actually caused by wrong patch in bug 642792. Closing as duplicate.

*** This bug has been marked as a duplicate of bug 642792 ***
Comment 9 Steve Grubb 2011-03-28 18:24:31 UTC 
*** Bug 683456 has been marked as a duplicate of this bug. ***