Bug#314289: strace
There you go. Starts right after reading my password:
22815 <... read resumed> "\6", 14) = 1
22813 <... write resumed> ) = 13
22815 read(7, <unfinished ...>
22813 read(6, <unfinished ...>
22815 <... read resumed> "\0\0\0\tmvemjsu6p", 13) = 13
22815 open("/etc/passwd", O_RDONLY) = 8
22815 fcntl64(8, F_GETFD) = 0
22815 fcntl64(8, F_SETFD, FD_CLOEXEC) = 0
22815 _llseek(8, 0, [0], SEEK_CUR) = 0
22815 fstat64(8, {st_mode=S_IFREG|0644, st_size=2759, ...}) = 0
22815 mmap2(NULL, 2759, PROT_READ, MAP_SHARED, 8, 0) = 0xb7fe8000
22815 _llseek(8, 2759, [2759], SEEK_SET) = 0
22815 munmap(0xb7fe8000, 2759) = 0
22815 close(8) = 0
22815 open("/etc/shadow", O_RDONLY) = 8
22815 fcntl64(8, F_GETFD) = 0
22815 fcntl64(8, F_SETFD, FD_CLOEXEC) = 0
22815 _llseek(8, 0, [0], SEEK_CUR) = 0
22815 fstat64(8, {st_mode=S_IFREG|0640, st_size=2087, ...}) = 0
22815 mmap2(NULL, 2087, PROT_READ, MAP_SHARED, 8, 0) = 0xb7fe8000
22815 _llseek(8, 2087, [2087], SEEK_SET) = 0
22815 munmap(0xb7fe8000, 2087) = 0
22815 close(8) = 0
22815 getuid32() = 0
22815 open("/etc/passwd", O_RDONLY) = 8
22815 fcntl64(8, F_GETFD) = 0
22815 fcntl64(8, F_SETFD, FD_CLOEXEC) = 0
22815 _llseek(8, 0, [0], SEEK_CUR) = 0
22815 fstat64(8, {st_mode=S_IFREG|0644, st_size=2759, ...}) = 0
22815 mmap2(NULL, 2759, PROT_READ, MAP_SHARED, 8, 0) = 0xb7fe8000
22815 _llseek(8, 2759, [2759], SEEK_SET) = 0
22815 munmap(0xb7fe8000, 2759) = 0
22815 close(8) = 0
22815 open("/etc/shadow", O_RDONLY) = 8
22815 fcntl64(8, F_GETFD) = 0
22815 fcntl64(8, F_SETFD, FD_CLOEXEC) = 0
22815 _llseek(8, 0, [0], SEEK_CUR) = 0
22815 fstat64(8, {st_mode=S_IFREG|0640, st_size=2087, ...}) = 0
22815 mmap2(NULL, 2087, PROT_READ, MAP_SHARED, 8, 0) = 0xb7fe8000
22815 _llseek(8, 2087, [2087], SEEK_SET) = 0
22815 munmap(0xb7fe8000, 2087) = 0
22815 close(8) = 0
22815 time(NULL) = 1120636582
22815 write(7, "\0\0\0\27\0", 5 <unfinished ...>
22813 <... read resumed> "\0\0\0\27", 4) = 4
22815 <... write resumed> ) = 5
22813 read(6, <unfinished ...>
22815 write(7, "\0\0\0\2OK\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0", 22 <unfinished ...>
22813 <... read resumed> "\0", 23) = 1
22815 <... write resumed> ) = 22
22813 read(6, <unfinished ...>
22815 exit_group(0) = ?
22813 <... read resumed> "\0\0\0\2OK\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0", 22) = 22
22813 --- SIGCHLD (Child exited) @ 0 (0) ---
22813 rt_sigaction(SIGCHLD, NULL, {0x8064a10, [], 0}, 8) = 0
22813 rt_sigaction(SIGCHLD, {SIG_DFL}, NULL, 8) = 0
22813 waitpid(22815, [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], WNOHANG) = 22815
22813 sigreturn() = ? (mask now [])
22813 write(3, "\366\336T\326Ar\313\n1\253\244Vm\224\245\201t\217\5\233a\325aE\255\203\323\340\221\305P\321\24\271\316\36\311u\347\vxJ\302\312\342\367|op{\25F", 52) = 52
22813 select(4, [3], NULL, NULL, NULL) = 1 (in [3])
22813 read(3, "G\203\377ISkOUNh@\214w$\347\316\275\337\212+#w\264u\300y<\21\322\250\267(ji\260\',8\257+\242F\354\245\212\364\337\300\323\330pR^\260S0\322r\303\251MVCM$\3729\321\"0aJP\37\225\216\335~\336L\335\36\n9w\22\356\2137\367\263?\7Cs\16\365v\366\2\325\301\243\36+Y\"\200\276\325L\304\244\261\330\1T\35O\3668\327\307xS/$\34L\225\211\251:\37\244\361\342\372U4\27\362\276-(\265\277\272>\"C\313\344\351\32e42\35*\223\340$38\f\213eh\210}\7C\272\327\333\315O|\224t\25%&\355a].\216\254)\f\26Z\3242\252\372\347\21\243\302\373\22Q\365!\3#q|\243\272.W\1\230\364[~\375?\1\22\37\202\340\311\20\365\352\265\306`\302\330=\34\364\302e\256\20\'\222\35\241\217\223\373\212q\37\30\331\216\354fa=\272\242W\3448\303Y\366\206\35\0040\267\300\247\341", 8192) = 276
22813 rt_sigaction(SIGCHLD, NULL, {SIG_DFL}, 8) = 0
22813 kill(22815, SIGTERM) = -1 ESRCH (No such process)
22813 close(6) = 0
22813 close(7) = 0
22813 time([1120636582]) = 1120636582
22813 getpid() = 22813
22813 rt_sigaction(SIGPIPE, {0xb7de6a70, [], 0}, {SIG_IGN}, 8) = 0
22813 send(4, "<38>Jul 6 09:56:22 sshd[22813]: Accepted keyboard-interactive/pam for schwindt from 193.196.182.171 port 1246 ssh2", 115, 0) = 115
22813 rt_sigaction(SIGPIPE, {SIG_IGN}, NULL, 8) = 0
22813 close(4) = 0
22813 write(3, "\373}\212\350\225m\251\323@\6\212\276HJ-\317\200\363\253\206\25..\357(\311\232\371V\252W\340]\344z\327", 36) = 36
22813 alarm(0) = 590
22813 close(5) = 0
22810 <... select resumed> ) = 1 (in [5])
22813 rt_sigaction(SIGCHLD, NULL, <unfinished ...>
22810 close(5 <unfinished ...>
22813 <... rt_sigaction resumed> {SIG_DFL}, 8) = 0
22810 <... close resumed> ) = 0
22813 rt_sigaction(SIGCHLD, {0x8053620, [], 0}, <unfinished ...>
22810 select(6, [3], NULL, NULL, NULL <unfinished ...>
22813 <... rt_sigaction resumed> NULL, 8) = 0
22813 pipe([4, 5]) = 0
22813 fcntl64(4, F_SETFD, FD_CLOEXEC) = 0
22813 fcntl64(5, F_SETFD, FD_CLOEXEC) = 0
22813 fcntl64(4, F_GETFL) = 0 (flags O_RDONLY)
22813 fcntl64(4, F_SETFL, O_RDONLY|O_NONBLOCK) = 0
22813 fcntl64(5, F_GETFL) = 0x1 (flags O_WRONLY)
22813 fcntl64(5, F_SETFL, O_WRONLY|O_NONBLOCK) = 0
22813 select(5, [3 4], [], NULL, NULL) = 1 (in [3])
22813 rt_sigprocmask(SIG_BLOCK, [CHLD], [], 8) = 0
22813 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
22813 read(3, "\10v\211\27\331)\211\217f\376\243.\357\21\220qx\252Y\0b\24\231F\33\267\3529Z\257\177\242\5\327\270\270\267\214h\214\336\301cj\37\0059\261\237\256\355\241\16kT\353\344\333\216\177g\341 I\31\245\27\323", 16384) = 68
22813 ioctl(-1, SNDCTL_TMR_TIMEBASE or TCGETS, 0xbfffe3a8) = -1 EBADF (Bad file descriptor)
22813 ioctl(-1, SNDCTL_TMR_TIMEBASE or TCGETS, 0xbfffe3a8) = -1 EBADF (Bad file descriptor)
22813 select(5, [3 4], [3], NULL, NULL) = 1 (out [3])
22813 rt_sigprocmask(SIG_BLOCK, [CHLD], [], 8) = 0
22813 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
22813 write(3, "k\262\274C\366\357D\250\311IZ\34\'\305C\204&\355\225\222\377_\5N\3624\177\220!\356\217\324\262Q\321q\262O\2260\224L\7\10\20\352U\301J\273\35\222", 52) = 52
22813 select(5, [3 4], [], NULL, NULL) = 1 (in [3])
22813 rt_sigprocmask(SIG_BLOCK, [CHLD], [], 8) = 0
22813 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
22813 read(3, "\200\25\331\254\374J\3214\2^\302\350&\221\25\222\205\4ji\342\230\240<\365 \374\25\0377\220r\213\214\235\370\306\34\213W\272\362\307T~\rn8\326;\320\264q\232\2172j\327\227\211\342|\\\37o<*\'\300l\233-t^\201\17\240\374L\33\35\234\2v\337\344V\355\337\3236)\265\332C\371ch\253\262", 16384) = 100
22813 open("/dev/ptmx", O_RDWR) = 6
22813 statfs("/dev/pts", {f_type="DEVPTS_SUPER_MAGIC", f_bsize=4096, f_blocks=0, f_bfree=0, f_bavail=0, f_files=0, f_ffree=0, f_fsid={0, 0}, f_namelen=255, f_frsize=4096}) = 0
22813 ioctl(6, SNDCTL_TMR_TIMEBASE or TCGETS, {B38400 opost isig icanon echo ...}) = 0
22813 ioctl(6, TIOCGPTN, [12]) = 0
22813 stat64("/dev/pts/12", {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 12), ...}) = 0
22813 statfs("/dev/pts/12", {f_type="DEVPTS_SUPER_MAGIC", f_bsize=4096, f_blocks=0, f_bfree=0, f_bavail=0, f_files=0, f_ffree=0, f_fsid={0, 0}, f_namelen=255, f_frsize=4096}) = 0
22813 ioctl(6, TIOCSPTLCK, [0]) = 0
22813 ioctl(6, SNDCTL_TMR_TIMEBASE or TCGETS, {B38400 opost isig icanon echo ...}) = 0
22813 ioctl(6, TIOCGPTN, [12]) = 0
22813 stat64("/dev/pts/12", {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 12), ...}) = 0
22813 open("/dev/pts/12", O_RDWR|O_NOCTTY) = 7
22813 ioctl(7, SNDCTL_TMR_TIMEBASE or TCGETS, {B38400 opost isig icanon echo ...}) = 0
22813 readlink("/proc/self/fd/7", "/dev/pts/12", 4095) = 11
22813 ioctl(7, SNDCTL_TMR_TIMEBASE or TCGETS, {B38400 opost isig icanon echo ...}) = 0
22813 ioctl(7, SNDCTL_TMR_TIMEBASE or TCGETS, {B38400 opost isig icanon echo ...}) = 0
22813 ioctl(7, SNDCTL_TMR_START or TCSETS, {B38400 opost isig icanon echo ...}) = 0
22813 ioctl(7, SNDCTL_TMR_TIMEBASE or TCGETS, {B38400 opost isig icanon echo ...}) = 0
22813 open("/etc/group", O_RDONLY) = 8
22813 fcntl64(8, F_GETFD) = 0
22813 fcntl64(8, F_SETFD, FD_CLOEXEC) = 0
22813 _llseek(8, 0, [0], SEEK_CUR) = 0
22813 fstat64(8, {st_mode=S_IFREG|0644, st_size=1015, ...}) = 0
22813 mmap2(NULL, 1015, PROT_READ, MAP_SHARED, 8, 0) = 0xb7cde000
22813 _llseek(8, 1015, [1015], SEEK_SET) = 0
22813 munmap(0xb7cde000, 1015) = 0
22813 close(8) = 0
22813 stat64("/dev/pts/12", {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 12), ...}) = 0
22813 open("/proc/filesystems", O_RDONLY|O_LARGEFILE) = 8
22813 read(8, "nodev\tsysfs\nnodev\trootfs\nnodev\tbdev\nnodev\tproc\nnodev\tsockfs\nnodev\tpipefs\nnodev\tfutexfs\nnodev\ttmpfs\nnodev\teventpollfs\nnodev\tdevpts\n\text3\n\text2\nnodev\tramfs\nnodev\tautofs\nnodev\tusbfs\nnodev\trpc_pipefs\nnodev\tnfs\n\tvfat\n\tiso9660\n", 4095) = 221
22813 close(8) = 0
22813 chown32("/dev/pts/12", 1000, 5) = 0
22813 ioctl(6, TIOCSWINSZ, {ws_row=24, ws_col=80, ws_xpixel=0, ws_ypixel=0}) = 0
22813 select(5, [3 4], [3], NULL, NULL) = 1 (out [3])
22813 rt_sigprocmask(SIG_BLOCK, [CHLD], [], 8) = 0
22813 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
22813 write(3, "\374B\377\t\25T\'\211\301\1\'d7~\210\7J\360\261@~\353\3\363\371;\345@\3029\206:\270q6\235", 36) = 36
22813 select(5, [3 4], [], NULL, NULL) = 1 (in [3])
22813 rt_sigprocmask(SIG_BLOCK, [CHLD], [], 8) = 0
22813 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
22813 read(3, "!\341\254\317h>\327\216\224\202\350:<\6\0\326\324Igc\344\226\220>\317P]\220j\24D\254\211\22\230G\331P{\354)\302{\215w<\237\211\236\17\263\274", 16384) = 52
22813 open("/etc/security/pam_env.conf", O_RDONLY) = 8
22813 fstat64(8, {st_mode=S_IFREG|0644, st_size=3101, ...}) = 0
22813 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7cde000
22813 read(8, "# $Date: 2002/09/21 18:37:34 $\n# $Author: hartmans $\n# $Id: pam_env.conf-example,v 1.4 2002/09/21 18:37:34 hartmans Exp $\n#\n# This is the configuration file for pam_env, a PAM module to load in \n# a configurable list of environment variables for a \n# \n# The original idea for this came from Andrew G. Morgan ...\n#<quote>\n# Mmm. Perhaps you might like to write a pam_env module that reads a\n# default environment from a file? I can see that as REALLY\n# useful... Note it would be an \"auth\" module that returns PAM_IGNORE\n# for the auth part and sets the environment returning PAM_SUCCESS in\n# the setcred function...\n#</quote>\n#\n# What I wanted was the REMOTEHOST variable set, purely for selfish\n# reasons, and AGM didn\'t want it added to the SimpleApps login\n# program (which is where I added the patch). So, my first concern is\n# that variable, from there there are numerous others that might/would\n# be useful to be set: NNTPSERVER, LESS, PATH, PAGER, MANPAGER .....\n#\n# Of course, these are a different kind of"..., 4096) = 3101
22813 read(8, "", 4096) = 0
22813 close(8) = 0
22813 munmap(0xb7cde000, 4096) = 0
22813 open("/etc/environment", O_RDONLY) = 8
22813 fstat64(8, {st_mode=S_IFREG|0644, st_size=12, ...}) = 0
22813 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7cde000
22813 read(8, "\nLANG=de_DE\n", 4096) = 12
22813 read(8, "", 4096) = 0
22813 close(8) = 0
22813 munmap(0xb7cde000, 4096) = 0
22813 time([1120636582]) = 1120636582
22813 getpid() = 22813
22813 rt_sigaction(SIGPIPE, {0xb7de6a70, [], 0}, {SIG_IGN}, 8) = 0
22813 socket(PF_FILE, SOCK_DGRAM, 0) = 8
22813 fcntl64(8, F_SETFD, FD_CLOEXEC) = 0
22813 connect(8, {sa_family=AF_FILE, path="/dev/log"}, 16) = 0
22813 send(8, "<34>Jul 6 09:56:22 sshd[22813]: fatal: PAM: pam_setcred(): Permission denied", 77, 0) = 77
22813 rt_sigaction(SIGPIPE, {SIG_IGN}, NULL, 8) = 0
22813 close(8) = 0
22813 munmap(0xb7fe4000, 14548) = 0
22813 munmap(0xb7cdf000, 93032) = 0
22813 munmap(0xb7fe2000, 7384) = 0
22813 munmap(0xb7fdf000, 12128) = 0
22813 munmap(0xb7fdb000, 15600) = 0
22813 munmap(0xb7ccb000, 14676) = 0
22813 getuid32() = 0
22813 chown32("/dev/pts/12", 0, 0) = 0
22813 chmod("/dev/pts/12", 0666) = 0
22813 close(0) = 0
22813 exit_group(255) = ?
22810 <... select resumed> ) = ? ERESTARTNOHAND (To be restarted)
22810 --- SIGCHLD (Child exited) @ 0 (0) ---
22810 waitpid(-1, [{WIFEXITED(s) && WEXITSTATUS(s) == 255}], WNOHANG) = 22813
22810 waitpid(-1, 0xbfffe450, WNOHANG) = -1 ECHILD (No child processes)
22810 rt_sigaction(SIGCHLD, NULL, {0x804cab0, [], 0}, 8) = 0
22810 sigreturn() = ? (mask now [])
22810 select(6, [3], NULL, NULL, NULL) = ? ERESTARTNOHAND (To be restarted)
22810 --- SIGINT (Interrupt) @ 0 (0) ---
22810 +++ killed by SIGINT +++
Reply to: