ssh.com's 3.2.3 and ssh-signer/signal problems

From: Mark Plaksin (happy_at_usg.edu)
Date: 05/22/03

  • Next message: William Pechter: "Re: Re: sftp script running through crontab" 
    To: secureshell@securityfocus.com
Date: 22 May 2003 08:54:02 -0400

    Hi,

    We're running ssh.com's version 3.2.3 on HP-UX 11.00 and are having
    problems with ssh-signer2 giving this error:
    ssh-signer2:FATAL:ssh_userfile_read_raw: child has died: Interrupted system call

    On 03/19/03, Carlos Carvalho (carlos@fisica.ufpr.br) posted a message
    (included below) about the same exact problem with 3.2.3 on Linux and
    FreeBSD. Nobody replied to Carlos' note.

    I've done a bit of debugging and found a sort of fix. I put the code below
    back at the end ssh_userfile_uninit() in lib/sshapputil/sshuserfile.c:
      while (wait(&status) < 0)
          if (errno != EINTR)
                break;

    The CHANGES file describes changes in 3.2.3 to fix the race condition. My
    guess is that the race condition which was supposed to be fixed isn't quite
    fixed. Here are the entries from CHANGES:
      2002-11-05 Sami J. Lehtinen <sjl@ssh.com>
     
             * lib/sshapputil/sshuserfile.c: Changed to use
               lib/sshsession/sigchld.c, instead of using wait() directly. This
               fixes the bug where the number of connections would slowly rise to
               the maximum when using MaxConnections and tcp-wrappers (it was a
               race-condition).
     
             * lib/sshsession/sigchld.c: Sigchld now keeps a list of recently
               exited children. This fixes a race condition, where the child
               process could exit before the mother process had registered a
               handler for it.

    The real solution is beyond my debugging abilities. Has anybody solved the
    problem or seen it themselves?

    Many thanks for any help!
     
    Here is Carlos' original note:

    From: Carlos Carvalho <carlos@fisica.ufpr.br>
    Date: Wed, 19 Mar 2003 19:17:43 -0300
    To: secureshell@securityfocus.com, edulsa@quimica.ufpr.br

    Hostbased authentication is not working here with version 3.2.3 of
    ssh.com. The problem happens with ssh-signer2, which runs suid root.
    Using ssh -v shows that ssh-signer complains of an interrupted
    syscall, and doesn't complete its operation. As a consequence ssh
    skips hostbased auth and proceeds to other methods, if any. The
    problem doesn't happen when the connection is done by root itself.

    This is happening both in linux and freeBSD, and only with version
    3.2.3. Versions 3.2.2 and 3.2.0 work fine. Further, in linux it always
    fails with option -f, but not always without it. In freeBSD it fails
    even without -f.

    Here's the configure command I used in linux, gcc 2.95:

    ./configure --without-ipv6 --without-ssh-f-configd --without-daemonpam --without-clientpam --without-clientsecurid --without-internal-ssh1-compat --without-ssh-agent1-compat --disable-server-kbd-interactive --prefix=/usr/local/ssh

    Here's a linux trace:

    % ssh -v -f host rxvt -ls
    debug: Host key pair is not specified, trying to use default 'hostkey'.
    debug: SshHostKeyIO/sshhostkeyio.c:194/ssh_host_key_read_keys: Reading public host key from /etc/ssh2/hostkey.pub
    debug: SshHostKeyIO/sshhostkeyio.c:279/ssh_host_key_read_keys: Host key algorithms (from disk): ssh-dss
    debug: SshSigChld/sigchld.c:238/ssh_sigchld_register: Registering handler for pid 30902.
    debug: Ssh2AuthHostBasedClient/authc-hostbased.c:790/ssh_client_auth_hostkeys_initialized: Child: Execing ssh-signer...(path: /usr/local/ssh/bin/ssh-signer2)
    debug: Ssh2AuthHostBasedClient/authc-hostbased.c:131/hostbased_init_pubkey: Trying "hostbased" authentication with `ssh-dss' key.
    ssh-signer2:FATAL:ssh_userfile_read_raw: child has died: Interrupted system call
    debug: SshSigChld/sigchld.c:75/ssh_sigchld_process_pid: calling handler pid 30902 code -6
    debug: ssh_pipe_sigchld_handler: pid 30902 status -6
    debug: ssh_pipe_sigchld_do_callback
    debug: ssh_pipe_stream_read: faking eof after sigchld
    debug: Ssh2AuthHostBasedClient/authc-hostbased.c:466/auth_hostbased_received_eof: received EOF from ssh-signer2.
    debug: Ssh2AuthClient/sshauthc.c:319/ssh_authc_completion_proc: Method 'hostbased' disabled.

    I've just run two consecutive ssh -v host and it worked the first time
    and not the second. The failure is the same as above.

    Any ideas?

  • Next message: William Pechter: "Re: Re: sftp script running through crontab"