Re: sshd permits logon using disabled user?

2019-01-24 Thread matthew patton via cygwin
 > I think refusing an account manually and deliberately disabled by an
 > admin makes lots of sense.

Why is this even a discussion? You *ALWAYS* refuse a login to an account that 
is disabled, locked out, or has an expired password or failed any of the other 
criteria that might be in effect (day/time restrictions, source IP 
restrictions, etc.)

Is someone suggesting that the Windows authentication API is actually returning 
a success code despite any of these conditions?

Furthermore you also *NEVER* hint to the user why the login was denied. It's 
rule #1 of security engineering.
Denied is denied. Explanations or hints are verboten.

--
Problem reports:   http://cygwin.com/problems.html
FAQ:   http://cygwin.com/faq/
Documentation: http://cygwin.com/docs.html
Unsubscribe info:  http://cygwin.com/ml/#unsubscribe-simple



[ANNOUNCEMENT] Updated: libcerf-1.11-1

2019-01-24 Thread Achim Gratz


This is an update to the latest upstream version.

Libcerf is a self-contained numeric library that provides an
efficient and accurate implementation of complex error functions,
along with Dawson, Faddeeva, and Voigt functions.

-- 
  *** CYGWIN-ANNOUNCE UNSUBSCRIBE INFO ***

If you want to unsubscribe from the cygwin-announce mailing list, look
at the "List-Unsubscribe: " tag in the email header of this message.
Send email to the address specified there. It will be in the format:

cygwin-announce-unsubscribe-you=yourdomain@cygwin.com

If you need more information on unsubscribing, start reading here:

http://sourceware.org/lists.html#unsubscribe-simple

Please read *all* of the information on unsubscribing that is available
starting at this URL.

--
Problem reports:   http://cygwin.com/problems.html
FAQ:   http://cygwin.com/faq/
Documentation: http://cygwin.com/docs.html
Unsubscribe info:  http://cygwin.com/ml/#unsubscribe-simple



Re: find_fast_cwd error

2019-01-24 Thread Marco Atzeri

Am 24.01.2019 um 19:48 schrieb Pudingos Stand:

  Hello, i got this error several times with the Joh the ripper program and
i couldn't seem to find a fix online.

2 [main] john 8388 find_fast_cwd: WARNING: Couldn't compute FAST_CWD
pointer.  Please report this problem to
the public mailing list cygwin@cygwin.com
0 password hashes cracked, 0 left



it is a warning not an error due to an old version of cygwin1.dll
used by the program you are using.

https://cygwin.com/faq.html#faq.using.fixing-find_fast_cwd-warnings

You can ask them to update their bundle

Regards
Marco

---
Diese E-Mail wurde von Avast Antivirus-Software auf Viren geprüft.
https://www.avast.com/antivirus


--
Problem reports:   http://cygwin.com/problems.html
FAQ:   http://cygwin.com/faq/
Documentation: http://cygwin.com/docs.html
Unsubscribe info:  http://cygwin.com/ml/#unsubscribe-simple



Flask app no longer working from cygwin when set to developer mode

2019-01-24 Thread Maxim Kupfer
This problem occurred immediately after attempting to run my python flask app 
in the backround (i.e $python app.py &)

It gave me the following error:
2 [main] python3.6m 11340 child_info_fork::abort: unable to remap 
_lbfgsb.cpython-36m-x86_64-cygwin.dll to same address as parent (0x493) - 
try running rebaseall

I've tried rebasing and restarting, but both didn't fix anything. The app works 
fine when it is not in developer mode, but then I don't get hot reloading. The 
app also works from my windows command line, so that is my temporary fix for 
now, but I would love to get my precious Cygwin setup up an running again.

Thanks for the help!

-Maxim

--
Problem reports:   http://cygwin.com/problems.html
FAQ:   http://cygwin.com/faq/
Documentation: http://cygwin.com/docs.html
Unsubscribe info:  http://cygwin.com/ml/#unsubscribe-simple



Re: sshd permits logon using disabled user?

2019-01-24 Thread Bill Stewart
On Thu, Jan 24, 2019 at 1:23 PM Corinna Vinschen
 wrote:

> I should have tested pubkey auth as well but as it was I just tested
> with pathword auth.  These methods take slightly different paths in
> Cygwin when trying to switch the user account.
>
> I pushed another patch and created new snapshots in the same location
> https://cygwin.com/snapshots/.

Just tested. Working now.

This is definitely the correct behavior IMO.

Thank you!

Bill

--
Problem reports:   http://cygwin.com/problems.html
FAQ:   http://cygwin.com/faq/
Documentation: http://cygwin.com/docs.html
Unsubscribe info:  http://cygwin.com/ml/#unsubscribe-simple



Re: sshd permits logon using disabled user?

2019-01-24 Thread Corinna Vinschen
On Jan 24 09:48, Bill Stewart wrote:
> Hello Corinna,
> 
> I performed the following steps:
> 
> 1. Downloaded cygwin-20190124.tar.xz
> 2. Extracted it
> 3. Stopped sshd
> 4. Renamed existing /bin/cygwin1.dll to cygwin1-20181108.dll
> 5. Copied cygwin1.dll from download to /bin
> 6. Started sshd
> 
> Did I miss anything?

No, I did.

> It still allows logon with disabled account.

I should have tested pubkey auth as well but as it was I just tested
with pathword auth.  These methods take slightly different paths in
Cygwin when trying to switch the user account.

I pushed another patch and created new snapshots in the same location
https://cygwin.com/snapshots/.


HTH,
Corinna


> 
> Thanks,
> 
> Bill
> 
> 
> On Thu, Jan 24, 2019 at 8:45 AM Corinna Vinschen 
> wrote:
> 
> > On Jan 24 06:28, Bill Stewart wrote:
> > > I am running Windows 10 (1803) and experimenting with sshd installed as a
> > > Windows service.
> > >
> > > The computer is a domain member. I created a local computer account for
> > > testing.
> > >
> > > I created host keys and a public/private key pair to use to log on the
> > user.
> > >
> > > This works, except I notice that if I disable the Windows user account, I
> > > can still log on using ssh using that account.
> > >
> > > In the shell, logged on as the disabled user, the 'whoami' command
> > returns
> > > the name of the disabled user.
> > >
> > > This seems unexpected and not good.
> > >
> > > Why does sshd allow logon for a disabled user?
> >
> > Because the underlying Cygwin function responsible for changing the user
> > account only checks if the account exists.  It does not check for any of
> > the flags in the user DB.  Yet.
> >
> > I pushed a patch to disallow changing the user account to a disabled or
> > locked out account.
> >
> > I just uploaded new developer snapshots containing this change to
> > https://cygwin.com/snapshots/
> >
> > Please give them a try.
> >
> >
> > Thanks,
> > Corinna
> >
> > --
> > Corinna Vinschen
> > Cygwin Maintainer
> >
> 
> --
> Problem reports:   http://cygwin.com/problems.html
> FAQ:   http://cygwin.com/faq/
> Documentation: http://cygwin.com/docs.html
> Unsubscribe info:  http://cygwin.com/ml/#unsubscribe-simple

-- 
Corinna Vinschen
Cygwin Maintainer


signature.asc
Description: PGP signature


Re: sshd permits logon using disabled user?

2019-01-24 Thread Stefan Baur
Am 24.01.19 um 20:17 schrieb Wayne Davison:
>> I don't think Windows natively supports password-free logons using only key
>> files (but I might be wrong about that).
> Don't forget that sshd_config fully supports disabling passwords.  You
> can turn a password off for a single user via:
> 
> Match User foobar
> PasswordAuthentication no
> 
> Or set the "PasswordAuthentication no" as the default for all users.

Yes, but that will still allow the user to log in with their password
when they have access to the local screen and keyboard, or the machine
is reachable via RDP or CIFS, for example.

Kind Regards,
Stefan Baur

-- 
BAUR-ITCS UG (haftungsbeschränkt)
Geschäftsführer: Stefan Baur
Eichenäckerweg 10, 89081 Ulm | Registergericht Ulm, HRB 724364
Fon/Fax 0731 40 34 66-36/-35 | USt-IdNr.: DE268653243

--
Problem reports:   http://cygwin.com/problems.html
FAQ:   http://cygwin.com/faq/
Documentation: http://cygwin.com/docs.html
Unsubscribe info:  http://cygwin.com/ml/#unsubscribe-simple



Re: sshd permits logon using disabled user?

2019-01-24 Thread Wayne Davison
On Thu, Jan 24, 2019 at 10:13 AM Bill Stewart wrote:
> I don't think Windows natively supports password-free logons using only key
> files (but I might be wrong about that).

Don't forget that sshd_config fully supports disabling passwords.  You
can turn a password off for a single user via:

Match User foobar
PasswordAuthentication no

Or set the "PasswordAuthentication no" as the default for all users.

..wayne..

--
Problem reports:   http://cygwin.com/problems.html
FAQ:   http://cygwin.com/faq/
Documentation: http://cygwin.com/docs.html
Unsubscribe info:  http://cygwin.com/ml/#unsubscribe-simple



Re: iperf 2.0.13 available

2019-01-24 Thread Achim Gratz
Bob McMahon writes:
> We've done a lot of work to make iperf 2.0.13 work well on cygwin.  There
> are also a lot of new features relevant to the WiFi testing community.  Is
> there a contact on how to get this distributed via cgywin apps?

Either the current maintainer does an update or, if that doesn't come to
pass for whatever reason, you send an ITA for the package over on the
cygwin-apps mailing list.


Regards,
Achim.
-- 
+<[Q+ Matrix-12 WAVE#46+305 Neuron microQkb Andromeda XTk Blofeld]>+

SD adaptation for Waldorf microQ V2.22R2:
http://Synth.Stromeko.net/Downloads.html#WaldorfSDada

--
Problem reports:   http://cygwin.com/problems.html
FAQ:   http://cygwin.com/faq/
Documentation: http://cygwin.com/docs.html
Unsubscribe info:  http://cygwin.com/ml/#unsubscribe-simple



find_fast_cwd error

2019-01-24 Thread Pudingos Stand
 Hello, i got this error several times with the Joh the ripper program and
i couldn't seem to find a fix online.

2 [main] john 8388 find_fast_cwd: WARNING: Couldn't compute FAST_CWD
pointer.  Please report this problem to
the public mailing list cygwin@cygwin.com
0 password hashes cracked, 0 left

--
Problem reports:   http://cygwin.com/problems.html
FAQ:   http://cygwin.com/faq/
Documentation: http://cygwin.com/docs.html
Unsubscribe info:  http://cygwin.com/ml/#unsubscribe-simple



Re: sshd permits logon using disabled user?

2019-01-24 Thread Bill Stewart
On Thu, Jan 24, 2019 at 10:58 AM Stefan Baur  wrote:

That sounds like the total opposite - allowing login without a password.
>
> Now, if there was a flag PASSWD_NOTPERMITTED or something like that,
> then we'd be able to emulate what can be done on Linux with "passwd -l
> username" and an ssh key file.
>

You are correct; "password not required" != "password not permitted."

I don't think Windows natively supports password-free logons using only key
files (but I might be wrong about that).

In any case, I'm not sure it's needed to support this scenario. Just set a
very long/random/complex password on the account.

Regards,

Bill

--
Problem reports:   http://cygwin.com/problems.html
FAQ:   http://cygwin.com/faq/
Documentation: http://cygwin.com/docs.html
Unsubscribe info:  http://cygwin.com/ml/#unsubscribe-simple



Re: sshd permits logon using disabled user?

2019-01-24 Thread Stefan Baur
Am 24.01.19 um 18:52 schrieb Bill Stewart:
> If you want to have an account that does not require a password, there is a
> separate flag for that - PASSWD_NOTREQD - although setting this may be
> prohibited by policy.

That sounds like the total opposite - allowing login without a password.

Now, if there was a flag PASSWD_NOTPERMITTED or something like that,
then we'd be able to emulate what can be done on Linux with "passwd -l
username" and an ssh key file.

Kind Regards,
Stefan Baur

-- 
BAUR-ITCS UG (haftungsbeschränkt)
Geschäftsführer: Stefan Baur
Eichenäckerweg 10, 89081 Ulm | Registergericht Ulm, HRB 724364
Fon/Fax 0731 40 34 66-36/-35 | USt-IdNr.: DE268653243

--
Problem reports:   http://cygwin.com/problems.html
FAQ:   http://cygwin.com/faq/
Documentation: http://cygwin.com/docs.html
Unsubscribe info:  http://cygwin.com/ml/#unsubscribe-simple



Re: sshd permits logon using disabled user?

2019-01-24 Thread Bill Stewart
Corinna Vinschen wrote:

> This description sounds extremly artificial to me.  We should work under
the
> assumption that the admin is the good guy.  Usually a user locks itself
out,
> or is locked out by a malicious login attempt.  The admin can only define
> rules for locking out, other than that she can only remove the "account
> locked" flag.

This is correct.

>From a Windows perspective, "disabled" (UF_ACCOUNTDISABLE) means "account
cannot be used to log on," and "locked out" (UF_LOCKOUT) means "there were
too many bad password attempts, so the account is locked and cannot be used
to log on at this time." The administrator can specify whether the
UF_LOCKOUT duration is indefinite (this is usually not recommended, because
this can be used for DoS) or not.

Only an administrator (or a user with appropriate permissions) can set or
clear UF_ACCOUNTDISABLE. It is used to prevent _any_ use of the account.

UF_LOCKOUT is _only_ set by bad password attempts (the number of bad
attempts is set by policy) and is not really intended to be used for any
other purpose. UF_LOCKOUT can be cleared by an administrator (or user with
appropriate permissions), or the system can clear it automatically after
some duration (specified by policy), or it can be indefinite (although, as
previously noted, this is not usually recommended).

If you want to have an account that does not require a password, there is a
separate flag for that - PASSWD_NOTREQD - although setting this may be
prohibited by policy.

So basically Corinna's idea is correct: If UF_ACCOUNTDISABLE or UF_LOCKOUT
are set, the account should not allow logon.

Regards,

Bill

--
Problem reports:   http://cygwin.com/problems.html
FAQ:   http://cygwin.com/faq/
Documentation: http://cygwin.com/docs.html
Unsubscribe info:  http://cygwin.com/ml/#unsubscribe-simple



Re: CYGWIN slow when accessing network share

2019-01-24 Thread J. David Boyd
db...@attentigroup.com (J. David Boyd) writes:

> Brian Inglis  writes:
>
>>
>> Network access may be slowed down by accessing AD.
>> Install and run cygserver at system startup to cache and share Cygwin AD info
>> across processes.
>
> I don't see any cygserver options in the config file that relate to AD.  What
> am I missing?
>
> Thanks for the info!
>
> Dave in Hudson, FL


But, it actually does seem to be better, just from using CygServer.   Thanks
for the tip

Dave


--
Problem reports:   http://cygwin.com/problems.html
FAQ:   http://cygwin.com/faq/
Documentation: http://cygwin.com/docs.html
Unsubscribe info:  http://cygwin.com/ml/#unsubscribe-simple



Re: sshd permits logon using disabled user?

2019-01-24 Thread Stefan Baur
Am 24.01.19 um 17:36 schrieb Corinna Vinschen:
>> If an admin can lock out an account (separately from disabling it
>> entirely), say, by setting an initial password, checking the "user must
>> change password on first login", and also checking "user is not allowed
>> to change password" simultaneously (if that's possible), or, say, by
>> just setting a random password without telling it to anyone ever,
>> followed by firing so many login attempts at the account that it gets
>> locked out, then telling them apart and treating locked out accounts
>> differently would make sense, IMO.

> This description sounds extremly artificial to me.

> We should work under
> the assumption that the admin is the good guy.

Uh, where did I imply anything else?


>  Usually a user locks
> itself out, or is locked out by a malicious login attempt.  The admin
> can only define rules for locking out, other than that she can only
> remove the "account locked" flag.

The methods listed above, well, at least the "brute force" one, would
work for intentionally creating an account that is locked out, but not
disabled - as a good guy admin.

And the reason for doing so would be the same as running "passwd -l
username" on Linux - You don't want your users to log in with a
password, because you consider that too insecure - instead, you want
them to use the (hopefully passphrase-protected) SSH key file.

Kind Regards,
Stefan Baur

-- 
BAUR-ITCS UG (haftungsbeschränkt)
Geschäftsführer: Stefan Baur
Eichenäckerweg 10, 89081 Ulm | Registergericht Ulm, HRB 724364
Fon/Fax 0731 40 34 66-36/-35 | USt-IdNr.: DE268653243



signature.asc
Description: OpenPGP digital signature


Re: sshd permits logon using disabled user?

2019-01-24 Thread Bill Stewart
Hello Corinna,

I performed the following steps:

1. Downloaded cygwin-20190124.tar.xz
2. Extracted it
3. Stopped sshd
4. Renamed existing /bin/cygwin1.dll to cygwin1-20181108.dll
5. Copied cygwin1.dll from download to /bin
6. Started sshd

Did I miss anything?

It still allows logon with disabled account.

Thanks,

Bill


On Thu, Jan 24, 2019 at 8:45 AM Corinna Vinschen 
wrote:

> On Jan 24 06:28, Bill Stewart wrote:
> > I am running Windows 10 (1803) and experimenting with sshd installed as a
> > Windows service.
> >
> > The computer is a domain member. I created a local computer account for
> > testing.
> >
> > I created host keys and a public/private key pair to use to log on the
> user.
> >
> > This works, except I notice that if I disable the Windows user account, I
> > can still log on using ssh using that account.
> >
> > In the shell, logged on as the disabled user, the 'whoami' command
> returns
> > the name of the disabled user.
> >
> > This seems unexpected and not good.
> >
> > Why does sshd allow logon for a disabled user?
>
> Because the underlying Cygwin function responsible for changing the user
> account only checks if the account exists.  It does not check for any of
> the flags in the user DB.  Yet.
>
> I pushed a patch to disallow changing the user account to a disabled or
> locked out account.
>
> I just uploaded new developer snapshots containing this change to
> https://cygwin.com/snapshots/
>
> Please give them a try.
>
>
> Thanks,
> Corinna
>
> --
> Corinna Vinschen
> Cygwin Maintainer
>

--
Problem reports:   http://cygwin.com/problems.html
FAQ:   http://cygwin.com/faq/
Documentation: http://cygwin.com/docs.html
Unsubscribe info:  http://cygwin.com/ml/#unsubscribe-simple



RE: script.exe is missing from util-linux 2.32.1-1

2019-01-24 Thread Buchbinder, Barry (NIH/NIAID) [E]
Rusty Lemur sent the following at Thursday, January 24, 2019 11:30 AM
>
>I noticed that script.exe is not included in util-linux 2.32.1-1. I had
>to downgrade to util-linux 2.25.2-2 before it was installed. This is
>a tool that I use heavily, so if it is being migrated to a different
>package (not util-linux), please let me know what I should install to
>get it.

See the release announcement for util-linux 2.32.1-1:
https://cygwin.com/ml/cygwin-announce/2019-01/msg00017.html


Re: sshd permits logon using disabled user?

2019-01-24 Thread Corinna Vinschen
On Jan 24 17:16, Stefan Baur wrote:
> Am 24.01.19 um 16:59 schrieb Corinna Vinschen:
> > I think refusing an account manually and deliberately disabled by an
> > admin makes lots of sense.
> > 
> > I'm not so sure about locked out accounts.  THis might need some
> > discussion.
> 
> It's been a while since I did Windows administration, so I can't really
> make a recommendation here ... BUT:
> 
> If an admin can lock out an account (separately from disabling it
> entirely), say, by setting an initial password, checking the "user must
> change password on first login", and also checking "user is not allowed
> to change password" simultaneously (if that's possible), or, say, by
> just setting a random password without telling it to anyone ever,
> followed by firing so many login attempts at the account that it gets
> locked out, then telling them apart and treating locked out accounts
> differently would make sense, IMO.

This description sounds extremly artificial to me.  We should work under
the assumption that the admin is the good guy.  Usually a user locks
itself out, or is locked out by a malicious login attempt.  The admin
can only define rules for locking out, other than that she can only
remove the "account locked" flag.


Corinna

-- 
Corinna Vinschen
Cygwin Maintainer


signature.asc
Description: PGP signature


script.exe is missing from util-linux 2.32.1-1

2019-01-24 Thread Rusty Lemur
To whom it may concern:

I noticed that script.exe is not included in util-linux 2.32.1-1.  I had to
downgrade to util-linux 2.25.2-2 before it was installed.  This is a tool
that I use heavily, so if it is being migrated to a different package (not
util-linux), please let me know what I should install to get it.

Many thanks to the package maintainers!

-Rusty

--
Problem reports:   http://cygwin.com/problems.html
FAQ:   http://cygwin.com/faq/
Documentation: http://cygwin.com/docs.html
Unsubscribe info:  http://cygwin.com/ml/#unsubscribe-simple



Re: sshd permits logon using disabled user?

2019-01-24 Thread Stefan Baur
Am 24.01.19 um 16:59 schrieb Corinna Vinschen:
> I think refusing an account manually and deliberately disabled by an
> admin makes lots of sense.
> 
> I'm not so sure about locked out accounts.  THis might need some
> discussion.

It's been a while since I did Windows administration, so I can't really
make a recommendation here ... BUT:

If an admin can lock out an account (separately from disabling it
entirely), say, by setting an initial password, checking the "user must
change password on first login", and also checking "user is not allowed
to change password" simultaneously (if that's possible), or, say, by
just setting a random password without telling it to anyone ever,
followed by firing so many login attempts at the account that it gets
locked out, then telling them apart and treating locked out accounts
differently would make sense, IMO.

Kind Regards,
Stefan Baur

-- 
BAUR-ITCS UG (haftungsbeschränkt)
Geschäftsführer: Stefan Baur
Eichenäckerweg 10, 89081 Ulm | Registergericht Ulm, HRB 724364
Fon/Fax 0731 40 34 66-36/-35 | USt-IdNr.: DE268653243



signature.asc
Description: OpenPGP digital signature


Re: sshd permits logon using disabled user?

2019-01-24 Thread Corinna Vinschen
On Jan 24 16:51, Stefan Baur wrote:
> Am 24.01.19 um 16:45 schrieb Corinna Vinschen:
> >> In the shell, logged on as the disabled user, the 'whoami' command returns
> >> the name of the disabled user.
> >>
> >> This seems unexpected and not good.
> >>
> >> Why does sshd allow logon for a disabled user?
> > Because the underlying Cygwin function responsible for changing the user
> > account only checks if the account exists.  It does not check for any of
> > the flags in the user DB.  Yet.
> > 
> > I pushed a patch to disallow changing the user account to a disabled or
> > locked out account.
> 
> I would like to point out that on Linux, you can disable an account's
> password ("password -l username" / "usermod -L username"), and still log
> in using an SSH key pair.  This is intentional and different to
> disabling an account entirely ("usermod -e 1 username" combined with the
> above).
> 
> So I guess, the question is if there's a way to make Cygwin act similar
> to this - maybe if you can tell disabled vs. locked out apart, allow SSH
> key pair logins when locked out, but not when disabled?

Being disabled and being locked out are two different flags, so this
can be recognized from each other.  A disabled account is a an account
which is explicitely disabled in the user DB.  A locked out account in
Windows is to my understanding an account which has unsuccessfully tried
to login multiple times so the account is locked for security reasons,
until an admin unlocks it.

Right now, with the patch I just pushed, both types, explicitely disabled
or locked out" are refused.

I think refusing an account manually and deliberately disabled by an
admin makes lots of sense.

I'm not so sure about locked out accounts.  THis might need some
discussion.


Corinna

-- 
Corinna Vinschen
Cygwin Maintainer


signature.asc
Description: PGP signature


Re: sshd permits logon using disabled user?

2019-01-24 Thread Stefan Baur
Am 24.01.19 um 16:45 schrieb Corinna Vinschen:
>> In the shell, logged on as the disabled user, the 'whoami' command returns
>> the name of the disabled user.
>>
>> This seems unexpected and not good.
>>
>> Why does sshd allow logon for a disabled user?
> Because the underlying Cygwin function responsible for changing the user
> account only checks if the account exists.  It does not check for any of
> the flags in the user DB.  Yet.
> 
> I pushed a patch to disallow changing the user account to a disabled or
> locked out account.

I would like to point out that on Linux, you can disable an account's
password ("password -l username" / "usermod -L username"), and still log
in using an SSH key pair.  This is intentional and different to
disabling an account entirely ("usermod -e 1 username" combined with the
above).

So I guess, the question is if there's a way to make Cygwin act similar
to this - maybe if you can tell disabled vs. locked out apart, allow SSH
key pair logins when locked out, but not when disabled?

Kind Regards,
Stefan Baur


-- 
BAUR-ITCS UG (haftungsbeschränkt)
Geschäftsführer: Stefan Baur
Eichenäckerweg 10, 89081 Ulm | Registergericht Ulm, HRB 724364
Fon/Fax 0731 40 34 66-36/-35 | USt-IdNr.: DE268653243



signature.asc
Description: OpenPGP digital signature


Re: sshd permits logon using disabled user?

2019-01-24 Thread Corinna Vinschen
On Jan 24 06:28, Bill Stewart wrote:
> I am running Windows 10 (1803) and experimenting with sshd installed as a
> Windows service.
> 
> The computer is a domain member. I created a local computer account for
> testing.
> 
> I created host keys and a public/private key pair to use to log on the user.
> 
> This works, except I notice that if I disable the Windows user account, I
> can still log on using ssh using that account.
> 
> In the shell, logged on as the disabled user, the 'whoami' command returns
> the name of the disabled user.
> 
> This seems unexpected and not good.
> 
> Why does sshd allow logon for a disabled user?

Because the underlying Cygwin function responsible for changing the user
account only checks if the account exists.  It does not check for any of
the flags in the user DB.  Yet.

I pushed a patch to disallow changing the user account to a disabled or
locked out account.

I just uploaded new developer snapshots containing this change to
https://cygwin.com/snapshots/

Please give them a try.


Thanks,
Corinna

-- 
Corinna Vinschen
Cygwin Maintainer


signature.asc
Description: PGP signature


Re: iperf 2.0.13 available

2019-01-24 Thread Richard Campbell
While iperf may have a maintainer listed (Joel Johnson), I only see
one release from him and no mailing list posts since that 2015 upload,
so iperf may be orphaned again.

At the time Joel noted that 2.0.5 was the last version prior to a
fork, but that he deliberately didn't pick that version due to an
incompatible change, so if that's the source of the current iperf
2.0.13, that iperf fork may also not have a maintainer.

https://sourceware.org/ml/cygwin-apps/2015-07/msg00052.html
https://sourceware.org/cgi-bin/search.cgi?q=joel+johnson&cmd=Search%21&form=extended&m=all&ps=10&fmt=long&wm=wrd&sp=1&sy=1&wf=2221&type=&GroupBySite=no&ul=%2Fml%2Fcygwin%25

-Richard Campbell.

--
Problem reports:   http://cygwin.com/problems.html
FAQ:   http://cygwin.com/faq/
Documentation: http://cygwin.com/docs.html
Unsubscribe info:  http://cygwin.com/ml/#unsubscribe-simple



sshd permits logon using disabled user?

2019-01-24 Thread Bill Stewart
I am running Windows 10 (1803) and experimenting with sshd installed as a
Windows service.

The computer is a domain member. I created a local computer account for
testing.

I created host keys and a public/private key pair to use to log on the user.

This works, except I notice that if I disable the Windows user account, I
can still log on using ssh using that account.

In the shell, logged on as the disabled user, the 'whoami' command returns
the name of the disabled user.

This seems unexpected and not good.

Why does sshd allow logon for a disabled user?

Thanks

Bill

--
Problem reports:   http://cygwin.com/problems.html
FAQ:   http://cygwin.com/faq/
Documentation: http://cygwin.com/docs.html
Unsubscribe info:  http://cygwin.com/ml/#unsubscribe-simple



Re: CYGWIN slow when accessing network share

2019-01-24 Thread J. David Boyd
Brian Inglis  writes:

>
> Network access may be slowed down by accessing AD.
> Install and run cygserver at system startup to cache and share Cygwin AD info
> across processes.

I don't see any cygserver options in the config file that relate to AD.  What
am I missing?

Thanks for the info!

Dave in Hudson, FL


--
Problem reports:   http://cygwin.com/problems.html
FAQ:   http://cygwin.com/faq/
Documentation: http://cygwin.com/docs.html
Unsubscribe info:  http://cygwin.com/ml/#unsubscribe-simple