Skip to content

add back explicit termination of preauth child process #814

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: latestw_all
Choose a base branch
from
+12 −4
Open

add back explicit termination of preauth child process #814

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions regress/pesterTests/SSHD.Tests.ps1
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,8 +55,8 @@ Describe "E2E scenarios for sshd" -Tags "CI" {

# with a connection, there should be two additional session processes
$sshdPidsCountWithConn | Should Be (2 + $sshdPidCountBefore)
# after LoginGraceTime expires, one of the session processes should exit
$sshdPidsCountAfter | Should Be (1 + $sshdPidCountBefore)
# after LoginGraceTime expires, both session processes should exit
$sshdPidsCountAfter | Should Be $sshdPidCountBefore
}

It "sshd pre-auth process is spawned under runtime generated virtual account" {
Expand Down
12 changes: 10 additions & 2 deletions sshd-session.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -335,7 +335,7 @@ pack_config(struct sshbuf* conf)
static void
send_config_state(int fd, struct sshbuf* conf)
{
/* copied from send_rexec_state() in sshd.c
/* copied from send_rexec_state() in sshd.c
Copy link
Collaborator

@vthiebaut10 vthiebaut10 Nov 5, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this trailing space from upstream? I would leave it unchanged if that is the case just to reduce discrepancies

On Windows, uses pack_hostkeys_for_child() and pack_config() */
struct sshbuf* keys;
u_int mlen;
Expand Down Expand Up @@ -542,7 +542,15 @@ privsep_child_cmdline()
static void
grace_alarm_handler(int sig)
{
#ifndef WINDOWS
#ifdef WINDOWS
/*
* continue to use explicit kill on the child process ID
* Windows does not currently support authorized keys
* command helpers, so this is sufficient
*/
if (pmonitor != NULL && pmonitor->m_pid > 0)
kill(pmonitor->m_pid, SIGALRM);
#else
/*
* Try to kill any processes that we have spawned, E.g. authorized
* keys command helpers or privsep children.
Expand Down