#439058 GSSAPICleanupCredentials doesn't work for root

Package:
openssh-server
Source:
openssh
Description:
secure shell (SSH) server, for secure access from remote machines
Submitter:
Tim Abbott
Date:
2026-08-23 11:43:02 UTC
Severity:
important
#439058#5
Date:
2007-08-21 21:39:24 UTC
From:
To:
GSSAPICleanupCredentials is not deleting Kerberos tickets created if one
forwards credentials (using GSSAPIDelegate Credentials) to root.

Further investigation reveals that the GSSAPI client store's filename
field is being overwritten with 0 sometime between being set in
gss-serv-krb5.c and being checked during cleanup in gss-serv.c.

The behavior of overwriting data structures with 0s seems very similar to
a bug I reported a year ago in ssh-krb5 3.8.1 on sarge:

#372680: ssh-krb5: pam_close_session is not being called

While #372680 does not seem to be a general problem in ssh 4.3p2-9, I do
notice that pam_close_session is also not being called for root in
4.3p2-9.

 	-Tim Abbott
#439058#10
Date:
2007-10-04 19:38:06 UTC
From:
To:
Tim is not the only one experiencing this problem.