Merge 3.7.1p2 to the trunk. I have absolutely no idea yet whether this will

work.

1 files changed, 614 insertions, 348 deletions

diff --git a/auth-pam.c b/auth-pam.c
index cb57ba110..754cbf6df 100644
--- a/auth-pam.c
+++ b/auth-pam.c
@@ -1,5 +1,11 @@
-/*
- * Copyright (c) 2000 Damien Miller.  All rights reserved.
+/*-
+ * Copyright (c) 2002 Networks Associates Technology, Inc.
+ * All rights reserved.
+ *
+ * This software was developed for the FreeBSD Project by ThinkSec AS and
+ * NAI Labs, the Security Research Division of Network Associates, Inc.
+ * under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the
+ * DARPA CHATS research program.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -10,446 +16,706 @@
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
  *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
  */
 
+/* Based on $FreeBSD: src/crypto/openssh/auth2-pam-freebsd.c,v 1.11 2003/03/31 13:48:18 des Exp $ */
 #include "includes.h"
+RCSID("$Id: auth-pam.c,v 1.72.2.1 2003/09/16 06:00:52 djm Exp $");
 
 #ifdef USE_PAM
-#include "xmalloc.h"
-#include "log.h"
+#include <security/pam_appl.h>
+
 #include "auth.h"
-#include "auth-options.h"
 #include "auth-pam.h"
-#include "servconf.h"
+#include "buffer.h"
+#include "bufaux.h"
 #include "canohost.h"
+#include "log.h"
+#include "monitor_wrap.h"
+#include "msg.h"
+#include "packet.h"
 #include "readpass.h"
+#include "servconf.h"
+#include "ssh2.h"
+#include "xmalloc.h"
+#include "auth-options.h"
 
-extern char *__progname;
+extern ServerOptions options;
 
-extern int use_privsep;
+#define __unused
 
-RCSID("$Id: auth-pam.c,v 1.55.4.1 2003/04/29 09:12:08 djm Exp $");
+#ifdef USE_POSIX_THREADS
+#include <pthread.h>
+/*
+ * Avoid namespace clash when *not* using pthreads for systems *with* 
+ * pthreads, which unconditionally define pthread_t via sys/types.h 
+ * (e.g. Linux)
+ */
+typedef pthread_t sp_pthread_t; 
+#else
+/*
+ * Simulate threads with processes.
+ */
+typedef pid_t sp_pthread_t;
 
-#define NEW_AUTHTOK_MSG \
-        "Warning: Your password has expired, please change it now."
-#define NEW_AUTHTOK_MSG_PRIVSEP \
-        "Your password has expired, the session cannot proceed."
+static void
+pthread_exit(void *value __unused)
+{
+        _exit(0);
+}
 
-static int do_pam_conversation(int num_msg, const struct pam_message **msg,
-        struct pam_response **resp, void *appdata_ptr);
+static int
+pthread_create(sp_pthread_t *thread, const void *attr __unused,
+    void *(*thread_start)(void *), void *arg)
+{
+        pid_t pid;
+
+        switch ((pid = fork())) {
+        case -1:
+                error("fork(): %s", strerror(errno));
+                return (-1);
+        case 0:
+                thread_start(arg);
+                _exit(1);
+        default:
+                *thread = pid;
+                return (0);
+        }
+}
 
-/* module-local variables */
-static struct pam_conv conv = {
-        (int (*)())do_pam_conversation,
-        NULL
-};
-static char *__pam_msg = NULL;
-static pam_handle_t *__pamh = NULL;
-static const char *__pampasswd = NULL;
-
-/* states for do_pam_conversation() */
-enum { INITIAL_LOGIN, OTHER } pamstate = INITIAL_LOGIN;
-/* remember whether pam_acct_mgmt() returned PAM_NEW_AUTHTOK_REQD */
-static int password_change_required = 0;
-/* remember whether the last pam_authenticate() succeeded or not */
-static int was_authenticated = 0;
-
-/* Remember what has been initialised */
-static int session_opened = 0;
-static int creds_set = 0;
-
-/* accessor which allows us to switch conversation structs according to
- * the authentication method being used */
-void do_pam_set_conv(struct pam_conv *conv)
+static int
+pthread_cancel(sp_pthread_t thread)
 {
-        pam_set_item(__pamh, PAM_CONV, conv);
+        return (kill(thread, SIGTERM));
 }
 
-/* start an authentication run */
-int do_pam_authenticate(int flags)
+static int
+pthread_join(sp_pthread_t thread, void **value __unused)
 {
-        int retval = pam_authenticate(__pamh, flags);
-        was_authenticated = (retval == PAM_SUCCESS);
-        return retval;
+        int status;
+
+        waitpid(thread, &status, 0);
+        return (status);
 }
+#endif
+
+
+static pam_handle_t *sshpam_handle;
+static int sshpam_err;
+static int sshpam_authenticated;
+static int sshpam_new_authtok_reqd;
+static int sshpam_session_open;
+static int sshpam_cred_established;
+
+struct pam_ctxt {
+        sp_pthread_t     pam_thread;
+        int              pam_psock;
+        int              pam_csock;
+        int              pam_done;
+};
+
+static void sshpam_free_ctx(void *);
 
 /*
- * PAM conversation function.
- * There are two states this can run in.
- *
- * INITIAL_LOGIN mode simply feeds the password from the client into
- * PAM in response to PAM_PROMPT_ECHO_OFF, and collects output
- * messages with into __pam_msg.  This is used during initial
- * authentication to bypass the normal PAM password prompt.
- *
- * OTHER mode handles PAM_PROMPT_ECHO_OFF with read_passphrase()
- * and outputs messages to stderr. This mode is used if pam_chauthtok()
- * is called to update expired passwords.
+ * Conversation function for authentication thread.
  */
-static int do_pam_conversation(int num_msg, const struct pam_message **msg,
-        struct pam_response **resp, void *appdata_ptr)
+static int
+sshpam_thread_conv(int n, const struct pam_message **msg,
+    struct pam_response **resp, void *data)
 {
-        struct pam_response *reply;
-        int count;
-        char buf[1024];
-
-        /* PAM will free this later */
-        reply = xmalloc(num_msg * sizeof(*reply));
-
-        for (count = 0; count < num_msg; count++) {
-                if (pamstate == INITIAL_LOGIN) {
-                        /*
-                         * We can't use stdio yet, queue messages for 
-                         * printing later
-                         */
-                        switch(PAM_MSG_MEMBER(msg, count, msg_style)) {
-                        case PAM_PROMPT_ECHO_ON:
-                                xfree(reply);
-                                return PAM_CONV_ERR;
-                        case PAM_PROMPT_ECHO_OFF:
-                                if (__pampasswd == NULL) {
-                                        xfree(reply);
-                                        return PAM_CONV_ERR;
-                                }
-                                reply[count].resp = xstrdup(__pampasswd);
-                                reply[count].resp_retcode = PAM_SUCCESS;
-                                break;
-                        case PAM_ERROR_MSG:
-                        case PAM_TEXT_INFO:
-                                if (PAM_MSG_MEMBER(msg, count, msg) != NULL) {
-                                        message_cat(&__pam_msg, 
-                                            PAM_MSG_MEMBER(msg, count, msg));
-                                }
-                                reply[count].resp = xstrdup("");
-                                reply[count].resp_retcode = PAM_SUCCESS;
-                                break;
-                        default:
-                                xfree(reply);
-                                return PAM_CONV_ERR;
-                        }
-                } else {
-                        /*
-                         * stdio is connected, so interact directly
-                         */
-                        switch(PAM_MSG_MEMBER(msg, count, msg_style)) {
-                        case PAM_PROMPT_ECHO_ON:
-                                fputs(PAM_MSG_MEMBER(msg, count, msg), stderr);
-                                fgets(buf, sizeof(buf), stdin);
-                                reply[count].resp = xstrdup(buf);
-                                reply[count].resp_retcode = PAM_SUCCESS;
-                                break;
-                        case PAM_PROMPT_ECHO_OFF:
-                                reply[count].resp = 
-                                    read_passphrase(PAM_MSG_MEMBER(msg, count,
-                                        msg), RP_ALLOW_STDIN);
-                                reply[count].resp_retcode = PAM_SUCCESS;
-                                break;
-                        case PAM_ERROR_MSG:
-                        case PAM_TEXT_INFO:
-                                if (PAM_MSG_MEMBER(msg, count, msg) != NULL)
-                                        fprintf(stderr, "%s\n", 
-                                            PAM_MSG_MEMBER(msg, count, msg));
-                                reply[count].resp = xstrdup("");
-                                reply[count].resp_retcode = PAM_SUCCESS;
-                                break;
-                        default:
-                                xfree(reply);
-                                return PAM_CONV_ERR;
-                        }
+        Buffer buffer;
+        struct pam_ctxt *ctxt;
+        int i;
+
+        ctxt = data;
+        if (n <= 0 || n > PAM_MAX_NUM_MSG)
+                return (PAM_CONV_ERR);
+        *resp = xmalloc(n * sizeof **resp);
+        buffer_init(&buffer);
+        for (i = 0; i < n; ++i) {
+                resp[i]->resp_retcode = 0;
+                resp[i]->resp = NULL;
+                switch (PAM_MSG_MEMBER(msg, i, msg_style)) {
+                case PAM_PROMPT_ECHO_OFF:
+                        buffer_put_cstring(&buffer, PAM_MSG_MEMBER(msg, i, msg));
+                        ssh_msg_send(ctxt->pam_csock, 
+                            PAM_MSG_MEMBER(msg, i, msg_style), &buffer);
+                        ssh_msg_recv(ctxt->pam_csock, &buffer);
+                        if (buffer_get_char(&buffer) != PAM_AUTHTOK)
+                                goto fail;
+                        resp[i]->resp = buffer_get_string(&buffer, NULL);
+                        break;
+                case PAM_PROMPT_ECHO_ON:
+                        buffer_put_cstring(&buffer, PAM_MSG_MEMBER(msg, i, msg));
+                        ssh_msg_send(ctxt->pam_csock, 
+                            PAM_MSG_MEMBER(msg, i, msg_style), &buffer);
+                        ssh_msg_recv(ctxt->pam_csock, &buffer);
+                        if (buffer_get_char(&buffer) != PAM_AUTHTOK)
+                                goto fail;
+                        resp[i]->resp = buffer_get_string(&buffer, NULL);
+                        break;
+                case PAM_ERROR_MSG:
+                        buffer_put_cstring(&buffer, PAM_MSG_MEMBER(msg, i, msg));
+                        ssh_msg_send(ctxt->pam_csock, 
+                            PAM_MSG_MEMBER(msg, i, msg_style), &buffer);
+                        break;
+                case PAM_TEXT_INFO:
+                        buffer_put_cstring(&buffer, PAM_MSG_MEMBER(msg, i, msg));
+                        ssh_msg_send(ctxt->pam_csock, 
+                            PAM_MSG_MEMBER(msg, i, msg_style), &buffer);
+                        break;
+                default:
+                        goto fail;
                 }
+                buffer_clear(&buffer);
         }
-
-        *resp = reply;
-
-        return PAM_SUCCESS;
+        buffer_free(&buffer);
+        return (PAM_SUCCESS);
+ fail:
+        while (i)
+                xfree(resp[--i]);
+        xfree(*resp);
+        *resp = NULL;
+        buffer_free(&buffer);
+        return (PAM_CONV_ERR);
 }
 
-/* Called at exit to cleanly shutdown PAM */
-void do_pam_cleanup_proc(void *context)
+/*
+ * Authentication thread.
+ */
+static void *
+sshpam_thread(void *ctxtp)
 {
-        int pam_retval = PAM_SUCCESS;
+        struct pam_ctxt *ctxt = ctxtp;
+        Buffer buffer;
+        struct pam_conv sshpam_conv;
+#ifndef USE_POSIX_THREADS
+        const char *pam_user;
+
+        pam_get_item(sshpam_handle, PAM_USER, (const void **)&pam_user);
+        setproctitle("%s [pam]", pam_user);
+#endif
 
-        if (__pamh && session_opened) {
-                pam_retval = pam_close_session(__pamh, 0);
-                if (pam_retval != PAM_SUCCESS)
-                        log("Cannot close PAM session[%d]: %.200s",
-                            pam_retval, PAM_STRERROR(__pamh, pam_retval));
-        }
+        sshpam_conv.conv = sshpam_thread_conv;
+        sshpam_conv.appdata_ptr = ctxt;
+
+        buffer_init(&buffer);
+        sshpam_err = pam_set_item(sshpam_handle, PAM_CONV,
+            (const void *)&sshpam_conv);
+        if (sshpam_err != PAM_SUCCESS)
+                goto auth_fail;
+        sshpam_err = pam_authenticate(sshpam_handle, 0);
+        if (sshpam_err != PAM_SUCCESS)
+                goto auth_fail;
+        buffer_put_cstring(&buffer, "OK");
+        ssh_msg_send(ctxt->pam_csock, sshpam_err, &buffer);
+        buffer_free(&buffer);
+        pthread_exit(NULL);
+
+ auth_fail:
+        buffer_put_cstring(&buffer,
+            pam_strerror(sshpam_handle, sshpam_err));
+        ssh_msg_send(ctxt->pam_csock, PAM_AUTH_ERR, &buffer);
+        buffer_free(&buffer);
+        pthread_exit(NULL);
+        
+        return (NULL); /* Avoid warning for non-pthread case */
+}
 
-        if (__pamh && creds_set) {
-                pam_retval = pam_setcred(__pamh, PAM_DELETE_CRED);
-                if (pam_retval != PAM_SUCCESS)
-                        debug("Cannot delete credentials[%d]: %.200s", 
-                            pam_retval, PAM_STRERROR(__pamh, pam_retval));
-        }
+static void
+sshpam_thread_cleanup(void *ctxtp)
+{
+        struct pam_ctxt *ctxt = ctxtp;
 
-        if (__pamh) {
-                pam_retval = pam_end(__pamh, pam_retval);
-                if (pam_retval != PAM_SUCCESS)
-                        log("Cannot release PAM authentication[%d]: %.200s",
-                            pam_retval, PAM_STRERROR(__pamh, pam_retval));
-        }
+        pthread_cancel(ctxt->pam_thread);
+        pthread_join(ctxt->pam_thread, NULL);
+        close(ctxt->pam_psock);
+        close(ctxt->pam_csock);
 }
 
-/* Attempt password authentication using PAM */
-int auth_pam_password(Authctxt *authctxt, const char *password)
+static int
+sshpam_null_conv(int n, const struct pam_message **msg,
+    struct pam_response **resp, void *data)
 {
-        extern ServerOptions options;
-        int pam_retval;
-        struct passwd *pw = authctxt->pw;
+        return (PAM_CONV_ERR);
+}
 
-        do_pam_set_conv(&conv);
+static struct pam_conv null_conv = { sshpam_null_conv, NULL };
 
-        __pampasswd = password;
+static void
+sshpam_cleanup(void *arg)
+{
+        (void)arg;
+        debug("PAM: cleanup");
+        pam_set_item(sshpam_handle, PAM_CONV, (const void *)&null_conv);
+        if (sshpam_cred_established) {
+                pam_setcred(sshpam_handle, PAM_DELETE_CRED);
+                sshpam_cred_established = 0;
+        }
+        if (sshpam_session_open) {
+                pam_close_session(sshpam_handle, PAM_SILENT);
+                sshpam_session_open = 0;
+        }
+        sshpam_authenticated = sshpam_new_authtok_reqd = 0;
+        pam_end(sshpam_handle, sshpam_err);
+        sshpam_handle = NULL;
+}
 
-        pamstate = INITIAL_LOGIN;
-        pam_retval = do_pam_authenticate(
-            options.permit_empty_passwd == 0 ? PAM_DISALLOW_NULL_AUTHTOK : 0);
-        if (pam_retval == PAM_SUCCESS && pw) {
-                debug("PAM password authentication accepted for "
-                    "%.100s", pw->pw_name);
-                return 1;
-        } else {
-                debug("PAM password authentication failed for "
-                    "%.100s: %s", pw ? pw->pw_name : "an illegal user",
-                    PAM_STRERROR(__pamh, pam_retval));
-                return 0;
+static int
+sshpam_init(const char *user)
+{
+        extern u_int utmp_len;
+        extern char *__progname;
+        const char *pam_rhost, *pam_user;
+
+        if (sshpam_handle != NULL) {
+                /* We already have a PAM context; check if the user matches */
+                sshpam_err = pam_get_item(sshpam_handle,
+                    PAM_USER, (const void **)&pam_user);
+                if (sshpam_err == PAM_SUCCESS && strcmp(user, pam_user) == 0)
+                        return (0);
+                fatal_remove_cleanup(sshpam_cleanup, NULL);
+                pam_end(sshpam_handle, sshpam_err);
+                sshpam_handle = NULL;
+        }
+        debug("PAM: initializing for \"%s\"", user);
+        sshpam_err =
+            pam_start(SSHD_PAM_SERVICE, user, &null_conv, &sshpam_handle);
+        if (sshpam_err != PAM_SUCCESS) {
+                pam_end(sshpam_handle, sshpam_err);
+                sshpam_handle = NULL;
+                return (-1);
         }
+        pam_rhost = get_remote_name_or_ip(utmp_len, options.use_dns);
+        debug("PAM: setting PAM_RHOST to \"%s\"", pam_rhost);
+        sshpam_err = pam_set_item(sshpam_handle, PAM_RHOST, pam_rhost);
+        if (sshpam_err != PAM_SUCCESS) {
+                pam_end(sshpam_handle, sshpam_err);
+                sshpam_handle = NULL;
+                return (-1);
+        }
+#ifdef PAM_TTY_KLUDGE
+        /*
+         * Some silly PAM modules (e.g. pam_time) require a TTY to operate.
+         * sshd doesn't set the tty until too late in the auth process and 
+         * may not even set one (for tty-less connections)
+         */
+        debug("PAM: setting PAM_TTY to \"ssh\"");
+        sshpam_err = pam_set_item(sshpam_handle, PAM_TTY, "ssh");
+        if (sshpam_err != PAM_SUCCESS) {
+                pam_end(sshpam_handle, sshpam_err);
+                sshpam_handle = NULL;
+                return (-1);
+        }
+#endif
+        fatal_add_cleanup(sshpam_cleanup, NULL);
+        return (0);
 }
 
-/* Do account management using PAM */
-int do_pam_account(char *username, char *remote_user)
+static void *
+sshpam_init_ctx(Authctxt *authctxt)
 {
-        int pam_retval;
+        struct pam_ctxt *ctxt;
+        int socks[2];
 
-        do_pam_set_conv(&conv);
+        /* Refuse to start if we don't have PAM enabled */
+        if (!options.use_pam)
+                return NULL;
 
-        if (remote_user) {
-                debug("PAM setting ruser to \"%.200s\"", remote_user);
-                pam_retval = pam_set_item(__pamh, PAM_RUSER, remote_user);
-                if (pam_retval != PAM_SUCCESS)
-                        fatal("PAM set ruser failed[%d]: %.200s", pam_retval, 
-                            PAM_STRERROR(__pamh, pam_retval));
+        /* Initialize PAM */
+        if (sshpam_init(authctxt->user) == -1) {
+                error("PAM: initialization failed");
+                return (NULL);
         }
 
-        pam_retval = pam_acct_mgmt(__pamh, 0);
-        debug2("pam_acct_mgmt() = %d", pam_retval);
-        switch (pam_retval) {
-                case PAM_SUCCESS:
-                        /* This is what we want */
-                        break;
-#if 0
-                case PAM_NEW_AUTHTOK_REQD:
-                        message_cat(&__pam_msg, use_privsep ?
-                            NEW_AUTHTOK_MSG_PRIVSEP : NEW_AUTHTOK_MSG);
-                        /* flag that password change is necessary */
-                        password_change_required = 1;
-                        /* disallow other functionality for now */
-                        no_port_forwarding_flag |= 2;
-                        no_agent_forwarding_flag |= 2;
-                        no_x11_forwarding_flag |= 2;
+        ctxt = xmalloc(sizeof *ctxt);
+        ctxt->pam_done = 0;
+
+        /* Start the authentication thread */
+        if (socketpair(AF_UNIX, SOCK_STREAM, PF_UNSPEC, socks) == -1) {
+                error("PAM: failed create sockets: %s", strerror(errno));
+                xfree(ctxt);
+                return (NULL);
+        }
+        ctxt->pam_psock = socks[0];
+        ctxt->pam_csock = socks[1];
+        if (pthread_create(&ctxt->pam_thread, NULL, sshpam_thread, ctxt) == -1) {
+                error("PAM: failed to start authentication thread: %s",
+                    strerror(errno));
+                close(socks[0]);
+                close(socks[1]);
+                xfree(ctxt);
+                return (NULL);
+        }
+        fatal_add_cleanup(sshpam_thread_cleanup, ctxt);
+        return (ctxt);
+}
+
+static int
+sshpam_query(void *ctx, char **name, char **info,
+    u_int *num, char ***prompts, u_int **echo_on)
+{
+        Buffer buffer;
+        struct pam_ctxt *ctxt = ctx;
+        size_t plen;
+        u_char type;
+        char *msg;
+        size_t len;
+
+        buffer_init(&buffer);
+        *name = xstrdup("");
+        *info = xstrdup("");
+        *prompts = xmalloc(sizeof(char *));
+        **prompts = NULL;
+        plen = 0;
+        *echo_on = xmalloc(sizeof(u_int));
+        while (ssh_msg_recv(ctxt->pam_psock, &buffer) == 0) {
+                type = buffer_get_char(&buffer);
+                msg = buffer_get_string(&buffer, NULL);
+                switch (type) {
+                case PAM_PROMPT_ECHO_ON:
+                case PAM_PROMPT_ECHO_OFF:
+                        *num = 1;
+                        len = plen + strlen(msg) + 1;
+                        **prompts = xrealloc(**prompts, len);
+                        plen += snprintf(**prompts + plen, len, "%s", msg);
+                        **echo_on = (type == PAM_PROMPT_ECHO_ON);
+                        xfree(msg);
+                        return (0);
+                case PAM_ERROR_MSG:
+                case PAM_TEXT_INFO:
+                        /* accumulate messages */
+                        len = plen + strlen(msg) + 1;
+                        **prompts = xrealloc(**prompts, len);
+                        plen += snprintf(**prompts + plen, len, "%s", msg);
+                        xfree(msg);
                         break;
+                case PAM_SUCCESS:
+                case PAM_AUTH_ERR:
+                        if (**prompts != NULL) {
+                                /* drain any accumulated messages */
+#if 0 /* XXX - not compatible with privsep */
+                                packet_start(SSH2_MSG_USERAUTH_BANNER);
+                                packet_put_cstring(**prompts);
+                                packet_put_cstring("");
+                                packet_send();
+                                packet_write_wait();
 #endif
+                                xfree(**prompts);
+                                **prompts = NULL;
+                        }
+                        if (type == PAM_SUCCESS) {
+                                *num = 0;
+                                **echo_on = 0;
+                                ctxt->pam_done = 1;
+                                xfree(msg);
+                                return (0);
+                        }
+                        error("PAM: %s", msg);
                 default:
-                        log("PAM rejected by account configuration[%d]: "
-                            "%.200s", pam_retval, PAM_STRERROR(__pamh, 
-                            pam_retval));
-                        return(0);
+                        *num = 0;
+                        **echo_on = 0;
+                        xfree(msg);
+                        ctxt->pam_done = -1;
+                        return (-1);
+                }
         }
+        return (-1);
+}
 
-        return(1);
+/* XXX - see also comment in auth-chall.c:verify_response */
+static int
+sshpam_respond(void *ctx, u_int num, char **resp)
+{
+        Buffer buffer;
+        struct pam_ctxt *ctxt = ctx;
+
+        debug2("PAM: %s", __func__);
+        switch (ctxt->pam_done) {
+        case 1:
+                sshpam_authenticated = 1;
+                return (0);
+        case 0:
+                break;
+        default:
+                return (-1);
+        }
+        if (num != 1) {
+                error("PAM: expected one response, got %u", num);
+                return (-1);
+        }
+        buffer_init(&buffer);
+        buffer_put_cstring(&buffer, *resp);
+        ssh_msg_send(ctxt->pam_psock, PAM_AUTHTOK, &buffer);
+        buffer_free(&buffer);
+        return (1);
 }
 
-/* Do PAM-specific session initialisation */
-void do_pam_session(char *username, const char *ttyname)
+static void
+sshpam_free_ctx(void *ctxtp)
 {
-        int pam_retval;
+        struct pam_ctxt *ctxt = ctxtp;
 
-        do_pam_set_conv(&conv);
+        fatal_remove_cleanup(sshpam_thread_cleanup, ctxt);
+        sshpam_thread_cleanup(ctxtp);
+        xfree(ctxt);
+        /*
+         * We don't call sshpam_cleanup() here because we may need the PAM
+         * handle at a later stage, e.g. when setting up a session.  It's
+         * still on the cleanup list, so pam_end() *will* be called before
+         * the server process terminates.
+         */
+}
 
-        if (ttyname != NULL) {
-                debug("PAM setting tty to \"%.200s\"", ttyname);
-                pam_retval = pam_set_item(__pamh, PAM_TTY, ttyname);
-                if (pam_retval != PAM_SUCCESS)
-                        fatal("PAM set tty failed[%d]: %.200s",
-                            pam_retval, PAM_STRERROR(__pamh, pam_retval));
-        }
+KbdintDevice sshpam_device = {
+        "pam",
+        sshpam_init_ctx,
+        sshpam_query,
+        sshpam_respond,
+        sshpam_free_ctx
+};
 
-        pam_retval = pam_open_session(__pamh, 0);
-        if (pam_retval != PAM_SUCCESS)
-                fatal("PAM session setup failed[%d]: %.200s",
-                    pam_retval, PAM_STRERROR(__pamh, pam_retval));
+KbdintDevice mm_sshpam_device = {
+        "pam",
+        mm_sshpam_init_ctx,
+        mm_sshpam_query,
+        mm_sshpam_respond,
+        mm_sshpam_free_ctx
+};
+
+/*
+ * This replaces auth-pam.c
+ */
+void
+start_pam(const char *user)
+{
+        if (!options.use_pam)
+                fatal("PAM: initialisation requested when UsePAM=no");
 
-        session_opened = 1;
+        if (sshpam_init(user) == -1)
+                fatal("PAM: initialisation failed");
 }
 
-/* Set PAM credentials */
-void do_pam_setcred(int init)
+void
+finish_pam(void)
 {
-        int pam_retval;
+        fatal_remove_cleanup(sshpam_cleanup, NULL);
+        sshpam_cleanup(NULL);
+}
 
-        if (__pamh == NULL)
-                return;
+u_int
+do_pam_account(void)
+{
+        sshpam_err = pam_acct_mgmt(sshpam_handle, 0);
+        debug3("%s: pam_acct_mgmt = %d", __func__, sshpam_err);
+        
+        if (sshpam_err != PAM_SUCCESS && sshpam_err != PAM_NEW_AUTHTOK_REQD)
+                return (0);
+
+        if (sshpam_err == PAM_NEW_AUTHTOK_REQD) {
+                sshpam_new_authtok_reqd = 1;
+
+                /* Prevent forwardings until password changed */
+                no_port_forwarding_flag |= 2;
+                no_agent_forwarding_flag |= 2;
+                no_x11_forwarding_flag |= 2;
+        }
 
-        do_pam_set_conv(&conv);
-
-        debug("PAM establishing creds");
-        pam_retval = pam_setcred(__pamh, 
-            init ? PAM_ESTABLISH_CRED : PAM_REINITIALIZE_CRED);
-        if (pam_retval != PAM_SUCCESS) {
-                if (was_authenticated)
-                        fatal("PAM setcred failed[%d]: %.200s",
-                            pam_retval, PAM_STRERROR(__pamh, pam_retval));
-                else
-                        debug("PAM setcred failed[%d]: %.200s",
-                            pam_retval, PAM_STRERROR(__pamh, pam_retval));
-        } else
-                creds_set = 1;
+        return (1);
 }
 
-/* accessor function for file scope static variable */
-int is_pam_password_change_required(void)
+void
+do_pam_session(void)
 {
-        return password_change_required;
+        sshpam_err = pam_set_item(sshpam_handle, PAM_CONV, 
+            (const void *)&null_conv);
+        if (sshpam_err != PAM_SUCCESS)
+                fatal("PAM: failed to set PAM_CONV: %s",
+                    pam_strerror(sshpam_handle, sshpam_err));
+        sshpam_err = pam_open_session(sshpam_handle, 0);
+        if (sshpam_err != PAM_SUCCESS)
+                fatal("PAM: pam_open_session(): %s",
+                    pam_strerror(sshpam_handle, sshpam_err));
+        sshpam_session_open = 1;
 }
 
-/*
- * Have user change authentication token if pam_acct_mgmt() indicated
- * it was expired.  This needs to be called after an interactive
- * session is established and the user's pty is connected to
- * stdin/stdout/stderr.
- */
-void do_pam_chauthtok(void)
+void
+do_pam_set_tty(const char *tty)
 {
-        int pam_retval;
-
-        do_pam_set_conv(&conv);
-
-        if (password_change_required) {
-                if (use_privsep)
-                        fatal("Password changing is currently unsupported"
-                            " with privilege separation");
-                pamstate = OTHER;
-                pam_retval = pam_chauthtok(__pamh, PAM_CHANGE_EXPIRED_AUTHTOK);
-                if (pam_retval != PAM_SUCCESS)
-                        fatal("PAM pam_chauthtok failed[%d]: %.200s",
-                            pam_retval, PAM_STRERROR(__pamh, pam_retval));
-#if 0
-                /* XXX: This would need to be done in the parent process,
-                 * but there's currently no way to pass such request. */
-                no_port_forwarding_flag &= ~2;
-                no_agent_forwarding_flag &= ~2;
-                no_x11_forwarding_flag &= ~2;
-                if (!no_port_forwarding_flag && options.allow_tcp_forwarding)
-                        channel_permit_all_opens();
-#endif
+        if (tty != NULL) {
+                debug("PAM: setting PAM_TTY to \"%s\"", tty);
+                sshpam_err = pam_set_item(sshpam_handle, PAM_TTY, tty);
+                if (sshpam_err != PAM_SUCCESS)
+                        fatal("PAM: failed to set PAM_TTY: %s",
+                            pam_strerror(sshpam_handle, sshpam_err));
+        }
+}
+
+void
+do_pam_setcred(int init)
+{
+        sshpam_err = pam_set_item(sshpam_handle, PAM_CONV,
+            (const void *)&null_conv);
+        if (sshpam_err != PAM_SUCCESS)
+                fatal("PAM: failed to set PAM_CONV: %s",
+                    pam_strerror(sshpam_handle, sshpam_err));
+        if (init) {
+                debug("PAM: establishing credentials");
+                sshpam_err = pam_setcred(sshpam_handle, PAM_ESTABLISH_CRED);
+        } else {
+                debug("PAM: reinitializing credentials");
+                sshpam_err = pam_setcred(sshpam_handle, PAM_REINITIALIZE_CRED);
+        }
+        if (sshpam_err == PAM_SUCCESS) {
+                sshpam_cred_established = 1;
+                return;
         }
+        if (sshpam_authenticated)
+                fatal("PAM: pam_setcred(): %s",
+                    pam_strerror(sshpam_handle, sshpam_err));
+        else
+                debug("PAM: pam_setcred(): %s",
+                    pam_strerror(sshpam_handle, sshpam_err));
 }
 
-/* Cleanly shutdown PAM */
-void finish_pam(void)
+int
+is_pam_password_change_required(void)
 {
-        do_pam_cleanup_proc(NULL);
-        fatal_remove_cleanup(&do_pam_cleanup_proc, NULL);
+        return (sshpam_new_authtok_reqd);
 }
 
-/* Start PAM authentication for specified account */
-void start_pam(const char *user)
+static int
+pam_chauthtok_conv(int n, const struct pam_message **msg,
+    struct pam_response **resp, void *data)
 {
-        int pam_retval;
-        extern ServerOptions options;
-        extern u_int utmp_len;
-        const char *rhost;
+        char input[PAM_MAX_MSG_SIZE];
+        int i;
 
-        debug("Starting up PAM with username \"%.200s\"", user);
+        if (n <= 0 || n > PAM_MAX_NUM_MSG)
+                return (PAM_CONV_ERR);
+        *resp = xmalloc(n * sizeof **resp);
+        for (i = 0; i < n; ++i) {
+                switch (PAM_MSG_MEMBER(msg, i, msg_style)) {
+                case PAM_PROMPT_ECHO_OFF:
+                        resp[i]->resp =
+                            read_passphrase(PAM_MSG_MEMBER(msg, i, msg), 
+                            RP_ALLOW_STDIN);
+                        resp[i]->resp_retcode = PAM_SUCCESS;
+                        break;
+                case PAM_PROMPT_ECHO_ON:
+                        fputs(PAM_MSG_MEMBER(msg, i, msg), stderr);
+                        fgets(input, sizeof input, stdin);
+                        resp[i]->resp = xstrdup(input);
+                        resp[i]->resp_retcode = PAM_SUCCESS;
+                        break;
+                case PAM_ERROR_MSG:
+                case PAM_TEXT_INFO:
+                        fputs(PAM_MSG_MEMBER(msg, i, msg), stderr);
+                        resp[i]->resp_retcode = PAM_SUCCESS;
+                        break;
+                default:
+                        goto fail;
+                }
+        }
+        return (PAM_SUCCESS);
+ fail:
+        while (i)
+                xfree(resp[--i]);
+        xfree(*resp);
+        *resp = NULL;
+        return (PAM_CONV_ERR);
+}
 
-        pam_retval = pam_start(SSHD_PAM_SERVICE, user, &conv, &__pamh);
+/*
+ * XXX this should be done in the authentication phase, but ssh1 doesn't
+ * support that
+ */
+void
+do_pam_chauthtok(void)
+{
+        struct pam_conv pam_conv;
+
+        pam_conv.conv = pam_chauthtok_conv;
+        pam_conv.appdata_ptr = NULL;
+
+        if (use_privsep)
+                fatal("Password expired (unable to change with privsep)");
+        sshpam_err = pam_set_item(sshpam_handle, PAM_CONV,
+            (const void *)&pam_conv);
+        if (sshpam_err != PAM_SUCCESS)
+                fatal("PAM: failed to set PAM_CONV: %s",
+                    pam_strerror(sshpam_handle, sshpam_err));
+        debug("PAM: changing password");
+        sshpam_err = pam_chauthtok(sshpam_handle, PAM_CHANGE_EXPIRED_AUTHTOK);
+        if (sshpam_err != PAM_SUCCESS)
+                fatal("PAM: pam_chauthtok(): %s",
+                    pam_strerror(sshpam_handle, sshpam_err));
+}
 
-        if (pam_retval != PAM_SUCCESS)
-                fatal("PAM initialisation failed[%d]: %.200s",
-                    pam_retval, PAM_STRERROR(__pamh, pam_retval));
+/* 
+ * Set a PAM environment string. We need to do this so that the session
+ * modules can handle things like Kerberos/GSI credentials that appear
+ * during the ssh authentication process.
+ */
 
-        rhost = get_remote_name_or_ip(utmp_len, options.verify_reverse_mapping);
-        debug("PAM setting rhost to \"%.200s\"", rhost);
+int
+do_pam_putenv(char *name, char *value) 
+{
+        int ret = 1;
+#ifdef HAVE_PAM_PUTENV  
+        char *compound;
+        size_t len;
 
-        pam_retval = pam_set_item(__pamh, PAM_RHOST, rhost);
-        if (pam_retval != PAM_SUCCESS)
-                fatal("PAM set rhost failed[%d]: %.200s", pam_retval,
-                    PAM_STRERROR(__pamh, pam_retval));
-#ifdef PAM_TTY_KLUDGE
-        /*
-         * Some PAM modules (e.g. pam_time) require a TTY to operate,
-         * and will fail in various stupid ways if they don't get one.
-         * sshd doesn't set the tty until too late in the auth process and may
-         * not even need one (for tty-less connections)
-         * Kludge: Set a fake PAM_TTY
-         */
-        pam_retval = pam_set_item(__pamh, PAM_TTY, "NODEVssh");
-        if (pam_retval != PAM_SUCCESS)
-                fatal("PAM set tty failed[%d]: %.200s",
-                    pam_retval, PAM_STRERROR(__pamh, pam_retval));
-#endif /* PAM_TTY_KLUDGE */
+        len = strlen(name) + strlen(value) + 2;
+        compound = xmalloc(len);
 
-        fatal_add_cleanup(&do_pam_cleanup_proc, NULL);
-}
+        snprintf(compound, len, "%s=%s", name, value);
+        ret = pam_putenv(sshpam_handle, compound);
+        xfree(compound);
+#endif
 
-/* Return list of PAM environment strings */
-char **fetch_pam_environment(void)
-{
-#ifdef HAVE_PAM_GETENVLIST
-        return(pam_getenvlist(__pamh));
-#else /* HAVE_PAM_GETENVLIST */
-        return(NULL);
-#endif /* HAVE_PAM_GETENVLIST */
+        return (ret);
 }
 
-void free_pam_environment(char **env)
+void
+print_pam_messages(void)
 {
-        int i;
-
-        if (env != NULL) {
-                for (i = 0; env[i] != NULL; i++)
-                        xfree(env[i]);
-        }
+        /* XXX */
 }
 
-/* Print any messages that have been generated during authentication */
-/* or account checking to stderr */
-void print_pam_messages(void)
+char **
+fetch_pam_environment(void)
 {
-        if (__pam_msg != NULL)
-                fputs(__pam_msg, stderr);
+#ifdef HAVE_PAM_GETENVLIST
+        debug("PAM: retrieving environment");
+        return (pam_getenvlist(sshpam_handle));
+#else
+        return (NULL);
+#endif
 }
 
-/* Append a message to buffer */
-void message_cat(char **p, const char *a)
+void
+free_pam_environment(char **env)
 {
-        char *cp;
-        size_t new_len;
-
-        new_len = strlen(a);
+        char **envp;
 
-        if (*p) {
-                size_t len = strlen(*p);
-
-                *p = xrealloc(*p, new_len + len + 2);
-                cp = *p + len;
-        } else
-                *p = cp = xmalloc(new_len + 2);
+        if (env == NULL)
+                return;
 
-        memcpy(cp, a, new_len);
-        cp[new_len] = '\n';
-        cp[new_len + 1] = '\0';
+        for (envp = env; *envp; envp++)
+                xfree(*envp);
+        xfree(env);
 }
 
 #endif /* USE_PAM */