Sewhoami Reports All Users As root Due to sshd-session Binary Change

Products

• CA Privileged Access Manager (PAM)

Issue/Introduction

After logging in as a standard user, the user is incorrectly identified as root when running the sewhoami command. This prevents the correct application of user-specific policies and may allow the user to use sesu without a password if UseInvokerPassword is enabled.

Environment

The issue will occur with any PAMSC build prior to 14.10.80.59 running on RHEL 9.8 and above

Cause

As of OpenSSH 9.8, the sshd daemon is split into a listener binary (sshd) and a per-session binary (sshd-session). Because the session handling has moved to a different binary path, the default LOGINAPPL rules for sshd no longer match the active session process, causing PAMSC to default the user identity to root.

Resolution

The issue has been fixed in the 14.10.80.59 build of PAMSC, which can be downloaded from the PAMSC Compatibility Matrix

If an upgrade is not possible at this time, create a new LOGINAPPL resource for the sshd-session binary using the following selang command. This example is for RHEL 9.8, the path varies by operating system.

PAMSC> newres LOGINAPPL SSH-SESS loginpath(/usr/libexec/openssh/sshd-session) defaccess(x)