session.c |   58 ++++++++++++++++++++++++++++++++++++++++++----------------
 1 file changed, 42 insertions(+), 16 deletions(-)
--- a/session.c
+++ b/session.c
@@ -454,6 +470,8 @@ do_authenticated1(Authctxt *authctxt)
 	}
 }
 
+void child_destroy_sensitive_data();
+
 #define USE_PIPES 1
 /*
  * This is called to fork and execute a command when we have no tty.  This
@@ -584,6 +602,7 @@ do_exec_no_pty(Session *s, const char *c
 		close(err[0]);
 #endif
 
+		child_destroy_sensitive_data();
 
 #ifdef _UNICOS
 		cray_init_job(s->pw); /* set up cray jid and tmpdir */
@@ -723,6 +742,9 @@ do_exec_pty(Session *s, const char *comm
 		/* Close the extra descriptor for the pseudo tty. */
 		close(ttyfd);
 
+		/* Do this early, so we will not block large MOTDs */
+		child_destroy_sensitive_data();
+
 		/* record login, etc. similar to login(1) */
 #ifndef HAVE_OSF_SIA
 		if (!(options.use_login && command == NULL)) {
@@ -1789,23 +1811,9 @@ child_close_fds(void)
 	closefrom(STDERR_FILENO + 1);
 }
 
-/*
- * Performs common processing for the child, such as setting up the
- * environment, closing extra file descriptors, setting the user and group
- * ids, and executing the command or shell.
- */
-#define ARGV_MAX 10
 void
-do_child(Session *s, const char *command)
+child_destroy_sensitive_data(void)
 {
-	extern char **environ;
-	char **env;
-	int env_size;
-	char *argv[ARGV_MAX];
-	const char *shell, *shell0, *hostname = NULL;
-	struct passwd *pw = s->pw;
-	int r = 0;
-
 #ifdef SSH_AUDIT_EVENTS
 	int pparent = paudit[1];
 	close(paudit[0]);
@@ -1817,7 +1825,7 @@ do_child(Session *s, const char *command
 	/* remove hostkey from the child's memory */
 	destroy_sensitive_data(use_privsep);
 	/*
-	 * We can audit this, because wer hacked the pipe to direct the
+	 * We can audit this, because we hacked the pipe to direct the
 	 * messages over postauth child. But this message requires answer
 	 * which we can't do using one-way pipe.
 	 */
@@ -1827,6 +1835,24 @@ do_child(Session *s, const char *command
 	/* Notify parent that we are done */
 	close(pparent);
 #endif
+}
+
+/*
+ * Performs common processing for the child, such as setting up the
+ * environment, closing extra file descriptors, setting the user and group
+ * ids, and executing the command or shell.
+ */
+#define ARGV_MAX 10
+void
+do_child(Session *s, const char *command)
+{
+	extern char **environ;
+	char **env;
+	int env_size;
+	char *argv[ARGV_MAX];
+	const char *shell, *shell0, *hostname = NULL;
+	struct passwd *pw = s->pw;
+	int r = 0;
 
 	/* Force a password change */
 	if (s->authctxt->force_pwchange) {