[21152] in bugtraq
pam session
daemon@ATHENA.MIT.EDU (Christian Kraemer)
Fri Jun 22 18:47:44 2001
From: Christian Kraemer <ckraemer@ginko.de>
To: bugtraq@securityfocus.com
Date: Tue, 19 Jun 2001 03:11:02 +0200
Content-Type: text/plain
MIME-Version: 1.0
Message-Id: <01061903113100.00225@christian.localdomain>
Content-Transfer-Encoding: 8bit
Hi,
Does anybody know why openssh (openssh-2.9p1) on a linux system does not call
pam_open_session if no pty is used? In this way the session modules (in
/etc/pam.d) are not activated.
This is espacially anoying if you
use pam_limits.so to set rlimits. Every user could
cirrcumvent them easily by calling ssh in this way:
ssh user@server /bin/sh
I do not know if this issue has been disscused before and if this behavior is
not alright .....
cu Christian
