Bug 1303036 - su and sudo crash when using pam_ssh_agent_auth
su and sudo crash when using pam_ssh_agent_auth
Status: CLOSED ERRATA
Product: Fedora
Classification: Fedora
Component: openssh (Show other bugs)
23
Unspecified Unspecified
unspecified Severity unspecified
: ---
: ---
Assigned To: Jakub Jelen
Fedora Extras Quality Assurance
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2016-01-29 06:43 EST by Sjoerd Mullender
Modified: 2016-01-31 21:20 EST (History)
5 users (show)

See Also:
Fixed In Version: openssh-7.1p2-3.fc23
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2016-01-31 21:20:40 EST
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Sjoerd Mullender 2016-01-29 06:43:46 EST
Description of problem:
In my file /etc/pam.d/sudo I have added the line
auth sufficient pam_ssh_agent_auth.so file=/etc/security/authorized_keys
at the start of the file.  Since the upgrade to pam_ssh_agent_auth-0.10.2-1.2.fc23.x86_64, sudo crashes with a Segmentation fault when called when I have the environment variable SSH_AUTH_SOCK set to point to a valid agent socket.
After downgrading to pam_ssh_agent_auth-0.10.2-1.2.fc23.x86_64, sudo works again.

Version-Release number of selected component (if applicable):
pam_ssh_agent_auth-0.10.2-1.2.fc23.x86_64

How reproducible:
100%

Steps to Reproduce:
1.install latest pam_ssh_agent_auth and follow instructions in man page
2.run an ssh agent
3.sudo whoami

Actual results:
Segmentation fault

Expected results:
command executes

Additional info:
Same problem with su and the appropriate change to /etc/pam.d/su.
Comment 1 Jakub Jelen 2016-01-29 07:01:33 EST
I can't reproduce the crash on my testing machine. Can you add also "debug" flag and post the log what is going on under the hood (should be in /var/log/secure)? Do you have correct permissions for the /etc/security/authorized_keys?
Comment 2 Sjoerd Mullender 2016-01-29 07:34:18 EST
$ ls -l /etc/security/authorized_keys
-rw-r--r--. 1 root root 750 Sep 12  2013 /etc/security/authorized_keys
$ ls -Z /etc/security/authorized_keys
unconfined_u:object_r:etc_t:s0 /etc/security/authorized_keys

After I added debug, I see the following in the log file (single sudo invocation):
Jan 29 13:25:16 mdbs sudo[13481]: Beginning pam_ssh_agent_auth for user sjoerd
Jan 29 13:25:16 mdbs sudo[13481]: Attempting authentication: `sjoerd' as `sjoerd' using /etc/security/authorized_keys
Jan 29 13:25:16 mdbs sudo[13481]: Contacted ssh-agent of user sjoerd (1000)
Jan 29 13:25:16 mdbs sudo[13481]: trying public key file /etc/security/authorized_keys
Jan 29 13:25:16 mdbs sudo[13481]: auth_secure_filename: checking for uid: 0
Jan 29 13:25:16 mdbs sudo[13481]: secure_filename: checking '/etc/security'
Jan 29 13:25:16 mdbs sudo[13481]: secure_filename: checking '/etc'
Jan 29 13:25:16 mdbs sudo[13481]: secure_filename: checking '/'
Jan 29 13:25:16 mdbs sudo[13481]: key not found
Jan 29 13:25:16 mdbs sudo[13481]: trying public key file /etc/security/authorized_keys
Jan 29 13:25:16 mdbs sudo[13481]: auth_secure_filename: checking for uid: 0
Jan 29 13:25:16 mdbs sudo[13481]: secure_filename: checking '/etc/security'
Jan 29 13:25:16 mdbs sudo[13481]: secure_filename: checking '/etc'
Jan 29 13:25:16 mdbs sudo[13481]: secure_filename: checking '/'
Jan 29 13:25:16 mdbs sudo[13481]: key not found


Maybe also relevant:
$ ssh-add -l | wc -l
7
Comment 3 Jakub Jelen 2016-01-29 16:11:36 EST
Ok. I got that. When I have only one valid key, it works fine.

For more keys (or if the first key is not valid), it segfaults, because the buffer gots somehow corrupted for some reason.
This unfortunately slipped through my tests.

Thank you for the report. I will try to solve it asap.
Comment 4 Fedora Update System 2016-01-30 04:06:59 EST
openssh-7.1p2-3.fc23 has been submitted as an update to Fedora 23. https://bodhi.fedoraproject.org/updates/FEDORA-2016-72f953d453
Comment 5 Fedora Update System 2016-01-30 14:54:58 EST
openssh-7.1p2-3.fc23 has been pushed to the Fedora 23 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2016-72f953d453
Comment 6 Fedora Update System 2016-01-31 21:20:37 EST
openssh-7.1p2-3.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.

Note You need to log in before you can comment on or make changes to this bug.