# PAM bad jump in stack after pam_ssh_agent_auth successful

## kess-net

Hi guys,

I would be glad if someone could lead me to success. I am trying to use ssh-agent forwarding to sudo (root).

I followed https://wiki.gentoo.org/wiki/Pam_ssh_agent_auth. ssh-agent is running. SSH_AUTH_SOCK is set an in my environment. my key is loaded. But I am still asked for my login password.

With debug option the log file states:

```
May 16 15:43:09 host sudo[11758]: pam_ssh_agent_auth: Beginning pam_ssh_agent_auth for user myself

May 16 15:43:09 host sudo[11758]: pam_ssh_agent_auth: Attempting authentication: `myself' as `myself' using /etc/ssh/sudo_authorized_key

May 16 15:43:09 host sudo[11758]: pam_ssh_agent_auth: Contacted ssh-agent of myself myself (1000)

May 16 15:43:09 host sudo[11758]: pam_ssh_agent_auth: trying public key file /etc/ssh/sudo_authorized_key

May 16 15:43:09 host sudo[11758]: pam_ssh_agent_auth: auth_secure_filename: checking for uid: 0

May 16 15:43:09 host sudo[11758]: pam_ssh_agent_auth: secure_filename: checking '/etc/ssh'

May 16 15:43:09 host sudo[11758]: pam_ssh_agent_auth: secure_filename: checking '/etc'

May 16 15:43:09 host sudo[11758]: pam_ssh_agent_auth: secure_filename: checking '/'

May 16 15:43:09 host sudo[11758]: pam_ssh_agent_auth: matching key found: file/command /etc/ssh/sudo_authorized_key, line 1

May 16 15:43:09 host sudo[11758]: pam_ssh_agent_auth: Found matching RSA key: 43:40:bc:73:91:72:e6:96:5d:b4:24:6d:d1:fb:f3:77

May 16 15:43:09 host sudo[11758]: pam_ssh_agent_auth: ssh_rsa_verify: signature correct

May 16 15:43:09 host sudo[11758]: pam_ssh_agent_auth: Authenticated: `myself' as `myself' using /etc/ssh/sudo_authorized_key

May 16 15:43:09 host sudo[11758]: PAM bad jump in stack

May 16 15:43:09 host sudo[11758]: pam_ssh_agent_auth: Beginning pam_ssh_agent_auth for user myself

May 16 15:43:09 host sudo[11758]: pam_ssh_agent_auth: Attempting authentication: `myself' as `myself' using /etc/ssh/sudo_authorized_key

May 16 15:43:09 host sudo[11758]: pam_ssh_agent_auth: Contacted ssh-agent of user myself (1000)

May 16 15:43:09 host sudo[11758]: pam_ssh_agent_auth: trying public key file /etc/ssh/sudo_authorized_key

May 16 15:43:09 host sudo[11758]: pam_ssh_agent_auth: auth_secure_filename: checking for uid: 0

May 16 15:43:09 host sudo[11758]: pam_ssh_agent_auth: secure_filename: checking '/etc/ssh'

May 16 15:43:09 host sudo[11758]: pam_ssh_agent_auth: secure_filename: checking '/etc'

May 16 15:43:09 host sudo[11758]: pam_ssh_agent_auth: secure_filename: checking '/'

May 16 15:43:09 host sudo[11758]: pam_ssh_agent_auth: matching key found: file/command /etc/ssh/sudo_authorized_key, line 1

May 16 15:43:09 host sudo[11758]: pam_ssh_agent_auth: Found matching RSA key: 43:40:bc:73:91:72:e6:96:5d:b4:24:6d:d1:fb:f3:77

May 16 15:43:09 host sudo[11758]: pam_ssh_agent_auth: ssh_rsa_verify: signature correct

May 16 15:43:09 host sudo[11758]: pam_ssh_agent_auth: Authenticated: `myself' as `myself' using /etc/ssh/sudo_authorized_key

May 16 15:43:09 host sudo[11758]: PAM bad jump in stack

May 16 15:43:09 host sudo[11758]: pam_ssh_agent_auth: Beginning pam_ssh_agent_auth for user myself

May 16 15:43:09 host sudo[11758]: pam_ssh_agent_auth: Attempting authentication: `myself' as `myself' using /etc/ssh/sudo_authorized_key

May 16 15:43:09 host sudo[11758]: pam_ssh_agent_auth: Contacted ssh-agent of user myself (1000)

May 16 15:43:09 host sudo[11758]: pam_ssh_agent_auth: trying public key file /etc/ssh/sudo_authorized_key

May 16 15:43:09 host sudo[11758]: pam_ssh_agent_auth: auth_secure_filename: checking for uid: 0

May 16 15:43:09 host sudo[11758]: pam_ssh_agent_auth: secure_filename: checking '/etc/ssh'

May 16 15:43:09 host sudo[11758]: pam_ssh_agent_auth: secure_filename: checking '/etc'

May 16 15:43:09 host sudo[11758]: pam_ssh_agent_auth: secure_filename: checking '/'

May 16 15:43:09 host sudo[11758]: pam_ssh_agent_auth: matching key found: file/command /etc/ssh/sudo_authorized_key, line 1

May 16 15:43:09 host sudo[11758]: pam_ssh_agent_auth: Found matching RSA key: 43:40:bc:73:91:72:e6:96:5d:b4:24:6d:d1:fb:f3:77

May 16 15:43:09 host sudo[11758]: pam_ssh_agent_auth: ssh_rsa_verify: signature correct

May 16 15:43:09 host sudo[11758]: pam_ssh_agent_auth: Authenticated: `myself' as `myself' using /etc/ssh/sudo_authorized_key

May 16 15:43:09 host sudo[11758]: PAM bad jump in stack

May 16 15:43:09 host sudo[11758]:     myself : 3 incorrect password attempts ; TTY=pts/1 ; PWD=/home/myself ; user=root ; COMMAND=/bin/su -

```

Thank you in advance.

 kess

[Moderator edit: added [code] tags to preserve output layout; fixed link to Wiki page. -Hu]

----------

## Hu

That message seems to come from only one place in PAM:

```
       /* this case is a syntax error: we can't succeed */

       if (action) {

      pam_syslog(pamh, LOG_ERR, "bad jump in stack");
```

Since the comment says syntax error, I think we need to see how you configured PAM for this.  Please post the output of cat -n on each of the PAM files you modified for this.

----------

## kess-net

Thank you for your response.

I modified just one pam file;

```
$ cat  /etc/pam.d/sudo

# File autogenerated by pamd_mimic in pam eclass

#auth /lib64/security/pam_ssh_agent_auth.so  file=/etc/ssh/sudo_authorized_key

auth [success=3 default=ignore] pam_ssh_agent_auth.so file=/etc/ssh/sudo_authorized_key debug

auth    substack                system-auth

account substack                system-auth

session substack                system-auth
```

sudo_authorized_key is no mistake. This file is named that way.

```
$ ls -l /etc/ssh/sudo_authorized_key

-rw-r--r-- 1 root root 738 14. Mai 14:52 /etc/ssh/sudo_authorized_key
```

Of course I also edited /etc/sudoers.

----------

## Hu

The Wiki uses include, not substack, for the remaining lines.  If you use include, does it work?  What is in the referenced file?  Perhaps the syntax error is there, not in the file you modified.

----------

## kess-net

Unfortunately nothing changes when I use include instead of substack. 

The referneced file is containing my public key: 

```

ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDHsd9m0N3e6Z1A4ypTezSJ8g6eynOx5OtsmdfCYoTAxr8TMo2VbuDQ81Wqh4FC5yf/EUeMYRGzGuRqQrPPYu0tbDTXU3/hrktr2RLdKGlCio99Y6RUxPSIurTcj+qMYPIFbwVwH3bUWuTC7h84dIfblFihvjooUZ55n7BvyF1VrzsdtqrbnelDvB2548xZF8Eor5VDAPsCeB2MeYlkYkEK6UkMfm57nrI72/VjYeEu/QA86OPkmKn9DtjFtUJeJkGEiAgg3f7V0ZhFH6nsFkVYE6FKd6DJV0dROvuqfvzf2j4erQVBd8iRmZ3+oGtAD6RV8u10Bxcrt9bfNNXFHDc0ZIJLbdPFIKDK2ZPoJvxP1OL9fQNQGlG/K2fnMIy9wZoI6a4UYHr4CDYGz3bpHGkGKrXBb0YSpnN7ZhqYVjmM/hKCdMGx/Jp7YWGYyJO3M90G2sME/K67Wte3Q05Emu8xFkKdygfG0jVuSdMjqg3Z0j/ucAiXT30RttxnhryQN98ppS1oxVw1jXqNpgjgiY2GtRdf+731XQ/NK3EhOC8fDxfYHSveSNLCwY0Fn7lFVCIlWPYc+gHh/uPiq5G6TreBBhucgNjIsYrhRXQvUoSXv1spGfP/0Ll+V9TvuZV85fQ/EzmyM23EI/6kqFu6jsG18Z3S7OCp3RSsPoH0Wd7zGw== myself@host

```

As I understand it the three remaining lines provide the usual password prompt for authentication if pam_ssh_agent_auth fails.

----------

## Hu

By referenced file, I meant the system-auth configuration, not the public key.  I admit it's a bit unlikely to be there, but the only other explanation I can see is that the Wiki's instructions are simply wrong.

----------

## Jimmy Jazz

why not use 'sufficient' if you don't want to walk through the stack/include file or success=1 ?

auth sufficient pam_ssh.so  ... debug       

or 

auth substack system-auth

auth requisite  pam_ssh.so  ... debug                                             

auth required   pam_permit.so    

and alike ?

 formatux has a nice table for the steps

----------

