dilim/openssh-portable
1
0 Fork 0
mirror of https://github.com/openssh/openssh-portable.git synced 2026-11-06 05:16:43 +00:00
Code Issues Packages Projects Releases Wiki Activity

upstream: clean up Kerberos ccache if KerberosAuthentication

Browse Source 
password authentication succeeds but the session is subsequently refused.

Anthropic ANT-2026-JGFGOUGS

OpenBSD-Commit-ID: 1dfdb0a8eab7270f62273b42e831ab40ffbdf4dd
This commit is contained in:
djm@openbsd.org authored and Damien Miller committed 2026-10-30 20:12:57 +11:00
1 parent 9c65c2806c
commit ea2111b562
4 files changed
+36 -8
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

auth-krb5.c
+4 -1
View File
@@ -1,4 +1,4 @@
/* $OpenBSD: auth-krb5.c,v 1.26 2026/02/08 19:54:31 dtucker Exp $ */
/* $OpenBSD: auth-krb5.c,v 1.27 2026/10/30 02:31:35 djm Exp $ */
/*
* Kerberos v5 authentication and ticket-passing routines.
*
@@ -228,6 +228,9 @@ krb5_cleanup_proc(Authctxt *authctxt)
krb5_cc_destroy(authctxt->krb5_ctx, authctxt->krb5_fwd_ccache);
authctxt->krb5_fwd_ccache = NULL;
}
authctxt->krb5_ticket_file = NULL;
free(authctxt->krb5_ccname);
authctxt->krb5_ccname = NULL;
if (authctxt->krb5_user) {
krb5_free_principal(authctxt->krb5_ctx, authctxt->krb5_user);
authctxt->krb5_user = NULL;
auth-passwd.c
+6 -2
View File
@@ -1,4 +1,4 @@
/* $OpenBSD: auth-passwd.c,v 1.49 2025/05/08 17:32:53 tedu Exp $ */
/* $OpenBSD: auth-passwd.c,v 1.50 2026/10/30 02:31:36 djm Exp $ */
/*
* Author: Tatu Ylonen <ylo@cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -96,8 +96,12 @@ auth_password(struct ssh *ssh, const char *password)
#ifdef KRB5
if (options.kerberos_authentication == 1) {
int ret = auth_krb5_password(authctxt, password);
if (ret == 1 || ret == 0)
if (ret == 1 || ret == 0) {
/* Don't keep a ticket cache for a refused login. */
if (ret && !ok)
krb5_cleanup_proc(authctxt);
return ret && ok;
}
/* Fall back to ordinary passwd authentication. */
}
#endif
monitor_wrap.c
+17 -1
View File
@@ -1,4 +1,4 @@
/* $OpenBSD: monitor_wrap.c,v 1.151 2026/09/16 06:23:16 djm Exp $ */
/* $OpenBSD: monitor_wrap.c,v 1.152 2026/10/30 02:31:36 djm Exp $ */
/*
* Copyright 2002 Niels Provos <provos@citi.umich.edu>
* Copyright 2002 Markus Friedl <markus@openbsd.org>
@@ -683,7 +683,23 @@ mm_session_pty_cleanup2(Session *s)
error("close(s->ptymaster/%d): %s",
s->ptymaster, strerror(errno));
/*
* If no command was started on this pty then do_exec_pty() never
* took over the descriptors received in mm_pty_allocate(), so close
* them here. Otherwise the channel owns the master and the slave was
* closed after the fork.
*/
if (s->pid == 0) {
if (close(s->ptyfd) == -1)
error("close(s->ptyfd/%d): %s",
s->ptyfd, strerror(errno));
if (close(s->ttyfd) == -1)
error("close(s->ttyfd/%d): %s",
s->ttyfd, strerror(errno));
}
/* unlink pty from session */
s->ptyfd = s->ptymaster = -1;
s->ttyfd = -1;
}
session.c
+9 -4
View File
@@ -1,4 +1,4 @@
/* $OpenBSD: session.c,v 1.353 2026/10/30 02:11:00 djm Exp $ */
/* $OpenBSD: session.c,v 1.354 2026/10/30 02:31:36 djm Exp $ */
/*
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
* All rights reserved
@@ -2649,9 +2649,14 @@ do_cleanup(struct ssh *ssh, Authctxt *authctxt)
return;
#ifdef KRB5
if (options.kerberos_ticket_cleanup &&
authctxt->krb5_ctx)
krb5_cleanup_proc(authctxt);
/*
* Remove the ticket cache written by Kerberos password
* authentication; if the login never completed there is no
* session that could use it, regardless of KerberosTicketCleanup.
*/
if (authctxt->krb5_ctx && (options.kerberos_ticket_cleanup ||
!authctxt->authenticated))
krb5_cleanup_proc(authctxt);
#endif
#ifdef GSSAPI