You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
33 lines
1.2 KiB
33 lines
1.2 KiB
2 months ago
|
From 26f366e263e575c4e1a18e2e64ba418f58878b37 Mon Sep 17 00:00:00 2001
|
||
|
|
From: Daan De Meyer <daan.j.demeyer@gmail.com>
|
||
|
|
Date: Mon, 20 Mar 2023 20:22:14 +0100
|
||
|
|
Subject: [PATCH] Only set PAM_RHOST if the remote host is not "UNKNOWN"
|
||
|
|
|
||
|
|
When using sshd's -i option with stdio that is not a AF_INET/AF_INET6
|
||
|
|
socket, auth_get_canonical_hostname() returns "UNKNOWN" which is then
|
||
|
|
set as the value of PAM_RHOST, causing pam to try to do a reverse DNS
|
||
|
|
query of "UNKNOWN", which times out multiple times, causing a
|
||
|
|
substantial slowdown when logging in.
|
||
|
|
|
||
|
|
To fix this, let's only set PAM_RHOST if the hostname is not "UNKNOWN".
|
||
|
|
---
|
||
|
|
auth-pam.c | 2 +-
|
||
|
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
||
|
|
|
||
|
|
diff --git a/auth-pam.c b/auth-pam.c
|
||
|
|
index e143304e3..39b4e4563 100644
|
||
|
|
--- a/auth-pam.c
|
||
|
|
+++ b/auth-pam.c
|
||
|
|
@@ -735,7 +735,7 @@ sshpam_init(struct ssh *ssh, Authctxt *authctxt)
|
||
|
|
sshpam_laddr = get_local_ipaddr(
|
||
|
|
ssh_packet_get_connection_in(ssh));
|
||
|
|
}
|
||
|
|
- if (sshpam_rhost != NULL) {
|
||
|
|
+ if (sshpam_rhost != NULL && strcmp(sshpam_rhost, "UNKNOWN") != 0) {
|
||
|
|
debug("PAM: setting PAM_RHOST to \"%s\"", sshpam_rhost);
|
||
|
|
sshpam_err = pam_set_item(sshpam_handle, PAM_RHOST,
|
||
|
|
sshpam_rhost);
|
||
|
|
--
|
||
|
|
2.44.0
|
||
|
|
|