From owner-freebsd-security@FreeBSD.ORG Tue Sep 20 19:13:40 2011 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 29C21106566C for ; Tue, 20 Sep 2011 19:13:40 +0000 (UTC) (envelope-from mike@sentex.net) Received: from smarthost1.sentex.ca (smarthost1-6.sentex.ca [IPv6:2607:f3e0:0:1::12]) by mx1.freebsd.org (Postfix) with ESMTP id B39C38FC16 for ; Tue, 20 Sep 2011 19:13:39 +0000 (UTC) Received: from [IPv6:2607:f3e0:0:4:f025:8813:7603:7e4a] (saphire3.sentex.ca [IPv6:2607:f3e0:0:4:f025:8813:7603:7e4a]) by smarthost1.sentex.ca (8.14.4/8.14.4) with ESMTP id p8KJDbOF024390; Tue, 20 Sep 2011 15:13:38 -0400 (EDT) (envelope-from mike@sentex.net) Message-ID: <4E78E5DC.6050600@sentex.net> Date: Tue, 20 Sep 2011 15:13:32 -0400 From: Mike Tancsa Organization: Sentex Communications User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101207 Thunderbird/3.1.7 MIME-Version: 1.0 To: Corey Smith References: <4E778357.1030206@sentex.net> In-Reply-To: <4E778357.1030206@sentex.net> X-Enigmail-Version: 1.1.1 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 8bit X-Scanned-By: MIMEDefang 2.71 on IPv6:2607:f3e0:0:1::12 Cc: freebsd-security@freebsd.org Subject: pam_ssh_agent_auth coredump on AMD64 (was Re: PAM modules) X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 20 Sep 2011 19:13:40 -0000 On 9/19/2011 2:00 PM, Mike Tancsa wrote: > On 9/16/2011 3:10 PM, Corey Smith wrote: >> On 09/16/2011 11:05 AM, Dag-Erling Smørgrav wrote: >>> My question is: which ones? >> >> security/pam_ssh_agent_auth >> >> It is BSD licensed and handy for sudo. > > > Neato, I didnt know of this module for sudo! However, with the default > install on AMD64, I am getting coredump. Actually, I tried the same setup on i386 and it seems to work just fine. However, on an AMD64 machine, sudo just coredumps. Anyone running this setup on amd64 ? Running with -D9, normally it looks something like % sudo -D9 su sudo: settings: debug_level=9 sudo: settings: progname=sudo sudo: settings: network_addrs=.... sudo: sudo_mode 1 sudo: policy plugin returns 1 sudo: command info: umask=022 sudo: command info: command=/usr/bin/su sudo: command info: runas_uid=0 sudo: command info: runas_gid=0 sudo: command info: runas_groups=0,5 sudo: command info: closefrom=3 sudo: command info: set_utmp=true sudo: command info: login_class=default where as on amd64, % sudo -D9 su sudo: settings: debug_level=9 sudo: settings: progname=sudo sudo: settings: network_addrs=.... sudo: sudo_mode 1 Segmentation fault It seems to die in the call to static int policy_check(struct plugin_container *plugin, int argc, char * const argv[], char *env_add[], char **command_info[], char **argv_out[], char **user_env_out[]) { return plugin->u.policy->check_policy(argc, argv, env_add, command_info, argv_out, user_env_out); } I cant get it to coredump since its setuid. Before I start adding more debug printfs, does anyone have any suggestions as to what it might be ? ---Mike > > I added > > > # auth > auth include system > - > +auth sufficient /usr/local/lib/pam_ssh_agent_auth.so > file=/etc/sudokeys debug > # account > account include system > > to /usr/local/etc/pam.d/sudo > > and added > > --- sudoers.sample 2011-09-19 13:24:56.000000000 -0400 > +++ sudoers 2011-09-19 13:29:17.000000000 -0400 > @@ -62,6 +62,10 @@ > ## Uncomment to enable special input methods. Care should be taken as > ## this may allow users to subvert the command being run via sudo. > # Defaults env_keep += "XMODIFIERS GTK_IM_MODULE QT_IM_MODULE > QT_IM_SWITCHER" > + > +Defaults env_keep += SSH_AUTH_SOCK > + > + > > > I must be missing something obvious? > > ---Mike > > -- ------------------- Mike Tancsa, tel +1 519 651 3400 Sentex Communications, mike@sentex.net Providing Internet services since 1994 www.sentex.net Cambridge, Ontario Canada http://www.tancsa.com/