<html><head></head><body><div style="color:#000; background-color:#fff; font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:16px"><div id="yui_3_16_0_ym19_1_1487627542459_6410">Hi,</div><div id="yui_3_16_0_ym19_1_1487627542459_6444"><br></div><div id="yui_3_16_0_ym19_1_1487627542459_6445">I would like to determine if authentication on sshd is done with key or with password, and then run some other modules based on this.</div><div id="yui_3_16_0_ym19_1_1487627542459_6446"><br></div><div id="yui_3_16_0_ym19_1_1487627542459_6447">This is not straightforward because sshd does not use PAM to do key authentication, but it can use PAM for password authentication (if appropriately configured).</div><div id="yui_3_16_0_ym19_1_1487627542459_6447"><br></div><div id="yui_3_16_0_ym19_1_1487627542459_6447">So my idea was: I put a pam_env somewhere in the PAM file, if I then find the variable it means authentication was by password.</div><div id="yui_3_16_0_ym19_1_1487627542459_6447" dir="ltr">It turned out things are a little bit more complicated, because sshd always uses PAM, at least in part. From what I understand sshd works like this:</div><div id="yui_3_16_0_ym19_1_1487627542459_6447" dir="ltr">1. PAM account;<br></div><div id="yui_3_16_0_ym19_1_1487627542459_6447" dir="ltr">2a. key authentication without PAM;</div><div id="yui_3_16_0_ym19_1_1487627542459_6447" dir="ltr">2b. PAM auth (pam_authenticate) if authentication was not done with key;</div><div id="yui_3_16_0_ym19_1_1487627542459_6447" dir="ltr">3. PAM auth (pam_setcred) - in any case, also when authentication was by key;</div><div id="yui_3_16_0_ym19_1_1487627542459_6447" dir="ltr">4. PAM open session;</div><div id="yui_3_16_0_ym19_1_1487627542459_6447" dir="ltr">5. PAM auth (pam_setcred) - it is not clear to me why pam_setcred is called again.</div><div id="yui_3_16_0_ym19_1_1487627542459_6447" dir="ltr"><br></div><div id="yui_3_16_0_ym19_1_1487627542459_6447" dir="ltr">The new idea is to put a pam_env in the auth section, and check the variable in a pam_exec module in the session section (because there I am sure that authentication was successful).</div><div id="yui_3_16_0_ym19_1_1487627542459_6447" dir="ltr"><br></div><div id="yui_3_16_0_ym19_1_1487627542459_6447" dir="ltr">The last obstacle is that pam_env runs only on pam_setcred and not on pam_authenticate, so I'm thinking about patching pam_env to have it work on pam_authenticate instead, if a specific parameter is passed.</div><div id="yui_3_16_0_ym19_1_1487627542459_6447" dir="ltr"><br></div><div id="yui_3_16_0_ym19_1_1487627542459_6447" dir="ltr">What do you think? Does it make any sense? Do you see a different/better/easier option?</div><div id="yui_3_16_0_ym19_1_1487627542459_6447" dir="ltr"><br></div><div id="yui_3_16_0_ym19_1_1487627542459_6447" dir="ltr">Thank you</div><div id="yui_3_16_0_ym19_1_1487627542459_6447" dir="ltr">Kind regards</div><div id="yui_3_16_0_ym19_1_1487627542459_6447" dir="ltr">Guido</div></div></body></html>