Bug#242236: sshd eats 100% CPU after logout when X11 forwarding was used (UsePam related)

[Mickael Marchand <marchand@kde.org>]

Subject: sshd eats CPU after logout when an X11 forwarding was used ('UsePAM' related)
Package: ssh
Version: 1:3.8p1-2
Severity: important

Hi,

since I upgraded my sarge ssh to sshd 3.8, I noticed the following
behavior :
with X11 forwarding enabled, I ssh to the box, run 'xdvi', then exits
the session. Then the sshd process (the one running as user), eats all
the CPU.

some notes about my config :
I am using pam+ldap authentication, I only modified common-* files in
/etc/pam.d/ (not the ssh one).
I am using nscd because I configured libnss-ldap.conf to bind
to the LDAP server (that is without nscd, if I login I get a : 'I have no
name!@mybox ~>' prompt) (all searches/reads needs an auth in my LDAP
server)

Removing the (automatically added) UsePAM yes from my sshd_config, the
bug can no longer be reproduced.
Disabling 'nscd' (and keeping UsePAM yes) also prevents the bug from
happening.
If i just logon the box and logout (without using X11 forwards) the bug
does not happen too.

I ran sshd -ddd to get some debug :
here is the end (when the client disconnects after an X11 app was
launched and closed):

debug3: channel 3: close_fds r 16 w 16 e -1
debug1: do_cleanup
debug1: PAM: cleanup
debug3: PAM: sshpam_thread_cleanup entering
debug1: temporarily_use_uid: 10001/20001 (e=10001/20001)
debug1: restore_uid: (unprivileged)
Closing connection to ::ffff:myIP
debug1: PAM: cleanup

<sshd goes into loop>
<I send a kill from another shell>

debug1: do_cleanup
debug1: PAM: cleanup
debug3: PAM: sshpam_thread_cleanup entering

if needed I can send the full log by private mail.

Cheers,
Mik


-- System Information:
Debian Release: testing/unstable
  APT prefers testing
  APT policy: (500, 'testing')
Architecture: i386 (x86_64)
Kernel: Linux 2.6.5
Locale: LANG=fr_FR@euro, LC_CTYPE=fr_FR@euro

Versions of packages ssh depends on:
ii  adduser                     3.51         Add and remove users and groups
ii  debconf                     1.4.16       Debian configuration management sy
ii  dpkg                        1.10.20      Package maintenance system for Deb
hi  libc6                       2.3.2.ds1-11 GNU C Library: Shared libraries an
ii  libpam-modules              0.76-15      Pluggable Authentication Modules f
ii  libpam-runtime              0.76-15      Runtime support for the PAM librar
ii  libpam0g                    0.76-15      Pluggable Authentication Modules l
ii  libssl0.9.7                 0.9.7d-1     SSL shared libraries
ii  libwrap0                    7.6-ipv6.1-3 Wietse Venema's TCP wrappers libra
ii  zlib1g                      1:1.2.1-5    compression library - runtime

-- debconf information:
  ssh/insecure_rshd: 
  ssh/privsep_ask: true
  ssh/user_environment_tell: 
* ssh/forward_warning: 
  ssh/insecure_telnetd: 
  ssh/new_config: true
* ssh/use_old_init_script: true
* ssh/SUID_client: true
* ssh/privsep_tell: 
  ssh/ssh2_keys_merged: 
* ssh/protocol2_only: true
  ssh/encrypted_host_key_but_no_keygen: 
* ssh/run_sshd: true