bin/60578: pam_ssh fails to use ssh-agent

["mlelstv%netbsd.org@localhost via gnats" <gnats-admin%NetBSD.org@localhost>]

>Number:         60578
>Category:       bin
>Synopsis:       pam_ssh fails to use ssh-agent
>Confidential:   no
>Severity:       critical
>Priority:       low
>Responsible:    bin-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Thu Aug 13 13:05:00 +0000 2026
>Originator:     Michael van Elst
>Release:        NetBSD 11.99.7
>Organization:
	
>Environment:
	
	
System: NetBSD arnold 11.99.7 NetBSD 11.99.7 (EGGHED64) #6: Wed Aug 5 06:50:55 UTC 2026 mlelstv@slowpoke:/home/netbsd-current/obj.evbarm64-el/scratch/netbsd-current/src/sys/arch/evbarm/compile/EGGHED64 evbarm
Architecture: any
Machine: any
>Description:
The pam_ssh module can be used to automatically launch an ssh-agent
and enable ssh keys. This fails for openssh 10.x.

In netbsd-10 (openssh 9.6) the output of 'ssh-agent -s' looks like:

SSH_AUTH_SOCK=/tmp/ssh-xxxxxxxxxxxx/agent.nnnn; export SSH_AUTH_SOCK;
SSH_AGENT_PID=nnnnn; export SSH_AGENT_PID;

In netbsd-11 and HEAD (openssh 10.3) the output looks like:

export SSH_AUTH_SOCK=/home/mlelstv/.ssh/agent/s.xxxxxxxxxx.agent.xxxxxxxxxx;
export SSH_AGENT_PID=nnnn;


The pam_ssh module recognizes only lines that start with 'SSH_' to pass them
into the environment.

static void
pam_ssh_process_agent_output(pam_handle_t *pamh, FILE *f)
...
        while ((line = fgetln(f, &len)) != NULL) {
                if (len < 4 || strncmp(line, "SSH_", 4) != 0)
                        continue;

The agent isn't terminated either when the PAM session closes as its
PID is learned again from the environment.


>How-To-Repeat:
Uncomment pam_ssh in /etc/pam.d/display_manager.
Watch ssh-agent running, but no environment is set to talk to it.

See also:

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=285043


>Fix:
Improve the parser in lib/libpam/modules/pam_ssh/pam_ssh.c

>Unformatted: