Non-interactive sessions broken when groups config option is used and motd printed

[mldailey]

Summary

The patch in pull #205 fixed the motd display for interactive sessions, but breaks non-interactive sessions like sftp

Steps to reproduce

1. Set up login_duo.conf with both the "groups" config and "motd = yes"
2. Log in via sftp as a user who is not in the specified group(s) - sftp fails with "Received message too long"

Specs

• OS version (ie CENTOS 7 or Ubuntu 14): Ubuntu 18.04
• OS arch (ie 32 or 64): 64
• Using pam_duo or login_duo: login_duo

Cause

This is caused because the motd prints regardless of whether the session is interactive or non-interactive. The test for this and setting of the "headless" variable is later in duo_auth(). It seems the best fix is to do the detection and setting of this variable earlier.

I have done minimal testing of the patch below and it appears to fix the issue for me. It would be great, though, to have someone that knows the code better make sure this won't break something else.

Patch

--- login_duo.c.orig	2021-10-14 13:34:13.015691416 -0400
+++ login_duo.c	2021-10-14 13:51:10.788484756 -0400
@@ -195,6 +195,13 @@
 #endif

     prompts = cfg.prompts;
+
+    /* Detect non-interactive sessions */
+    if ((p = getenv("SSH_ORIGINAL_COMMAND")) != NULL ||
+        !isatty(STDIN_FILENO)) {
+        headless = 1;
+    }
+
     /* Check group membership. */
     matched = duo_check_groups(pw, cfg.groups, cfg.groups_cnt);
     if (matched == -1) {
@@ -253,13 +260,11 @@
     }

     /* Special handling for non-interactive sessions */
-    if ((p = getenv("SSH_ORIGINAL_COMMAND")) != NULL ||
-        !isatty(STDIN_FILENO)) {
+    if (headless) {
         /* Try to support automatic one-shot login */
         duo_set_conv_funcs(duo, NULL, NULL, NULL);
         flags = (DUO_FLAG_SYNC|DUO_FLAG_AUTO);
         prompts = 1;
-        headless = 1;
     } else if (cfg.autopush) { /* Special handling for autopush */
         duo_set_conv_funcs(duo, NULL, __autopush_status_fn, NULL);
         flags = (DUO_FLAG_SYNC|DUO_FLAG_AUTO);

[vbscott]

Hi, thanks for the issue, would you be able to make this a pull request?