Bug 680722 - ssh flooding audit log with USER_END messages
Summary: ssh flooding audit log with USER_END messages
Keywords:
Status: CLOSED DUPLICATE of bug 642792
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: openssh
Version: 6.1
Hardware: All
OS: Linux
high
high
Target Milestone: rc
: ---
Assignee: Jan F. Chadima
QA Contact: BaseOS QE Security Team
URL:
Whiteboard:
: 683456 (view as bug list)
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2011-02-27 11:14 UTC by Miroslav Vadkerti
Modified: 2011-03-28 18:24 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2011-03-01 14:31:09 UTC
Target Upstream Version:


Attachments (Terms of Use)

Description Miroslav Vadkerti 2011-02-27 11:14:48 UTC
Description of problem:
After I login/logout with to a SSHv1 ssh server processes like

11385 ?        Rs     1:33 sshd: root@notty 

Start flooding audit log with messages below. 

type=USER_END msg=audit(1298804960.636:894587): user pid=11385 uid=0 auid=0 ses=5536 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=localhost addr=::1 terminal=ssh res=success'
type=USER_END msg=audit(1298804960.646:894588): user pid=11385 uid=0 auid=0 ses=5536 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=localhost addr=::1 terminal=ssh res=success'
type=USER_END msg=audit(1298804960.646:894589): user pid=11385 uid=0 auid=0 ses=5536 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=localhost addr=::1 terminal=ssh res=success'
type=USER_END msg=audit(1298804960.646:894590): user pid=11385 uid=0 auid=0 ses=5536 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=localhost addr=::1 terminal=ssh res=success'
type=USER_END msg=audit(1298804960.646:894591): user pid=11385 uid=0 auid=0 ses=5536 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=localhost addr=::1 terminal=ssh res=success'
type=USER_END msg=audit(1298804960.646:894592): user pid=11385 uid=0 auid=0 ses=5536 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=localhost addr=::1 terminal=ssh res=success'
type=USER_END msg=audit(1298804960.646:894593): user pid=11385 uid=0 auid=0 ses=5536 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login id=0 exe="/usr/sbin/sshd" hostname=localhost addr=::1 terminal=ssh res=success'


Version-Release number of selected component (if applicable):
openssh-5.3p1-40.el6.x86_64

How reproducible:
100% on all archs

Steps to Reproduce:
1. set Protocol 1 in /etc/sshd_config
2. service sshd restart
3. ssh -1 root@localhost
4. exit
5. tailf /var/log/audit/audit.log 

Actual results:
audit.log flooded by never ending USER_END messages
sshd: root@notty processes hanging on the machine

Expected results:
audit.log not flooded, no sshd: root@notty processes hanging on the machine

Additional info:

Comment 1 Miroslav Vadkerti 2011-02-27 11:16:47 UTC
Important note:
This does not happen with SSHv2 (Protocol 2 in sshd_config)

Comment 2 Miroslav Vadkerti 2011-02-27 11:27:45 UTC
The processes cannot be killed by SIG_TERM - you have to send SIG_KILL

Comment 3 Miroslav Vadkerti 2011-02-28 08:02:34 UTC
Corrected description:
After I login/logout to a SSHv1 ssh server, processes like
[snip]

Comment 6 Miroslav Vadkerti 2011-02-28 15:05:34 UTC
This is a regression as this problem cannot be reproduced with openssh-5.3p1-40.el6.x86_64

Comment 8 Miroslav Vadkerti 2011-03-01 14:31:09 UTC
This bug is actually caused by wrong patch in bug 642792. Closing as duplicate.

*** This bug has been marked as a duplicate of bug 642792 ***

Comment 9 Steve Grubb 2011-03-28 18:24:31 UTC
*** Bug 683456 has been marked as a duplicate of this bug. ***


Note You need to log in before you can comment on or make changes to this bug.