From e017ae71dad4837b0d22f291b0b0e0949075f822 Mon Sep 17 00:00:00 2001 From: Chen Qi Date: Wed, 2 Jul 2014 14:24:39 +0800 Subject: openssh: avoid checking empty passwords to mess up with PAM modules Previously, even if PAM is enabled for ssh, the daemon still tries to authenticate an empty password. This leads to authentication failure which would mess up with PAM modules. As a result, if 'UsePAM', 'PermitEmptyPasswords' and 'PasswordAuthentication' are enabled, no user can login correctly. We would meet the following error message at the client side. Write failed: Broken Pipe This patch fixes the above problem by checking whether PAM is enabled before authenticating an empty password. After all, if PAM is enabled, the task of authenticating passwords should be handled to PAM modules. [YOCTO #6466] Signed-off-by: Chen Qi Signed-off-by: Richard Purdie --- ...c-avoid-authenticate-empty-passwords-to-m.patch | 30 ++++++++++++++++++++++ 1 file changed, 30 insertions(+) create mode 100644 meta/recipes-connectivity/openssh/openssh/auth2-none.c-avoid-authenticate-empty-passwords-to-m.patch (limited to 'meta/recipes-connectivity/openssh/openssh') diff --git a/meta/recipes-connectivity/openssh/openssh/auth2-none.c-avoid-authenticate-empty-passwords-to-m.patch b/meta/recipes-connectivity/openssh/openssh/auth2-none.c-avoid-authenticate-empty-passwords-to-m.patch new file mode 100644 index 0000000000..ba13cd1919 --- /dev/null +++ b/meta/recipes-connectivity/openssh/openssh/auth2-none.c-avoid-authenticate-empty-passwords-to-m.patch @@ -0,0 +1,30 @@ +Upstream-Status: Pending + +Subject: auth2-none.c: avoid authenticate empty passwords to mess up with PAM + +If UsePAM, PermitEmptyPasswords, PasswordAuthentication are enabled. The ssh daemon +will try to authenticate an empty password, resulting in login failures of any user. +If PAM is enabled, then we should leave the task of password authentication to PAM. + +Signed-off-by: Chen Qi + +--- + auth2-none.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/auth2-none.c b/auth2-none.c +index c8c6c74..b48b2fd 100644 +--- a/auth2-none.c ++++ b/auth2-none.c +@@ -61,7 +61,7 @@ userauth_none(Authctxt *authctxt) + { + none_enabled = 0; + packet_check_eom(); +- if (options.permit_empty_passwd && options.password_authentication) ++ if (options.permit_empty_passwd && options.password_authentication && !options.use_pam) + return (PRIVSEP(auth_password(authctxt, ""))); + return (0); + } +-- +1.7.9.5 + -- cgit 1.2.3-korg