This really is a bug in how OpenSSH USE_PAM is implemented.
Particularly if you presume that PAM is the devil, the last thing you want to do, from a security standpoint, is to let a client dictate how a server applies PAM. The policy _has_ to be entirely controlled by the server's config. Once you let the client decide, you're just asking for things to go wrong.
Well, it sort of isn't, because the OpenBSD team designed OpenSSH to not use PAM at all. PAM was patched in by some folks, and clearly they got it wrong, but I suspect the OpenSSH team doesn't see that as "part of OpenSSH".
Comments
This really is a bug in how OpenSSH USE_PAM is implemented.
Particularly if you presume that PAM is the devil, the last thing you want to do, from a security standpoint, is to let a client dictate how a server applies PAM. The policy _has_ to be entirely controlled by the server's config. Once you let the client decide, you're just asking for things to go wrong.
Yes, and this guy, quoted by the article author:
"I wouldn't call that an OpenSSH bug. I would call it a systemic design flaw in PAM."
is then clearly wrong, it is an OpenSSH bug.
Well, it sort of isn't, because the OpenBSD team designed OpenSSH to not use PAM at all. PAM was patched in by some folks, and clearly they got it wrong, but I suspect the OpenSSH team doesn't see that as "part of OpenSSH".
PAM support is part of OpenSSH portable releases. http://www.openssh.com/faq.html#3.15