Fix login delay, spurious auth.log entry, and PermitRootLogin information

leakage due to PAM issues with upstream's recent security update (thanks,
Darren Tucker; closes: #99168, #192207, #193546).

4 files changed, 15 insertions, 2 deletions

diff --git a/auth-passwd.c b/auth-passwd.c
index 62ea3a52d..2307c1e5e 100644
--- a/auth-passwd.c
+++ b/auth-passwd.c
@@ -125,6 +125,14 @@ auth_password(Authctxt *authctxt, const char *password)
                 ok = 0;
 
 #if defined(USE_PAM)
+        /*
+         * If the user logging in is root and RootLogin=no, always attempt
+         * an invalid root login to prevent leaking timing information
+         */
+        if (pw && pw->pw_uid == 0 && options.permit_root_login != PERMIT_YES) {
+                auth_pam_password(authctxt, "\b\n\r\177INCORRECT");
+                return 0;
+        }
         return auth_pam_password(authctxt, password) && ok;
 #elif defined(HAVE_OSF_SIA)
         if (!ok)
diff --git a/auth1.c b/auth1.c
index c273f2fb6..b7e10abd0 100644
--- a/auth1.c
+++ b/auth1.c
@@ -80,7 +80,7 @@ do_authloop(Authctxt *authctxt)
             authctxt->valid ? "" : "illegal user ", authctxt->user);
 
         /* If the user has no password, accept authentication immediately. */
-        if (options.password_authentication &&
+        if (options.password_authentication && options.permit_empty_passwd &&
 #if defined(KRB4) || defined(KRB5)
             (!options.kerberos_authentication || options.kerberos_or_local_passwd) &&
 #endif
diff --git a/auth2-none.c b/auth2-none.c
index 692a2961f..46a4c617e 100644
--- a/auth2-none.c
+++ b/auth2-none.c
@@ -100,6 +100,8 @@ userauth_none(Authctxt *authctxt)
         if (check_nt_auth(1, authctxt->pw) == 0)
                 return(0);
 #endif
+        if (options.permit_empty_passwd == 0)
+                return 0;
         return PRIVSEP(auth_password(authctxt, "")) && authctxt->valid;
 }
 
diff --git a/debian/changelog b/debian/changelog
index b691f4231..7c0c9b952 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,10 +1,13 @@
-openssh (1:3.6.1p2-6) UNRELEASED; urgency=low
+openssh (1:3.6.1p2-6) UNRELEASED; urgency=medium
 
   * Use a more CVS-friendly means of setting SSH_VERSION.
   * Update Brazilian Portuguese debconf template translation (thanks, Andre
     Luis Lopes; closes: #208036).
   * Don't run 'sshd -t' in init script if the server isn't to be run
     (closes: #197576).
+  * Fix login delay, spurious auth.log entry, and PermitRootLogin
+    information leakage due to PAM issues with upstream's recent security
+    update (thanks, Darren Tucker; closes: #99168, #192207, #193546).
   * Policy version 3.6.1: recode this changelog to UTF-8.
 
  -- Colin Watson <cjwatson@debian.org>  Mon,  1 Sep 2003 23:56:57 +0100