#1008715 libpam-modules: Module pam_motd.so prints motd into stdout which breaks SSH-based services

Package:
libpam-modules
Source:
pam
Description:
Pluggable Authentication Modules for PAM
Submitter:
WHR
Date:
2022-03-31 05:45:03 UTC
Severity:
normal
#1008715#5
Date:
2022-03-31 05:41:38 UTC
From:
To:
Hello.
When using this module with sshd(8) as the default configuration, it prints
MOTD into stdout (file descriptor 1) of the SSH stream. When setting up a
SSH-based service using a delegated login shell or a forced-command key
option, pam_motd.so will prepend the MOTD into the service stream, causing
protocol error.
For example, using the following key options in '.ssh/authorized_keys' would
creating a service that retrieves a screenshot of specified virtual machine:
	no-agent-forwarding,no-X11-forwarding,no-pty,no-port-forwarding,command="exec VBoxManage controlvm <vm-name> screenshotpng /dev/stdout" <public-key>
The screenshot as a PNG stream can then be retrieved from a client-side,
using command similar to:
	ssh <address> -T [-i <private-key>] < /dev/null > screenshot.png
If pam_motd is enabled for sshd(8) however, it will corrupt the PNG image.
I suggest either printing MOTD to stderr instead, or not printing it at all
when a SSH shell session is requested without a terminal (note the pseudo-
terminal allocation is explicitly disabled via ssh(1) option '-T').