|
 |
df26987 |
diff -up openssh-8.0p1/auth-pam.c.preserve-pam-errors openssh-8.0p1/auth-pam.c
|
|
|
df26987 |
--- openssh-8.0p1/auth-pam.c.preserve-pam-errors 2021-03-31 17:03:15.618592347 +0200
|
|
|
df26987 |
+++ openssh-8.0p1/auth-pam.c 2021-03-31 17:06:58.115220014 +0200
|
|
|
df26987 |
@@ -511,7 +511,11 @@ sshpam_thread(void *ctxtp)
|
|
|
df26987 |
goto auth_fail;
|
|
|
df26987 |
|
|
|
df26987 |
if (!do_pam_account()) {
|
|
|
df26987 |
- sshpam_err = PAM_ACCT_EXPIRED;
|
|
|
df26987 |
+ /* Preserve PAM_PERM_DENIED and PAM_USER_UNKNOWN.
|
|
|
df26987 |
+ * Backward compatibility for other errors. */
|
|
|
df26987 |
+ if (sshpam_err != PAM_PERM_DENIED
|
|
|
df26987 |
+ && sshpam_err != PAM_USER_UNKNOWN)
|
|
|
df26987 |
+ sshpam_err = PAM_ACCT_EXPIRED;
|
|
|
df26987 |
goto auth_fail;
|
|
|
df26987 |
}
|
|
|
df26987 |
if (sshpam_authctxt->force_pwchange) {
|
|
|
df26987 |
@@ -568,8 +572,10 @@ sshpam_thread(void *ctxtp)
|
|
|
df26987 |
pam_strerror(sshpam_handle, sshpam_err))) != 0)
|
|
|
df26987 |
fatal("%s: buffer error: %s", __func__, ssh_err(r));
|
|
|
df26987 |
/* XXX - can't do much about an error here */
|
|
|
df26987 |
- if (sshpam_err == PAM_ACCT_EXPIRED)
|
|
|
df26987 |
- ssh_msg_send(ctxt->pam_csock, PAM_ACCT_EXPIRED, buffer);
|
|
|
df26987 |
+ if (sshpam_err == PAM_PERM_DENIED
|
|
|
df26987 |
+ || sshpam_err == PAM_USER_UNKNOWN
|
|
|
df26987 |
+ || sshpam_err == PAM_ACCT_EXPIRED)
|
|
|
df26987 |
+ ssh_msg_send(ctxt->pam_csock, sshpam_err, buffer);
|
|
|
df26987 |
else if (sshpam_maxtries_reached)
|
|
|
df26987 |
ssh_msg_send(ctxt->pam_csock, PAM_MAXTRIES, buffer);
|
|
|
df26987 |
else
|
|
|
df26987 |
@@ -856,10 +862,12 @@ sshpam_query(void *ctx, char **name, cha
|
|
|
df26987 |
plen++;
|
|
|
df26987 |
free(msg);
|
|
|
df26987 |
break;
|
|
|
df26987 |
+ case PAM_USER_UNKNOWN:
|
|
|
df26987 |
+ case PAM_PERM_DENIED:
|
|
|
df26987 |
case PAM_ACCT_EXPIRED:
|
|
|
df26987 |
+ sshpam_account_status = 0;
|
|
|
df26987 |
+ /* FALLTHROUGH */
|
|
|
df26987 |
case PAM_MAXTRIES:
|
|
|
df26987 |
- if (type == PAM_ACCT_EXPIRED)
|
|
|
df26987 |
- sshpam_account_status = 0;
|
|
|
df26987 |
if (type == PAM_MAXTRIES)
|
|
|
df26987 |
sshpam_set_maxtries_reached(1);
|
|
|
df26987 |
/* FALLTHROUGH */
|