Mailing List Archive

[Bug 647] Setting "UsePAM no" in sshd_config gives error if not config'ed w/ --with-pam
http://bugzilla.mindrot.org/show_bug.cgi?id=647

Summary: Setting "UsePAM no" in sshd_config gives error if not
config'ed w/ --with-pam
Product: Portable OpenSSH
Version: -current
Platform: Sparc
OS/Version: SunOS
Status: NEW
Severity: minor
Priority: P4
Component: sshd
AssignedTo: openssh-bugs@mindrot.org
ReportedBy: pon@es.net
CC: pon@es.net


For OpenSSH_3.7p1, if one does NOT use the "--with-pam" configuration
option, setting the default "#UsePAM yes" flag in sshd_config to
"UsePam no" will cause the following error:
init.d [111]# ./openssh start
/etc/ssh/sshd_config line 75: Unsupported option UsePAM

However, if one does use the "--with-pam" configuration option,
setting the flag "UsePam no" is acceptable.

Seems a bit confusing to me. Perhaps "#UsePAM no" should be the default?

Thanks.



------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
[Bug 647] Setting "UsePAM no" in sshd_config gives error if not config'ed w/ --with-pam [ In reply to ]
http://bugzilla.mindrot.org/show_bug.cgi?id=647





------- Additional Comments From dtucker@zip.com.au 2003-09-18 17:47 -------
Created an attachment (id=422)
--> (http://bugzilla.mindrot.org/attachment.cgi?id=422&action=view)
Set options->use_pam to 0 if USE_PAM is not set

On a related note, options.use_pam is set even unless overridden by the UsePAM
directive, which doesn't happen if PAM support isn't compiled in.

This means, for example, that things like this (from auth.c) don't happen when
PAM support is disabled:
#if defined(HAVE_SHADOW_H) && !defined(DISABLE_SHADOW)
if (!options.use_pam)
spw = getspnam(pw->pw_name);

Hey! That might be the cause of some of our mystery segfaults on Solaris 2.6!



------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
[Bug 647] Setting "UsePAM no" in sshd_config gives error if not config'ed w/ --with-pam [ In reply to ]
http://bugzilla.mindrot.org/show_bug.cgi?id=647





------- Additional Comments From djm@mindrot.org 2003-09-18 18:40 -------
Maybe it should just default to 0



------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
[Bug 647] Setting "UsePAM no" in sshd_config gives error if not config'ed w/ --with-pam [ In reply to ]
http://bugzilla.mindrot.org/show_bug.cgi?id=647





------- Additional Comments From dtucker@zip.com.au 2003-09-18 18:57 -------
That was my first thought, but most of the options go through this "-1 = unset"
-> set from config -> apply default if -1 process. I assumed there was a reason
for it, so left it that way.



------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.