SSH_CONNECTION security issue is back

[yuhldr]

like #74

use aur howdy-beta-git, The same thing happened: "Face recognition on login via ssh #74"

[yuhldr]

Doesn't work https://github.com/boltgolt/howdy/blob/344eb342f7256154fa789cf93b5c0eff2c33c2e4/howdy/src/pam/main.cc#L151-L152

[saidsay-so]

It works, what program are you trying to authenticate?

[yuhldr]

It works, what program are you trying to authenticate?

in archlinux A,

• install aur howdy-beta-git,
• add auth sufficient /lib/security/pam_howdy.so try_first_pass nullok in /etc/pam.d/system-auth

then ssh A and sudo su via ssh , the face recognition is triggered. this is a big security issue.

maybe auth sufficient .. should be add other pam.d? but old version is work well.

[saidsay-so]

Thanks for your report, it indeed doesn't work on sudo while working with other programs. I created #903 to fix it.

[yuhldr]

Thanks for your report, it indeed doesn't work on sudo while working with other programs. I created #903 to fix it.

work well!