#601864 openssh-server: Environment variable defaults in PAM act as overrides

Package:
openssh-server
Source:
openssh
Description:
secure shell (SSH) server, for secure access from remote machines
Submitter:
Martin Mares
Date:
2010-12-03 20:51:05 UTC
Severity:
normal
#601864#5
Date:
2010-10-30 12:02:08 UTC
From:
To:
When I configure PAM (in /etc/security/pam_env.conf) to supply a default value
for an environment variable that can be passed through a SSH connection, the
default always overrides the client's value.

Test case:

	Clear /etc/default/locale
	Append to /etc/security/pam_env.conf: LC_CTYPE DEFAULT="cs_CZ"
	Check that LC_* is listed in AcceptEnv in /etc/ssh/sshd_config
	Connect to the server from a client which has LC_CTYPE=cs_CZ.UTF8 set.

	I expect that the shell on the server will have the client's LC_CTYPE,
	but I got cs_CZ instead.

SSH passes the environment variable correctly (when I comment out the line
in pam_env.conf, LC_CTYPE is correct).

I suspect that the problem lies in interaction between sshd's environment
and PAM's environment. It is likely that sshd does not pass the connection's
environment to PAM env, so pam_env does not see the value supplied by the
client and sets it to the default, but SSH then blindly overwrites the
connection's environment by the PAM's values. [I haven't checked that in the
source, though.]
#601864#10
Date:
2010-12-03 20:48:42 UTC
From:
To:
This looks like #313317.