NetBSD Problem Report #60578

From mlelstv@arnold.1st.de  Thu Aug 13 13:04:06 2026
Return-Path: <mlelstv@arnold.1st.de>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits)
	 client-signature RSA-PSS (2048 bits))
	(Client CN "mail.netbsd.org", Issuer "YR2" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id 4BB681A923B
	for <gnats-bugs@gnats.NetBSD.org>; Thu, 13 Aug 2026 13:04:06 +0000 (UTC)
Message-Id: <20260813130029.6DDA3BC165@arnold.1st.de>
Date: Thu, 13 Aug 2026 15:00:29 +0200 (CEST)
From: mlelstv@netbsd.org
Reply-To: mlelstv@netbsd.org
To: gnats-bugs@NetBSD.org
Subject: pam_ssh fails to use ssh-agent
X-Send-Pr-Version: 3.95
X-From4GNATS: "mlelstv@netbsd.org via gnats" <gnats-admin@NetBSD.org>

>Number:         60578
>Category:       bin
>Synopsis:       pam_ssh fails to use ssh-agent
>Confidential:   no
>Severity:       critical
>Priority:       low
>Responsible:    bin-bug-people
>State:          feedback
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Thu Aug 13 13:05:00 +0000 2026
>Closed-Date:    
>Last-Modified:  Sun Aug 16 14:50:01 +0000 2026
>Originator:     Michael van Elst
>Release:        NetBSD 11.99.7
>Organization:

>Environment:


System: NetBSD arnold 11.99.7 NetBSD 11.99.7 (EGGHED64) #6: Wed Aug 5 06:50:55 UTC 2026 mlelstv@slowpoke:/home/netbsd-current/obj.evbarm64-el/scratch/netbsd-current/src/sys/arch/evbarm/compile/EGGHED64 evbarm
Architecture: any
Machine: any
>Description:
The pam_ssh module can be used to automatically launch an ssh-agent
and enable ssh keys. This fails for openssh 10.x.

In netbsd-10 (openssh 9.6) the output of 'ssh-agent -s' looks like:

SSH_AUTH_SOCK=/tmp/ssh-xxxxxxxxxxxx/agent.nnnn; export SSH_AUTH_SOCK;
SSH_AGENT_PID=nnnnn; export SSH_AGENT_PID;

In netbsd-11 and HEAD (openssh 10.3) the output looks like:

export SSH_AUTH_SOCK=/home/mlelstv/.ssh/agent/s.xxxxxxxxxx.agent.xxxxxxxxxx;
export SSH_AGENT_PID=nnnn;


The pam_ssh module recognizes only lines that start with 'SSH_' to pass them
into the environment.

static void
pam_ssh_process_agent_output(pam_handle_t *pamh, FILE *f)
...
        while ((line = fgetln(f, &len)) != NULL) {
                if (len < 4 || strncmp(line, "SSH_", 4) != 0)
                        continue;

The agent isn't terminated either when the PAM session closes as its
PID is learned again from the environment.


>How-To-Repeat:
Uncomment pam_ssh in /etc/pam.d/display_manager.
Watch ssh-agent running, but no environment is set to talk to it.

See also:

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=285043


>Fix:
Improve the parser in lib/libpam/modules/pam_ssh/pam_ssh.c

>Release-Note:

>Audit-Trail:
From: "Taylor R Campbell" <riastradh@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/60578 CVS commit: src/crypto/external/bsd/openssh/dist
Date: Fri, 14 Aug 2026 17:23:36 +0000

 Module Name:	src
 Committed By:	riastradh
 Date:		Fri Aug 14 17:23:36 UTC 2026

 Modified Files:
 	src/crypto/external/bsd/openssh/dist: ssh-agent.c

 Log Message:
 ssh-agent(1): Restore /bin/sh-style output with `ssh-agent -s'.

 This was locally patched to pacify -Wformat-nonliteral, but the local
 patch was changed in the 10.3 leading to different output.  The
 different output, while still valid /bin/sh, broke other downstream
 consumers including pam_ssh.  Perhaps pam_ssh should be more liberal in
 what /bin/sh syntax it accepts, but the change in output wasn't really
 necessary anyway.

 PR bin/60578: pam_ssh fails to use ssh-agent


 To generate a diff of this commit:
 cvs rdiff -u -r1.44 -r1.45 src/crypto/external/bsd/openssh/dist/ssh-agent.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

State-Changed-From-To: open->feedback
State-Changed-By: riastradh@NetBSD.org
State-Changed-When: Fri, 14 Aug 2026 20:46:36 +0000
State-Changed-Why:
Does this work now?

(See also PR bin/60588: pam_ssh mishandles ssh-agent child process
<https://gnats.NetBSD.org/60588>.)


From: Taylor R Campbell <riastradh@NetBSD.org>
To: gnats-bugs@netbsd.org, netbsd-bugs@netbsd.org
Cc: mlelstv@netbsd.org, ryoon@netbsd.org
Subject: Re: bin/60578 (pam_ssh fails to use ssh-agent)
Date: Sun, 16 Aug 2026 14:48:53 +0000

 > Date: Fri, 14 Aug 2026 20:46:37 +0000 (UTC)
 > From: riastradh@NetBSD.org
 > 
 > Synopsis: pam_ssh fails to use ssh-agent
 > 
 > State-Changed-From-To: open->feedback
 > State-Changed-By: riastradh@NetBSD.org
 > State-Changed-When: Fri, 14 Aug 2026 20:46:36 +0000
 > State-Changed-Why:
 > Does this work now?
 > 
 > (See also PR bin/60588: pam_ssh mishandles ssh-agent child process
 > <https://gnats.NetBSD.org/60588>.)

 Oops, missed a spot (will be needed for pullup):

 https://mail-index.netbsd.org/source-changes/2026/08/16/msg163629.html


 Module Name:    src
 Committed By:   ryoon
 Date:           Sun Aug 16 11:41:18 UTC 2026

 Modified Files:
         src/crypto/external/bsd/openssh/dist: ssh-agent.c

 Log Message:
 Fix error, export: not an identifier: PID, from eval `ssh-agent -s`


 To generate a diff of this commit:
 cvs rdiff -u -r1.45 -r1.46 src/crypto/external/bsd/openssh/dist/ssh-agent.c

>Unformatted:

Home	PR Database Search