From edwin@mavetju.org  Sat Oct 12 20:21:24 2002
Return-Path: <edwin@mavetju.org>
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 54F7F37B401
	for <FreeBSD-gnats-submit@freebsd.org>; Sat, 12 Oct 2002 20:21:24 -0700 (PDT)
Received: from topaz.mdcc.cx (topaz.mdcc.cx [212.204.230.141])
	by mx1.FreeBSD.org (Postfix) with ESMTP id B8D1243E77
	for <FreeBSD-gnats-submit@freebsd.org>; Sat, 12 Oct 2002 20:21:23 -0700 (PDT)
	(envelope-from edwin@mavetju.org)
Received: from k7.mavetju (topaz.mdcc.cx [212.204.230.141])
	by topaz.mdcc.cx (Postfix) with ESMTP id 254072B678
	for <FreeBSD-gnats-submit@freebsd.org>; Sun, 13 Oct 2002 05:21:21 +0200 (CEST)
Received: by k7.mavetju (Postfix, from userid 1001)
	id 8AB716A712B; Sun, 13 Oct 2002 13:21:18 +1000 (EST)
Message-Id: <20021013032118.8AB716A712B@k7.mavetju>
Date: Sun, 13 Oct 2002 13:21:18 +1000 (EST)
From: Edwin Groothuis <edwin@mavetju.org>
Reply-To: Edwin Groothuis <edwin@mavetju.org>
To: FreeBSD-gnats-submit@freebsd.org
Cc:
Subject: sshd gives fatal while logging off
X-Send-Pr-Version: 3.113
X-GNATS-Notify:

>Number:         43994
>Category:       bin
>Synopsis:       sshd gives fatal while logging off
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    des
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Sat Oct 12 20:30:01 PDT 2002
>Closed-Date:    Tue Aug 19 03:50:14 PDT 2003
>Last-Modified:  Tue Aug 19 03:50:14 PDT 2003
>Originator:     Edwin Groothuis
>Release:        FreeBSD 4.7-RELEASE i386
>Organization:
-
>Environment:
System: FreeBSD friet47.mavetju 4.7-RELEASE FreeBSD 4.7-RELEASE #0: Wed Oct 9 15:08:34 GMT 2002 root@builder.freebsdmall.com:/usr/obj/usr/src/sys/GENERIC i386

Running under VMWare. OS is straight out of the box, no modifications
regarding nything yet.

>Description:

When logging off I see this message coming up on the console:

Oct 12 16:32:43 friet47 sshd[122]: fatal: msg_send: write
Oct 12 16:32:55 friet47 sshd[7310]: fatal: msg_send: write

Running sshd in debug mode (triple -d) I get:

debug1: Received SIGCHLD.
debug2: notify_done: reading
debug1: End of interactive session; stdin 3, stdout (read 2037, sent 2037), stderr 0 bytes.
debug1: channel_free: channel 0: auth socket, nchannels 1
debug3: channel_free: status: The following connections are open:

debug3: channel_close_fds: channel 0: r 9 w 9 e -1
debug1: Command exited with status 1.
debug1: Received exit confirmation.
debug1: session_close: session 0 pid 9095
debug1: session_pty_cleanup: session 0 release /dev/ttyp0
debug1: restore_uid
Closing connection to 192.168.0.1
debug3: msg_send: type 7
msg_send: write

debug1: Calling cleanup 0x805ec88(0x0)
debug1: Calling cleanup 0x804d72c(0x0)


This is the write in msg.c line 43 (the first one). After some
debugging, it's caused by these lines:

static void *
pam_child(struct pam_ctxt *ctxt)
{
        Buffer buffer;
        struct pam_conv pam_conv = { pam_child_conv, ctxt };
        pam_handle_t *pamh;
        int pam_err;


        buffer_init(&buffer);
        setproctitle("%s [pam]", ctxt->pam_user);
        pam_err = pam_start("sshd", ctxt->pam_user, &pam_conv, &pamh);
        if (pam_err != PAM_SUCCESS)
                goto auth_fail;
        pam_err = pam_authenticate(pamh, 0);
[ pam_err is 19 here: PAM_CONV_ERR: Conversation error ]
        if (pam_err != PAM_SUCCESS)
                goto auth_fail;
        pam_err = pam_acct_mgmt(pamh, 0);


>How-To-Repeat:

Install a clean 4.7-RELEASE, log in via ssh -1 and logoff. Check the console.

>Fix:

Beyond my capabilities.

Workaround are
- ignore it and loose some account management information.
- set ChallengeResponseAuthentication to no in /etc/ssh/sshd_config

>Release-Note:
>Audit-Trail:
Responsible-Changed-From-To: freebsd-bugs->des 
Responsible-Changed-By: kris 
Responsible-Changed-When: Sat Jul 12 17:59:00 PDT 2003 
Responsible-Changed-Why:  
Assign to SSH maintainer 

http://www.freebsd.org/cgi/query-pr.cgi?pr=43994 

From: des@des.no (Dag-Erling =?iso-8859-1?q?Sm=F8rgrav?=)
To: freebsd-gnats-submit@freebsd.org
Cc:  
Subject: Re: bin/43994
Date: Mon, 14 Jul 2003 12:51:24 +0200

 Any idea what triggered the failed msg_send?
 Were you using ssh1 or ssh2?
 How did you authenticate yourself?
 
 DES
 --=20
 Dag-Erling Sm=F8rgrav - des@des.no
State-Changed-From-To: open->closed 
State-Changed-By: des 
State-Changed-When: Tue Aug 19 03:50:12 PDT 2003 
State-Changed-Why:  
Feedback timeout. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=43994 
>Unformatted:
