First let me say that I'm not too well-versed in coding and the ins and outs of how processes utilize credentials when they are spawned. However, the jist of it seems to be that if there are no credentials saved with passwd -R to replace the current user token with that of the user that is SSH'd in, then there is no way to change that token at all (or get rid of it) meaning the token used when accessing a share will stay as the token of the caller - namely cyg_server? Please correct me if I'm way off-base but that seems to be my interpretation of this.
If that is the case, it seems this is an unintended side effect of the way CYGWIN and sshd work together, and with the current state of Windows there isn't really a way around it. And that's OK (I can work around it if that's the case), I just wanted to get to the bottom of why this was happening and let people know the situation because I wasn't sure if anyone was aware of this behavior. Thank you very much Erik and everyone else for the help with this. This is my first time posting on these mailing lists and I appreciate people taking the time to reproduce the issue and help work it out. Thanks, David -----Original Message----- From: cygwin-ow...@cygwin.com [mailto:cygwin-ow...@cygwin.com] On Behalf Of Corinna Vinschen Sent: Monday, February 15, 2016 4:11 AM To: cygwin@cygwin.com Subject: Re: Possible Security Hole in SSHD w/ CYGWIN? On Feb 14 13:36, Erik Soderquist wrote: > I think the key point is that if no network password is stored using > the "passwd -R" option, then there should be absolutely no network > access at all in the current code/design, not a fall through to the > cyg_server account's network access, regardless of how much or little > network access that account has. The problem is this: I'm not aware of any explicit OS call which allows the process calling CreateProcessAsUser to drop network credentials of the *caller* in the child process running under another user token. In fact, I'm not even aware of any call which allows to drop network credentials even for the calling process, and that would be the wrong thing to do anyway. This is a clear cut case of "I need help" and "Patches gratefully accepted". Corinna -- Corinna Vinschen Please, send mails regarding Cygwin to Cygwin Maintainer cygwin AT cygwin DOT com Red Hat -- Problem reports: http://cygwin.com/problems.html FAQ: http://cygwin.com/faq/ Documentation: http://cygwin.com/docs.html Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple