From b0695cc9f5478daa14d3f451ecdd39ba6e6abe0f Mon Sep 17 00:00:00 2001

From: Jakub Jelen <jjelen@redhat.com>

Date: Tue, 19 Jan 2016 15:29:22 +0100

Subject: [PATCH] authorized_keys_command

---

 pam_ssh_agent_auth-0.9.3/CONTRIBUTORS              |   2 +

 pam_ssh_agent_auth-0.9.3/Makefile.in               |  28 +-

 pam_ssh_agent_auth-0.9.3/README                    |  38 +++

 pam_ssh_agent_auth-0.9.3/configure.ac              |  27 +-

 pam_ssh_agent_auth-0.9.3/get_command_line.c        | 113 +++++++

 pam_ssh_agent_auth-0.9.3/get_command_line.h        |  40 +++

 pam_ssh_agent_auth-0.9.3/identity.h                |  24 ++

 pam_ssh_agent_auth-0.9.3/iterate_ssh_agent_keys.c  | 137 ++++++++-

 pam_ssh_agent_auth-0.9.3/iterate_ssh_agent_keys.h  |   2 +-

 pam_ssh_agent_auth-0.9.3/pam_ssh_agent_auth.c      |  16 +-

 pam_ssh_agent_auth-0.9.3/pam_ssh_agent_auth.pod    |  50 ++-

 pam_ssh_agent_auth-0.9.3/pam_static_macros.h       |  29 ++

 .../pam_user_authorized_keys.c                     |  23 +-

 .../pam_user_authorized_keys.h                     |   2 +-

 pam_ssh_agent_auth-0.9.3/pam_user_key_allowed2.c   | 334 ++++++++++++++++-----

 pam_ssh_agent_auth-0.9.3/pam_user_key_allowed2.h   |   3 +-

 pam_ssh_agent_auth-0.9.3/secure_filename.c         |  51 +++-

 pam_ssh_agent_auth-0.9.3/secure_filename.h         |   4 +-

 pam_ssh_agent_auth-0.9.3/userauth_pubkey_from_id.c |  20 +-

 pam_ssh_agent_auth-0.9.3/userauth_pubkey_from_id.h |   2 +-

 20 files changed, 805 insertions(+), 140 deletions(-)

 create mode 100644 pam_ssh_agent_auth-0.9.3/README

 create mode 100644 pam_ssh_agent_auth-0.9.3/get_command_line.c

 create mode 100644 pam_ssh_agent_auth-0.9.3/get_command_line.h

diff --git a/pam_ssh_agent_auth-0.9.3/CONTRIBUTORS b/pam_ssh_agent_auth-0.9.3/CONTRIBUTORS

index d5a21cb..22b424a 100644

--- a/pam_ssh_agent_auth-0.9.3/CONTRIBUTORS

+++ b/pam_ssh_agent_auth-0.9.3/CONTRIBUTORS

@@ -1,3 +1,5 @@

 * Foremost, OpenSSH from which this project is derived.

 * Jamie Beverly

 * Rafael D'Halleweyn - 2011-06-05 18:56:24 EDT

+* Jan-Pieter Cornet ( johnpc ) - 2012-03-23 03:25:52 PDT

+* chrysn@fsfe.org

diff --git a/pam_ssh_agent_auth-0.9.3/Makefile.in b/pam_ssh_agent_auth-0.9.3/Makefile.in

index 47bb103..4977838 100644

--- a/pam_ssh_agent_auth-0.9.3/Makefile.in

+++ b/pam_ssh_agent_auth-0.9.3/Makefile.in

@@ -1,4 +1,28 @@

 # $Id: Makefile.in,v 1.289 2008/03/13 01:41:31 djm Exp $

+#

+# Copyright (c) 2000 Markus Friedl.  All rights reserved.

+# Modifications Copyright (c) 2008-2014 Jamie Beverly. All Rights reserved

+#

+# Redistribution and use in source and binary forms, with or without

+# modification, are permitted provided that the following conditions

+# are met:

+# 1. Redistributions of source code must retain the above copyright

+#    notice, this list of conditions and the following disclaimer.

+# 2. Redistributions in binary form must reproduce the above copyright

+#    notice, this list of conditions and the following disclaimer in the

+#    documentation and/or other materials provided with the distribution.

+#

+# THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR

+# IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES

+# OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.

+# IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,

+# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT

+# NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,

+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY

+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT

+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF

+# THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

+#

 # uncomment if you run a non bourne compatable shell. Ie. csh

 #SHELL = @SH@

@@ -46,9 +70,9 @@ INSTALL_SSH_RAND_HELPER=@INSTALL_SSH_RAND_HELPER@

 PAM_MODULES=pam_ssh_agent_auth.so

-SSHOBJS=xmalloc.o atomicio.o authfd.o bufaux.o bufbn.o buffer.o cleanup.o entropy.o fatal.o key.o log.o misc.o secure_filename.o ssh-dss.o ssh-rsa.o uuencode.o compat.o

+SSHOBJS=xmalloc.o atomicio.o authfd.o bufaux.o bufbn.o buffer.o cleanup.o entropy.o fatal.o key.o log.o misc.o secure_filename.o ssh-dss.o ssh-rsa.o uuencode.o compat.o uidswap.o

-PAM_SSH_AGENT_AUTH_OBJS=pam_user_key_allowed2.o iterate_ssh_agent_keys.o userauth_pubkey_from_id.o pam_user_authorized_keys.o secure_filename.o

+PAM_SSH_AGENT_AUTH_OBJS=pam_user_key_allowed2.o iterate_ssh_agent_keys.o userauth_pubkey_from_id.o pam_user_authorized_keys.o secure_filename.o get_command_line.o

 MANPAGES_IN	= pam_ssh_agent_auth.pod

diff --git a/pam_ssh_agent_auth-0.9.3/README b/pam_ssh_agent_auth-0.9.3/README

new file mode 100644

index 0000000..c1a49ef

--- /dev/null

+++ b/pam_ssh_agent_auth-0.9.3/README

@@ -0,0 +1,38 @@

+pam_ssh_agent_auth is a PAM module which permits PAM authentication via your

+keyring in a forwarded ssh-agent.

+

+Release 0.10.1 is stable, and has been tested on FreeBSD, Solaris 10, Solaris 11,

+RHEL5, RHEL6, Debian Wheezy, Ubuntu 12.04 (LTS), Ubuntu 13.10,

+and MacOS X 10.7.

+

+This module can be used to provide authentication for anything run locally that

+supports PAM. It was written specifically with the intention of permitting

+authentication for sudo without password entry, and also has been proven useful

+for use with su as an alternative to wheel.

+

+It serves as middle ground between the two most common, and suboptimal

+alternatives for large-scale system administration: allowing rootlogin via ssh,

+or using NOPASSWD in sudoers. This module allows for ssh public-key

+authentication, and it does this by leveraging an authentication mechanism you

+are probably already using, ssh-agent.

+

+There are caveats of course, ssh-agent forwarding has it’s own security risks

+which must be carefully considered for your environment. In cases where there

+are not untrustworthy intermediate servers, and you wish to retain traceability,

+accountability, and required authentication for privileged command invocation,

+the benefits should outweigh the risks. Release 0.10.1 can be downloaded from

+SourceForge: https://sourceforge.net/project/showfiles.php?group_id=249556

+

+If you encounter any issues with usability or security, please use the project's

+SourceForge tracker:

+https://sourceforge.net/tracker2/?group_id=249556&atid=1126337

+

+Note that if you wish to use this for sudo, you will need a version of sudo that

+preserves the env_keep environment during authentication; and ideally a version

+incorporating my minor patch which ensures RUSER is set during PAM authentication.

+

+sudo 1.6.8p12 does not work correctly with this PAM module, because it clears the

+environment (even env_keep variables) prior to attempting PAM authentication.

+

+sudo 1.7.2p1 or later is preferred, as it correctly sets PAM_RUSER for

+authentication.

diff --git a/pam_ssh_agent_auth-0.9.3/configure.ac b/pam_ssh_agent_auth-0.9.3/configure.ac

index 1f372ce..4eb1f32 100644

--- a/pam_ssh_agent_auth-0.9.3/configure.ac

+++ b/pam_ssh_agent_auth-0.9.3/configure.ac

@@ -18,8 +18,10 @@ AC_INIT(OpenSSH, Portable, openssh-unix-dev@mindrot.org)

 AC_REVISION($Revision: 1.397 $)

 AC_CONFIG_SRCDIR([pam_ssh_agent_auth.c])

-AC_CONFIG_HEADER(config.h)

+AC_CONFIG_SRCDIR([config.h.in])

+AC_CONFIG_HEADERS([config.h])

 AC_PROG_CC

+AC_C_INLINE

 AC_CANONICAL_HOST

 AC_C_BIGENDIAN

@@ -117,7 +119,6 @@ if test -z "$LD" ; then

 fi

 AC_SUBST(LD)

-AC_C_INLINE

 AC_CHECK_DECL(LLONG_MAX, have_llong_max=1, , [#include <limits.h>])

@@ -151,7 +152,7 @@ if test "$GCC" = "yes" || test "$GCC" = "egcs"; then

 		     ;;

 		2.*) no_attrib_nonnull=1 ;;

 		3.*) CFLAGS="$CFLAGS -Wsign-compare" ;;

-		4.*) CFLAGS="$CFLAGS -Wsign-compare -Wno-pointer-sign" ;;

+		4.*) CFLAGS="$CFLAGS -Wsign-compare -Wall -Wextra" ;;

 		*) ;;

 	esac

@@ -1656,11 +1657,11 @@ fi

 if test "x$check_for_conflicting_getspnam" = "x1"; then

 	AC_MSG_CHECKING(for conflicting getspnam in shadow.h)

-	AC_COMPILE_IFELSE(

+	AC_COMPILE_IFELSE([AC_LANG_SOURCE(

 		[

 #include <shadow.h>

 int main(void) {exit(0);}

-		],

+		])],

 		[

 			AC_MSG_RESULT(no)

 		],

@@ -2720,7 +2721,7 @@ fi

 dnl make sure we're using the real structure members and not defines

 AC_CACHE_CHECK([for msg_accrights field in struct msghdr],

 		ac_cv_have_accrights_in_msghdr, [

-	AC_COMPILE_IFELSE(

+	AC_COMPILE_IFELSE([AC_LANG_SOURCE(

 		[

 #include <sys/types.h>

 #include <sys/socket.h>

@@ -2734,7 +2735,7 @@ struct msghdr m;

 m.msg_accrights = 0;

 exit(0);

 }

-		],

+		])],

 		[ ac_cv_have_accrights_in_msghdr="yes" ],

 		[ ac_cv_have_accrights_in_msghdr="no" ]

 	)

@@ -2747,7 +2748,7 @@ fi

 AC_CACHE_CHECK([for msg_control field in struct msghdr],

 		ac_cv_have_control_in_msghdr, [

-	AC_COMPILE_IFELSE(

+	AC_COMPILE_IFELSE([AC_LANG_SOURCE(

 		[

 #include <sys/types.h>

 #include <sys/socket.h>

@@ -2761,7 +2762,7 @@ struct msghdr m;

 m.msg_control = 0;

 exit(0);

 }

-		],

+		])],

 		[ ac_cv_have_control_in_msghdr="yes" ],

 		[ ac_cv_have_control_in_msghdr="no" ]

 	)

@@ -2891,14 +2892,14 @@ AC_SEARCH_LIBS(getrrsetbyname, resolv,

 		    saved_LIBS="$LIBS"

 		    LIBS="$LIBS -lresolv"

 		    AC_MSG_CHECKING(for res_query in -lresolv)

-		    AC_LINK_IFELSE([

+		    AC_LINK_IFELSE([AC_LANG_SOURCE([

 #include <resolv.h>

 int main()

 {

 	res_query (0, 0, 0, 0, 0);

 	return 0;

 }

-			],

+			])],

 			[LIBS="$LIBS -lresolv"

 			 AC_MSG_RESULT(yes)],

 			[LIBS="$saved_LIBS"

@@ -2915,7 +2916,7 @@ int main()

 	])

 AC_MSG_CHECKING(if struct __res_state _res is an extern)

-AC_LINK_IFELSE([

+AC_LINK_IFELSE([AC_LANG_SOURCE([

 #include <stdio.h>

 #if HAVE_SYS_TYPES_H

 # include <sys/types.h>

@@ -2925,7 +2926,7 @@ AC_LINK_IFELSE([

 #include <resolv.h>

 extern struct __res_state _res;

 int main() { return 0; }

-		],

+		])],

 		[AC_MSG_RESULT(yes)

 		 AC_DEFINE(HAVE__RES_EXTERN, 1,

 		    [Define if you have struct __res_state _res as an extern])

diff --git a/pam_ssh_agent_auth-0.9.3/get_command_line.c b/pam_ssh_agent_auth-0.9.3/get_command_line.c

new file mode 100644

index 0000000..e880fee

--- /dev/null

+++ b/pam_ssh_agent_auth-0.9.3/get_command_line.c

@@ -0,0 +1,113 @@

+/*

+ * Copyright (c) 2014, Jamie Beverly.

+ * All rights reserved.

+ *

+ * Redistribution and use in source and binary forms, with or without modification, are

+ * permitted provided that the following conditions are met:

+ *

+ *    1. Redistributions of source code must retain the above copyright notice, this list of

+ *       conditions and the following disclaimer.

+ *

+ *    2. Redistributions in binary form must reproduce the above copyright notice, this list

+ *       of conditions and the following disclaimer in the documentation and/or other materials

+ *       provided with the distribution.

+ *

+ * THIS SOFTWARE IS PROVIDED BY Jamie Beverly ``AS IS'' AND ANY EXPRESS OR IMPLIED

+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND

+ * FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL Jamie Beverly OR

+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR

+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR

+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON

+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING

+ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF

+ * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

+ *

+ * The views and conclusions contained in the software and documentation are those of the

+ * authors and should not be interpreted as representing official policies, either expressed

+ * or implied, of Jamie Beverly.

+ */

+

+#include <stdio.h>

+#include <errno.h>

+#include <string.h>

+

+#include "includes.h"

+#include "xmalloc.h"

+#include "get_command_line.h"

+

+#ifdef HAVE_PROC_PID_CMDLINE

+

+static size_t

+proc_pid_cmdline(char *** inargv)

+{

+    pid_t pid;

+    FILE *f = NULL;

+    char filename[64] = { 0 }, c = '\0';

+    char ** argv;

+    char argbuf[MAX_LEN_PER_CMDLINE_ARG + 1] = { 0 };

+    size_t count = 0, len = 0;

+

+    pid = getpid();

+    argv = NULL;

+

+    snprintf(filename, sizeof(filename), "/proc/%d/cmdline", pid);

+    f = fopen(filename, "r");

+

+    if (f) { 

+        while (!feof(f) && count < MAX_CMDLINE_ARGS) {

+            if (len > MAX_LEN_PER_CMDLINE_ARG) {

+                while (!feof(f) && (c = fgetc(f)) != '\0');

+            }

+            else {

+                c = fgetc(f);

+            }

+            switch (c) {

+                case EOF:

+                case '\0':

+                    if (len > 0) { 

+                        argv = xrealloc(argv, count + 1, sizeof(*argv));

+                        argv[count] = xcalloc(len + 1, sizeof(*argv[count]));

+                        strncpy(argv[count++], argbuf, len);

+                        memset(argbuf, '\0', MAX_LEN_PER_CMDLINE_ARG + 1);

+                        len = 0;

+                    }

+                    break;

+                default:

+                    argbuf[len++] = c;

+                    break;

+            }

+        }

+        fclose(f);

+    }

+    *inargv = argv;

+    return count;

+}

+#endif

+

+

+/*

+ * takes a pointer to an unallocated array of arrays of strings, populates the

+ * given pointer with the address of the allocated array of strings collected

+ */

+size_t 

+pamsshagentauth_get_command_line(char *** argv)

+{

+#ifdef HAVE_PROC_PID_CMDLINE

+    return proc_pid_cmdline(argv);

+#else

+    /* No other supported implementations at this time */

+    return 0;

+#endif

+}

+

+void

+pamsshagentauth_free_command_line(char ** argv, size_t n_args)

+{

+    size_t i;

+    for (i = 0; i < n_args; i++)

+        free(argv[i]);

+

+    free(argv);

+    return;

+}

+

diff --git a/pam_ssh_agent_auth-0.9.3/get_command_line.h b/pam_ssh_agent_auth-0.9.3/get_command_line.h

new file mode 100644

index 0000000..37cd077

--- /dev/null

+++ b/pam_ssh_agent_auth-0.9.3/get_command_line.h

@@ -0,0 +1,40 @@

+/*

+ * Copyright (c) 2014, Jamie Beverly.

+ * All rights reserved.

+ *

+ * Redistribution and use in source and binary forms, with or without modification, are

+ * permitted provided that the following conditions are met:

+ *

+ *    1. Redistributions of source code must retain the above copyright notice, this list of

+ *       conditions and the following disclaimer.

+ *

+ *    2. Redistributions in binary form must reproduce the above copyright notice, this list

+ *       of conditions and the following disclaimer in the documentation and/or other materials

+ *       provided with the distribution.

+ *

+ * THIS SOFTWARE IS PROVIDED BY Jamie Beverly ``AS IS'' AND ANY EXPRESS OR IMPLIED

+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND

+ * FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL Jamie Beverly OR

+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR

+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR

+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON

+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING

+ * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF

+ * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

+ *

+ * The views and conclusions contained in the software and documentation are those of the

+ * authors and should not be interpreted as representing official policies, either expressed

+ * or implied, of Jamie Beverly.

+ */

+

+#ifndef _GET_COMMAND_LINE_H

+#define _GET_COMMAND_LINE_H

+

+#include "includes.h"

+

+size_t pamsshagentauth_get_command_line(char ***);

+void pamsshagentauth_free_command_line(char **, size_t);

+#define MAX_CMDLINE_ARGS 255

+#define MAX_LEN_PER_CMDLINE_ARG 255

+

+#endif

diff --git a/pam_ssh_agent_auth-0.9.3/identity.h b/pam_ssh_agent_auth-0.9.3/identity.h

index eb21320..0bde782 100644

--- a/pam_ssh_agent_auth-0.9.3/identity.h

+++ b/pam_ssh_agent_auth-0.9.3/identity.h

@@ -1,3 +1,27 @@

+/*

+ * Copyright (c) 2000 Markus Friedl.  All rights reserved.

+ *

+ * Redistribution and use in source and binary forms, with or without

+ * modification, are permitted provided that the following conditions

+ * are met:

+ * 1. Redistributions of source code must retain the above copyright

+ *    notice, this list of conditions and the following disclaimer.

+ * 2. Redistributions in binary form must reproduce the above copyright

+ *    notice, this list of conditions and the following disclaimer in the

+ *    documentation and/or other materials provided with the distribution.

+ *

+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR

+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES

+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.

+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,

+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT

+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,

+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY

+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT

+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF

+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

+ */

+

 #ifndef _IDENTITY_H

 #define _IDENTITY_H

 #include "includes.h"

diff --git a/pam_ssh_agent_auth-0.9.3/iterate_ssh_agent_keys.c b/pam_ssh_agent_auth-0.9.3/iterate_ssh_agent_keys.c

index 11ab6e2..6b4d531 100644

--- a/pam_ssh_agent_auth-0.9.3/iterate_ssh_agent_keys.c

+++ b/pam_ssh_agent_auth-0.9.3/iterate_ssh_agent_keys.c

@@ -28,6 +28,8 @@

  */

+#include <string.h>

+

 #include "includes.h"

 #include "config.h"

@@ -48,26 +50,75 @@

 #include <errno.h>

 #include <fcntl.h>

 #include <openssl/evp.h>

+#include "ssh2.h"

+#include "misc.h"

 #include "userauth_pubkey_from_id.h"

 #include "identity.h"

+#include "get_command_line.h"

+extern char **environ;

+

+#define PAM_SSH_AGENT_AUTH_REQUESTv1 101

+

+static char *

+log_action(char ** action, size_t count)

+{

+    size_t i;

+    char *buf = NULL;

+

+    if (count == 0)

+        return NULL;

+   

+    buf = xcalloc((count * MAX_LEN_PER_CMDLINE_ARG) + (count * 3), sizeof(*buf));

+    for (i = 0; i < count; i++) {

+        strcat(buf, (i > 0) ? " '" : "'");

+        strncat(buf, action[i], MAX_LEN_PER_CMDLINE_ARG);

+        strcat(buf, "'");

+    }

+    return buf;

+}

+

+void

+agent_action(Buffer *buf, char ** action, size_t count)

+{

+    size_t i;

+    buffer_init(buf);

-u_char * session_id2 = NULL;

-uint8_t session_id_len = 0;

+    buffer_put_int(buf, count);

+

+    for (i = 0; i < count; i++) {

+        buffer_put_cstring(buf, action[i]);

+    }

+}

-u_char *

-session_id2_gen()

+void

+session_id2_gen(Buffer * session_id2, const char * user,

+                const char * ruser, const char * servicename)

 {

     char *cookie = NULL;

     uint8_t i = 0;

     uint32_t rnd = 0;

+    uint8_t cookie_len;

+    char hostname[256] = { 0 };

+    char pwd[1024] = { 0 };

+    time_t ts;

+    char ** reported_argv = NULL;

+    size_t count = 0;

+    char * action_logbuf = NULL;

+    Buffer action_agentbuf;

+    uint8_t free_logbuf = 0;

+    char * retc;

+    int32_t reti;

     rnd = arc4random();

-    session_id_len = (uint8_t) rnd;

+    cookie_len = ((uint8_t) rnd);

+    while (cookie_len < 16) { 

+        cookie_len += 16;                                          /* Add 16 bytes to the size to ensure that while the length is random, the length is always reasonable; ticket #18 */

+    }

-    cookie = calloc(1,session_id_len);

+    cookie = xcalloc(1, cookie_len);

-    for (i = 0; i < session_id_len; i++) {

+    for (i = 0; i < cookie_len; i++) {

         if (i % 4 == 0) {

             rnd = arc4random();

         }

@@ -75,7 +126,64 @@ session_id2_gen()

         rnd >>= 8;

     }

-    return cookie;

+    count = pamsshagentauth_get_command_line(&reported_argv);

+    if (count > 0) { 

+        free_logbuf = 1;

+        action_logbuf = log_action(reported_argv, count);

+        agent_action(&action_agentbuf, reported_argv, count);

+        pamsshagentauth_free_command_line(reported_argv, count);

+    }

+    else {

+        action_logbuf = "unknown on this platform";

+        buffer_init(&action_agentbuf); /* stays empty, means unavailable */

+    }

+    

+    /*

+    action = getenv("SUDO_COMMAND");

+    if(!action) {

+        action = getenv("PAM_AUTHORIZED_ACTION");

+        if(!action) {

+            action = empty;

+        }

+    }

+    */

+

+    reti = gethostname(hostname, sizeof(hostname) - 1);

+    retc = getcwd(pwd, sizeof(pwd) - 1);

+    time(&ts);

+

+    buffer_init(session_id2);

+

+    buffer_put_int(session_id2, PAM_SSH_AGENT_AUTH_REQUESTv1);

+    /* debug3("cookie: %s", tohex(cookie, cookie_len)); */

+    buffer_put_string(session_id2, cookie, cookie_len);

+    /* debug3("user: %s", user); */

+    buffer_put_cstring(session_id2, user);

+    /* debug3("ruser: %s", ruser); */

+    buffer_put_cstring(session_id2, ruser);

+    /* debug3("servicename: %s", servicename); */

+    buffer_put_cstring(session_id2, servicename);

+    /* debug3("pwd: %s", pwd); */

+    if(retc)

+        buffer_put_cstring(session_id2, pwd);

+    else

+        buffer_put_cstring(session_id2, "");

+    /* debug3("action: %s", action_logbuf); */

+    buffer_put_string(session_id2, action_agentbuf.buf + action_agentbuf.offset, action_agentbuf.end - action_agentbuf.offset);

+    if (free_logbuf) { 

+        free(action_logbuf);

+        buffer_free(&action_agentbuf);

+    }

+    /* debug3("hostname: %s", hostname); */

+    if(reti >= 0)

+        buffer_put_cstring(session_id2, hostname);

+    else

+        buffer_put_cstring(session_id2, "");

+    /* debug3("ts: %ld", ts); */

+    buffer_put_int64(session_id2, (uint64_t) ts);

+

+    free(cookie);

+    return;

 }

 /* 

@@ -174,19 +282,21 @@ ssh_get_authentication_connection_for_uid(uid_t uid)

 }

 int

-find_authorized_keys(uid_t uid)

+find_authorized_keys(const char * user, const char * ruser, const char * servicename)

 {

+    Buffer session_id2 = { 0 };

     Identity *id;

     Key *key;

     AuthenticationConnection *ac;

     char *comment;

     uint8_t retval = 0;

+    uid_t uid = getpwnam(ruser)->pw_uid;

     OpenSSL_add_all_digests();

-    session_id2 = session_id2_gen();

+    session_id2_gen(&session_id2, user, ruser, servicename);

     if ((ac = ssh_get_authentication_connection_for_uid(uid))) {

-        verbose("Contacted ssh-agent of user %s (%u)", getpwuid(uid)->pw_name, uid);

+        verbose("Contacted ssh-agent of user %s (%u)", ruser, uid);

         for (key = ssh_get_first_identity(ac, &comment, 2); key != NULL; key = ssh_get_next_identity(ac, &comment, 2)) 

         {

             if(key != NULL) {

@@ -194,7 +304,7 @@ find_authorized_keys(uid_t uid)

                 id->key = key;

                 id->filename = comment;

                 id->ac = ac;

-                if(userauth_pubkey_from_id(id)) {

+                if(userauth_pubkey_from_id(ruser, id, &session_id2)) {

                     retval = 1;

                 }

                 free(id->filename);

@@ -204,12 +314,13 @@ find_authorized_keys(uid_t uid)

                     break;

             }

         }

+        buffer_free(&session_id2);

         ssh_close_authentication_connection(ac);

     }

     else {

         verbose("No ssh-agent could be contacted");

     }

-    free(session_id2);

+    /*free(session_id2);*/

     EVP_cleanup();

     return retval;

 }

diff --git a/pam_ssh_agent_auth-0.9.3/iterate_ssh_agent_keys.h b/pam_ssh_agent_auth-0.9.3/iterate_ssh_agent_keys.h

index ed7549e..e6c75aa 100644

--- a/pam_ssh_agent_auth-0.9.3/iterate_ssh_agent_keys.h

+++ b/pam_ssh_agent_auth-0.9.3/iterate_ssh_agent_keys.h

@@ -31,6 +31,6 @@

 #ifndef _ITERATE_SSH_AGENT_KEYS_H

 #define _ITERATE_SSH_AGENT_KEYS_H

-int find_authorized_keys(uid_t);

+int find_authorized_keys(const char * user, const char * ruser, const char * servicename);

 #endif

diff --git a/pam_ssh_agent_auth-0.9.3/pam_ssh_agent_auth.c b/pam_ssh_agent_auth-0.9.3/pam_ssh_agent_auth.c

index d3f4325..37309f7 100644

--- a/pam_ssh_agent_auth-0.9.3/pam_ssh_agent_auth.c

+++ b/pam_ssh_agent_auth-0.9.3/pam_ssh_agent_auth.c

@@ -59,9 +59,12 @@

 #include "pam_user_authorized_keys.h"

 #define strncasecmp_literal(A,B) strncasecmp( A, B, sizeof(B) - 1)

+#define UNUSED(expr) do { (void)(expr); } while (0)

 char           *authorized_keys_file = NULL;

 uint8_t         allow_user_owned_authorized_keys_file = 0;

+char           *authorized_keys_command = NULL;

+char           *authorized_keys_command_user = NULL;

 #if ! HAVE___PROGNAME || HAVE_BUNDLE

 char           *__progname;

@@ -90,6 +93,7 @@ pam_sm_authenticate(pam_handle_t * pamh, int flags, int argc, const char **argv)

     facility = SYSLOG_FACILITY_AUTHPRIV;

 #endif

+    UNUSED(flags);

     pam_get_item(pamh, PAM_SERVICE, (void *) &servicename);

 /*

  * XXX: 

@@ -113,6 +117,12 @@ pam_sm_authenticate(pam_handle_t * pamh, int flags, int argc, const char **argv)

         if(strncasecmp_literal(*argv_ptr, "file=") == 0 ) { 

             authorized_keys_file_input = *argv_ptr + sizeof("file=") - 1;

         }

+        if(strncasecmp_literal(*argv_ptr, "authorized_keys_command=") == 0 ) { 

+            authorized_keys_command = *argv_ptr + sizeof("authorized_keys_command=") - 1;

+        }

+        if(strncasecmp_literal(*argv_ptr, "authorized_keys_command_user=") == 0 ) { 

+            authorized_keys_command_user = *argv_ptr + sizeof("authorized_keys_command_user=") - 1;

+        }

 #ifdef ENABLE_SUDO_HACK

         if(strncasecmp_literal(*argv_ptr, "sudo_service_name=") == 0) { 

             strncpy( sudo_service_name, *argv_ptr + sizeof("sudo_service_name=") - 1, sizeof(sudo_service_name) - 1);

@@ -182,7 +192,7 @@ pam_sm_authenticate(pam_handle_t * pamh, int flags, int argc, const char **argv)

         /* 

          * this pw_uid is used to validate the SSH_AUTH_SOCK, and so must be the uid of the ruser invoking the program, not the target-user

          */

-        if(find_authorized_keys(getpwnam(ruser)->pw_uid)) {

+        if(find_authorized_keys(user, ruser, servicename)) { /* getpwnam(ruser)->pw_uid)) { */

             logit("Authenticated: `%s' as `%s' using %s", ruser, user, authorized_keys_file);

             retval = PAM_SUCCESS;

         } else {

@@ -207,6 +217,10 @@ cleanexit:

 PAM_EXTERN int __attribute__ ((visibility ("default")))

 pam_sm_setcred(pam_handle_t * pamh, int flags, int argc, const char **argv)

 {