Skip to content

Fix PAM Auth for exec sessions with allocated TTY#61690

Merged
Joerger merged 1 commit intomasterfrom
joerger/fix-pam-auth-interactive-exec
Dec 3, 2025
Merged

Fix PAM Auth for exec sessions with allocated TTY#61690
Joerger merged 1 commit intomasterfrom
joerger/fix-pam-auth-interactive-exec

Conversation

@Joerger
Copy link
Copy Markdown
Contributor

@Joerger Joerger commented Nov 21, 2025

Changelog: Fix an issue in the Teleport SSH Service where interactive PAM Auth modules always fail when trying to run exec sessions with tty allocated. e.g. tsh ssh --tty <node> ls.

Fixes #61689

Manual Testing (8cd5232):

  • Set up a custom interactive PAM auth module as described in PAM Auth with interactive input is broken. #49028.
  • tsh ssh --tty <node> ls prompts for authentication and succeeds.
  • tsh ssh <node> prompts for authentication and succeeds.
  • Starting an interactive session in the WebUI prompts for authentication and succeeds.

Note: tsh ssh <node> ls without -tty and with interactive PAM auth fails both before and after this PR, as expected. Unfortunately, this failure manifests as a stalled connection which eventually times out or is canceled by the user, and it's unclear whether this is improvable within this boundaries of PAM. Either way, that issue is out of scope of this PR.

@rosstimothy
Copy link
Copy Markdown
Contributor

@Joerger can we also cover that tsh ssh <node> ls and the Web UI still behave as expected in the test plan?

@Joerger Joerger force-pushed the joerger/fix-pam-auth-interactive-exec branch from 26b86c4 to 8cd5232 Compare November 25, 2025 00:37
@Joerger Joerger requested a review from rosstimothy November 25, 2025 00:37
@Joerger
Copy link
Copy Markdown
Contributor Author

Joerger commented Nov 25, 2025

@Joerger can we also cover that tsh ssh <node> ls and the Web UI still behave as expected in the test plan?

Added a manual test for the WebUI. tsh ssh ls without --tty is not expected to work currently, so I just added a note in the PR description.

@rosstimothy
Copy link
Copy Markdown
Contributor

Note: tsh ssh <node> ls without -tty and with interactive PAM auth fails both before and after this PR, as expected. Unfortunately, this failure manifests as a stalled connection which eventually times out or is canceled by the user, and it's unclear whether this is improvable within this boundaries of PAM. Either way, that issue is out of scope of this PR.

Do we have an open issue for this? Should we create one if not?

@Joerger
Copy link
Copy Markdown
Contributor Author

Joerger commented Dec 3, 2025

@eriktate Friendly ping to review

@public-teleport-github-review-bot public-teleport-github-review-bot bot removed the request for review from vapopov December 3, 2025 19:21
@Joerger Joerger added this pull request to the merge queue Dec 3, 2025
Merged via the queue into master with commit 1d7d8d3 Dec 3, 2025
44 checks passed
@Joerger Joerger deleted the joerger/fix-pam-auth-interactive-exec branch December 3, 2025 20:10
Joerger added a commit that referenced this pull request Dec 8, 2025
Joerger added a commit that referenced this pull request Dec 8, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

PAM Auth is broken for exec sessions with allocated TTY

3 participants