Running sshd with Privilege Seperation drops connection on password change

[Darren Tucker]

Hi Darren/Damien,
Sorry for responding so late. Still hope we can get this sorted out.
Yes I am indeed using PAM for ssh authentication and disabling priv seperation is a no-go for us since it opens up a security loophole.
From what I can see in ptree and auth logs, when the child passwd process returns with SIGCHLD, the parent sshd process terminates.

Despite being asked for them earlier, you still have not provided the
full debug logs, which would tell, amongst other things, what version
of OpenSSH this is. That said...

[...]

Dec 16 22:22:13 knasim-ubuntu1 sshd[8623]: debug1: SELinux support disabled

I know of no version of OpenSSH supplied by us that has that message,
so I suspect you are using a modified version.

Dec 16 22:22:13 knasim-ubuntu1 sshd[8569]: debug3: PAM: sshpam_passwd_conv called with 1 messages

[...]

Dec 16 22:22:24 knasim-ubuntu1 passwd[8624]: pam_unix(passwd:chauthtok): password changed for nasim

This is working exactly as I described in option #2 earlier: password
authentication followed by execing /bin/passwd.

Your other option is what I described in #1: Disable
PasswordAuthentication in sshd_config and use
ChallengeResponseAuthentication/KbdInteractiveAuthentication.

Dec 16 22:22:24 knasim-ubuntu1 sshd[8623]: debug1: Received SIGCHLD.

[...]

Let me know what you guys think.

I think it is working as intended.

[Jakub Jelen]

Post by Darren Tucker

Dec 16 22:22:13 knasim-ubuntu1 sshd[8623]: debug1: SELinux support disabled

I know of no version of OpenSSH supplied by us that has that message,
so I suspect you are using a modified version.

FYI, it is part of port-linux.c:

https://anongit.mindrot.org/openssh.git/tree/openbsd-compat/port-linux.c#n53

Post by Darren Tucker
On changing the password successfully, sshd will drop the connection

and client has to reconnect.

Yes, this is intended behavior and described in the message to user
before prompting for password:
https://anongit.mindrot.org/openssh.git/tree/session.c#n1578

Without privilege separation, there is though some problem that the
connection is NOT dropped, if I remember well, but I consider this as a
low-priority, since it is not advised to use ssh without privilege
separation.