From owner-freebsd-security Tue Jul 2 15:41:33 2002 Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.FreeBSD.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 8DAA437B400 for ; Tue, 2 Jul 2002 15:41:30 -0700 (PDT) Received: from flood.ping.uio.no (flood.ping.uio.no [129.240.78.31]) by mx1.FreeBSD.org (Postfix) with ESMTP id 1B27B43E13 for ; Tue, 2 Jul 2002 15:41:30 -0700 (PDT) (envelope-from des@ofug.org) Received: by flood.ping.uio.no (Postfix, from userid 2602) id 3FE1D534B; Wed, 3 Jul 2002 00:41:28 +0200 (CEST) X-URL: http://www.ofug.org/~des/ X-Disclaimer: The views expressed in this message do not necessarily coincide with those of any organisation or company with which I am or have been affiliated. To: Mikhail Teterin Cc: security@FreeBSD.org Subject: Re: two sshd processes per session? References: <200207021141.34021.mi+mx@aldan.algebra.com> <200207021829.44485.mi+mx@aldan.algebra.com> From: Dag-Erling Smorgrav Date: 03 Jul 2002 00:41:27 +0200 In-Reply-To: <200207021829.44485.mi+mx@aldan.algebra.com> Message-ID: Lines: 22 User-Agent: Gnus/5.0808 (Gnus v5.8.8) Emacs/21.2 MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org Mikhail Teterin writes: > What exactly will break? At least, the w(1)'s output is correct after > the disconnection -- shell is responsible for that. What else? pam_close_session() will not run, for one. This could mean for instance that locally cached copies of Kerberos tickets you obtained when you logged in won't be removed. I'm not sure that's a security risk, but it could fill up your /tmp after a while. Also, protocol version 2 allows multiple ptys per connection (i.e. you can connect to an ssh server and open a shell, then later open a second shell through the same TCP connection). OpenSSH's ssh client doesn't support this, but many other clients do (PuTTY, for instance), and the OpenSSH server does. If you try to do this after having killed the monitor, not only will you not get a second shell but the unprivileged process will probably (I haven't checked the source) log an error and abort, killing your first shell and any tunneled connections you might have. DES -- Dag-Erling Smorgrav - des@ofug.org To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message