diff --git a/ChangeLog b/ChangeLog
index 85f251ce5..b96329ef2 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,10 @@
+20121212
+ - (djm) OpenBSD CVS Sync
+   - markus@cvs.openbsd.org 2012/12/11 22:16:21
+     [monitor.c]
+     drain the log messages after receiving the keystate from the unpriv
+     child. otherwise it might block while sending. ok djm@
+
 20121207
  - (dtucker) OpenBSD CVS Sync
    - dtucker@cvs.openbsd.org 2012/12/06 06:06:54
diff --git a/monitor.c b/monitor.c
index 1cfc48757..8006b833c 100644
--- a/monitor.c
+++ b/monitor.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: monitor.c,v 1.119 2012/12/02 20:34:10 djm Exp $ */
+/* $OpenBSD: monitor.c,v 1.120 2012/12/11 22:16:21 markus Exp $ */
 /*
  * Copyright 2002 Niels Provos <provos@citi.umich.edu>
  * Copyright 2002 Markus Friedl <markus@openbsd.org>
@@ -438,10 +438,6 @@ monitor_child_preauth(Authctxt *_authctxt, struct monitor *pmonitor)
 #endif
 	}
 
-	/* Drain any buffered messages from the child */
-	while (pmonitor->m_log_recvfd != -1 && monitor_read_log(pmonitor) == 0)
-		;
-
 	if (!authctxt->valid)
 		fatal("%s: authenticated invalid user", __func__);
 	if (strcmp(auth_method, "unknown") == 0)
@@ -452,6 +448,10 @@ monitor_child_preauth(Authctxt *_authctxt, struct monitor *pmonitor)
 
 	mm_get_keystate(pmonitor);
 
+	/* Drain any buffered messages from the child */
+	while (pmonitor->m_log_recvfd != -1 && monitor_read_log(pmonitor) == 0)
+		;
+
 	close(pmonitor->m_sendfd);
 	close(pmonitor->m_log_recvfd);
 	pmonitor->m_sendfd = pmonitor->m_log_recvfd = -1;