- (dtucker) [auth-pam.c auth.h auth2-none.c auth2.c monitor.c monitor_wrap.c]

   Bug #892: Send messages from failing PAM account modules to the client via
   SSH2_MSG_USERAUTH_BANNER messages.  Note that this will not happen with
   SSH2 kbdint authentication, which need to be dealt with separately.  ok djm@

1 files changed, 14 insertions, 5 deletions

diff --git a/auth2-none.c b/auth2-none.c
index 787458dad..1c30a3203 100644
--- a/auth2-none.c
+++ b/auth2-none.c
@@ -74,6 +74,19 @@ auth2_read_banner(void)
         return (banner);
 }
 
+void
+userauth_send_banner(const char *msg)
+{
+        if (datafellows & SSH_BUG_BANNER)
+                return;
+
+        packet_start(SSH2_MSG_USERAUTH_BANNER);
+        packet_put_cstring(msg);
+        packet_put_cstring("");         /* language, unused */
+        packet_send();
+        debug("%s: sent", __func__);
+}
+
 static void
 userauth_banner(void)
 {
@@ -84,12 +97,8 @@ userauth_banner(void)
 
         if ((banner = PRIVSEP(auth2_read_banner())) == NULL)
                 goto done;
+        userauth_send_banner(banner);
 
-        packet_start(SSH2_MSG_USERAUTH_BANNER);
-        packet_put_cstring(banner);
-        packet_put_cstring("");         /* language, unused */
-        packet_send();
-        debug("userauth_banner: sent");
 done:
         if (banner)
                 xfree(banner);