debian/openssh-server.sshd.pam: Explicitly state that ~/.pam_environment

should be read, and move the pam_env calls from "auth" to "session" so
that it's also read when $HOME is encrypted (LP: #952185).

1 files changed, 7 insertions, 7 deletions

diff --git a/debian/openssh-server.sshd.pam b/debian/openssh-server.sshd.pam
index c108cdf68..9261e9dca 100644
--- a/debian/openssh-server.sshd.pam
+++ b/debian/openssh-server.sshd.pam
@@ -1,12 +1,5 @@
 # PAM configuration for the Secure Shell service
 
-# Read environment variables from /etc/environment and
-# /etc/security/pam_env.conf.
-auth       required     pam_env.so # [1]
-# In Debian 4.0 (etch), locale-related environment variables were moved to
-# /etc/default/locale, so read that as well.
-auth       required     pam_env.so envfile=/etc/default/locale
-
 # Standard Un*x authentication.
 @include common-auth
 
@@ -38,5 +31,12 @@ session    required     pam_limits.so
 # Set up SELinux capabilities (need modified pam)
 # session  required     pam_selinux.so multiple
 
+# Read environment variables from /etc/environment and
+# /etc/security/pam_env.conf.
+session    required     pam_env.so # [1]
+# In Debian 4.0 (etch), locale-related environment variables were moved to
+# /etc/default/locale, so read that as well.
+session    required     pam_env.so user_readenv=1 envfile=/etc/default/locale
+
 # Standard Un*x password updating.
 @include common-password