Re: SSH password change request
On Jan 26 13:56, Jonathan Mailloux wrote: Hi everyone. I modified openssh-5.1p1-10 to allow SSH to have it login with a password and do some action on a single line. This is the result of a chain of problems I had to customize and automate our web installations here. Syntax is as follow: ssh password:usern...@server [params] [actions] [etc...] I wanted to submit this to cygwin-packages but I am having all the troubles in the world connectiong via cvs + v1.7 has gone out. There are a couple of problems: - OpenSSH is at 5.3p1, not at 5.1p1, so the patches probably won't apply cleanly to the latest from CVS. - There is no cygwin-packages repository, there's only a cygwin-apps repository. - OpenSSH is not maintained in cygwin-apps, but entirely upstream by the OpenBSD community. See http://www.openssh.com/portable.html. - The Cygwin version of OpenSSH is also maintained in the upstream source tree. For CVS access to that tree, see the aforementioned web page at http://www.openssh.com/portable.html. There's no Cygwin-specific patch which hasn't been accepted in the upstream repository and, as the Cygwin OpenSSH maintainer, I'm not willing to apply Cygwin-specific patches which won't go upstream. - I'm very certain that the patch won't be accepted upstream, since there's nothing you can say which will the upstream maintainers convince to allow to specify a cleartext password on the command line. - Last but not least, with Cygwin 1.7 there are very likely other solutions to your problems, see the Cygwin User's Guide at http://cygwin.com/cygwin-ug-net/ntsec.html#ntsec-setuid-overview and especially at http://cygwin.com/cygwin-ug-net/ntsec.html#ntsec-nopasswd2 and http://cygwin.com/cygwin-ug-net/ntsec.html#ntsec-nopasswd3 Corinna -- Corinna Vinschen Please, send mails regarding Cygwin to Cygwin Project Co-Leader cygwin AT cygwin DOT com Red Hat -- Problem reports: http://cygwin.com/problems.html FAQ: http://cygwin.com/faq/ Documentation: http://cygwin.com/docs.html Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple
RE: ssh password-less cmds to Windows 2003 don't return any output
-Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of John McNulty Sent: Wednesday, June 21, 2006 7:07 AM To: cygwin@cygwin.com Subject: ssh password-less cmds to Windows 2003 don't return any output Hello, I've been testing executing command via password-less SSH (public key) logins from MacOSX and OpenVMS clients to a Redhat EL AS 4 server, and a WinXP Home system (with Cygwin's OpenSSH). All works ok and I can issue test commands like: $ ssh [EMAIL PROTECTED] ipconfig and see the output from ipconfig on the client. However I've just installed and configured Cygwin OpenSSH on a Windows 2003 server, and setup password-less logins (via public keys) as before. But when I try and issue a command via ssh from the client I get no command output back at all. The remote command just completes silently. The password-less login is working just fine. Does anyone else see this and have any idea why I'm getting this behavior? I do not see this and I do not know why you are seeing that behavior. I am reporting that $ ssh [EMAIL PROTECTED] server] [command] produces user-visible output when I run that command from RHEL 3 or RH 7.3. -- Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple Problem reports: http://cygwin.com/problems.html Documentation: http://cygwin.com/docs.html FAQ: http://cygwin.com/faq/
Re: ssh password-less cmds to Windows 2003 don't return any output
On Wed, 21 Jun 2006, John McNulty wrote: Hello, I've been testing executing command via password-less SSH (public key) logins from MacOSX and OpenVMS clients to a Redhat EL AS 4 server, and a WinXP Home system (with Cygwin's OpenSSH). All works ok and I can issue test commands like: $ ssh [EMAIL PROTECTED] ipconfig and see the output from ipconfig on the client. However I've just installed and configured Cygwin OpenSSH on a Windows 2003 server, and setup password-less logins (via public keys) as before. But when I try and issue a command via ssh from the client I get no command output back at all. The remote command just completes silently. The password-less login is working just fine. Does anyone else see this and have any idea why I'm getting this behavior? Cygwin ssh (and basically all terminals except the Windows console) use pipes to emulate ttys (so-called ptys). Some Windows applications don't like these ptys and won't write data to them (and they will certainly not detect them as a console, so any console-specific functions won't work either). I followed the instructions in ssh-host-config and opted to use the sshd_server account (which kind of caught me by surprise). Obviously this changes the way ssh works on Cygwin a little. On Windows 2003, SYSTEM does not have the appropriate privileges to switch user contexts, so ssh-host-config needs to create an account that does. Read http://cygwin.com/cygwin-ug-net/ntsec.html#ntsec-switch for details. Ultimately the object of the exercise here is to drive a CLI app on Windows 2003 from batch jobs on OpenVMS. Cygwin OpenSSH is the only way I've been able to think of to solve this problem. The other clients and servers are only being used to test my methodology is correct, and it works flawlessly on WinXP Home. You are not guaranteed that the program you want to drive will work with a pty. The easiest way to check is to run the application in rxvt. If that works, your app will probably work over ssh as well. If it doesn't, don't even bother to set up ssh. Whether or not this works is specific to the application you intend to run. Igor -- http://cs.nyu.edu/~pechtcha/ |\ _,,,---,,_[EMAIL PROTECTED] | [EMAIL PROTECTED] ZZZzz /,`.-'`'-. ;-;;,_Igor Peshansky, Ph.D. (name changed!) |,4- ) )-,_. ,\ ( `'-' old name: Igor Pechtchanski '---''(_/--' `-'\_) fL a.k.a JaguaR-R-R-r-r-r-.-.-. Meow! Las! je suis sot... -Mais non, tu ne l'es pas, puisque tu t'en rends compte. But no -- you are no fool; you call yourself a fool, there's proof enough in that! -- Rostand, Cyrano de Bergerac -- Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple Problem reports: http://cygwin.com/problems.html Documentation: http://cygwin.com/docs.html FAQ: http://cygwin.com/faq/
Re: ssh password-less cmds to Windows 2003 don't return any output
John McNulty wrote: However I've just installed and configured Cygwin OpenSSH on a Windows 2003 server, and setup password-less logins (via public keys) as before. But when I try and issue a command via ssh from the client I get no command output back at all. The remote command just completes silently. The password-less login is working just fine. Are you sure it works at all? Did you check /var/log/sshd.log on the W2K3 server for errors? It might be that the ssh isn't running the command at all rather it's aborting. Does anyone else see this and have any idea why I'm getting this behavior? I have similar problems with both ssh and rsh on W2K3. I followed the instructions in ssh-host-config and opted to use the sshd_server account (which kind of caught me by surprise). Obviously this changes the way ssh works on Cygwin a little. The change is necessary since W2K3 tightened up security and permissions on the Local System Account such that sshd would not be able to switch user if it used that account. Instead it offers to create a new account called sshd_server and bestow on it the required rights to switch user. (I've been wondering why not bestow those rights directly to the Local System Account? I mean it had them before... Obviously a security decision, probably a wise one). -- Andrew DeFaria http://defaria.com It's not an optical illusion. It just looks like one. -- Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple Problem reports: http://cygwin.com/problems.html Documentation: http://cygwin.com/docs.html FAQ: http://cygwin.com/faq/
Re: ssh password-less cmds to Windows 2003 don't return any output
On Jun 21 08:29, Andrew DeFaria wrote: The change is necessary since W2K3 tightened up security and permissions on the Local System Account such that sshd would not be able to switch user if it used that account. Instead it offers to create a new account called sshd_server and bestow on it the required rights to switch user. (I've been wondering why not bestow those rights directly to the Local System Account? I mean it had them before... Obviously a security decision, probably a wise one). You'll be surprised, but on 2K3 the SYSTEM account still has all the rights it has on previous systems. The sad fact on 2K3 is that the SYSTEM account gets revoked the SeCreateTokenName privilege *unconditionally* as soon as a service is running under that account. Unfortunately this is the privilege necessary to allow password-less logins. Whatever you do to the SYSTEM account, you'll not have the SeCreateTokenName privilege in any service started under this account. This is a Microsoft design decision to raise security. Alas, the cygwin mailing list is not the right place to discuss sense or nonsense of this decision... Corinna -- Corinna Vinschen Please, send mails regarding Cygwin to Cygwin Project Co-Leader cygwin AT cygwin DOT com Red Hat -- Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple Problem reports: http://cygwin.com/problems.html Documentation: http://cygwin.com/docs.html FAQ: http://cygwin.com/faq/
RE: ssh password-less cmds to Windows 2003 don't return any output
-Original Message- From: John McNulty [mailto:[EMAIL PROTECTED] Sent: Wednesday, June 21, 2006 12:48 PM To: Harig, Mark Subject: Re: ssh password-less cmds to Windows 2003 don't return any output On 21/06/06, Harig, Mark [EMAIL PROTECTED] wrote: I do not see this and I do not know why you are seeing that behavior. I am reporting that $ ssh [EMAIL PROTECTED] server] [command] produces user-visible output when I run that command from RHEL 3 or RH 7.3. I just tried it from one of the RHEL AS 4 (update 3) systems. Same thing. So that's 3 different clients now and 3 different operating systems. The common denominator is the W2003 server. My guess is the one that was listed in one of the earlier replies, namely, to confirm that you have created the required special accounts required for running a Cygwin ssh service on Windows 2K+. Normally, 'ssh-host-config' will have done this for you, or will have prompted you for permission to do it. Consider posting your /etc/passwd, /etc/group, and /etc/sshd_config files (as attachments) to the Cygwin mailing list. Someone may see a problem with your configuration. For what it's worth, I used your test program, 'ipconfig', to check the cygwin sshd behavior on three W2003 servers. All three worked as expected, with the output of ipconfig displayed in my rxvt terminal window. Also, I am assuming that you are able to start an ssh client on your RHEL server and successfully connect to your W2003 server, and can run the 'ipconfig' command with the expected results when run interactively. -- Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple Problem reports: http://cygwin.com/problems.html Documentation: http://cygwin.com/docs.html FAQ: http://cygwin.com/faq/
Re: ssh password-less cmds to Windows 2003 don't return any output
On 21/06/06, Igor Peshansky [EMAIL PROTECTED] wrote: Cygwin ssh (and basically all terminals except the Windows console) use pipes to emulate ttys (so-called ptys). Some Windows applications don't like these ptys and won't write data to them (and they will certainly not detect them as a console, so any console-specific functions won't work either). Hmm .. this is where it gets even more interesting. If I run: $ ssh [EMAIL PROTECTED] date Wed Jun 21 18:02:13 GMTDT 2006 .. then I get a result. But other commands don't, e.g. $ ssh [EMAIL PROTECTED] cat /etc/hosts $ ssh [EMAIL PROTECTED] ls On Windows 2003, SYSTEM does not have the appropriate privileges to switch user contexts, so ssh-host-config needs to create an account that does. Read http://cygwin.com/cygwin-ug-net/ntsec.html#ntsec-switch for details. Before running ssh-host-config I did: - Right click My Computer, Properties Advanced Environment Variables - Under System Variables, click New, add CYGWIN as the variable name, add ntsec as the variable value - Under System Variables, scroll down to Path, click Edit, add ;c:\cygwin\bin to the end of the string already in the field Then opened Cygwin on the desktop, ran ssh-host-config and entered: Privilege Separation? Yes Create local user SSHd? Yes Install SSHd as a service? Yes CYGWIN = enter ntsec Should I have done anything different there on W2003 ? Regards, John -- Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple Problem reports: http://cygwin.com/problems.html Documentation: http://cygwin.com/docs.html FAQ: http://cygwin.com/faq/
Re: ssh password-less cmds to Windows 2003 don't return any output
On 21/06/06, John McNulty [EMAIL PROTECTED] wrote: Privilege Separation? Yes Create local user SSHd? Yes Install SSHd as a service? Yes CYGWIN = enter ntsec Whoops, that was from a log from the WinXP install. The correct log includes the bit about the sshd_server. Sorry. -- Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple Problem reports: http://cygwin.com/problems.html Documentation: http://cygwin.com/docs.html FAQ: http://cygwin.com/faq/
Re: ssh password-less cmds to Windows 2003 don't return any output
On 21/06/06, Andrew DeFaria [EMAIL PROTECTED] wrote: Are you sure it works at all? Did you check /var/log/sshd.log on the W2K3 server for errors? It might be that the ssh isn't running the command at all rather it's aborting. sshd.log is empty. However from my other replies you can see that commands like 'date' work and return output to the client. Also, I can do stuff like: $ ssh [EMAIL PROTECTED] rm foo and 'foo' is successfully removed. Regards, John -- Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple Problem reports: http://cygwin.com/problems.html Documentation: http://cygwin.com/docs.html FAQ: http://cygwin.com/faq/
Re: ssh password-less cmds to Windows 2003 don't return any output
John McNulty wrote: On 21/06/06, Igor Peshansky [EMAIL PROTECTED] wrote: Cygwin ssh (and basically all terminals except the Windows console) use pipes to emulate ttys (so-called ptys). Some Windows applications don't like these ptys and won't write data to them (and they will certainly not detect them as a console, so any console-specific functions won't work either). Hmm .. this is where it gets even more interesting. If I run: $ ssh [EMAIL PROTECTED] date Wed Jun 21 18:02:13 GMTDT 2006 .. then I get a result. But other commands don't, e.g. $ ssh [EMAIL PROTECTED] cat /etc/hosts $ ssh [EMAIL PROTECTED] ls What does 'ssh [EMAIL PROTECTED] cygcheck ls' say? On Windows 2003, SYSTEM does not have the appropriate privileges to switch user contexts, so ssh-host-config needs to create an account that does. Read http://cygwin.com/cygwin-ug-net/ntsec.html#ntsec-switch for details. Before running ssh-host-config I did: - Right click My Computer, Properties Advanced Environment Variables - Under System Variables, click New, add CYGWIN as the variable name, add ntsec as the variable value - Under System Variables, scroll down to Path, click Edit, add ;c:\cygwin\bin to the end of the string already in the field Then opened Cygwin on the desktop, ran ssh-host-config and entered: Privilege Separation? Yes Create local user SSHd? Yes Install SSHd as a service? Yes CYGWIN = enter ntsec Should I have done anything different there on W2003 ? Depends on what you need. If you need to get output from non-Cygwin executables, then you'll need to re-install the service with nontsec instead. But this is notably less secure. There should be no need to do this if you're simply dealing with Cygwin utilities though. -- Larry Hall http://www.rfk.com RFK Partners, Inc. (508) 893-9779 - RFK Office 838 Washington Street (508) 893-9889 - FAX Holliston, MA 01746 -- Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple Problem reports: http://cygwin.com/problems.html Documentation: http://cygwin.com/docs.html FAQ: http://cygwin.com/faq/
Re: ssh password-less cmds to Windows 2003 don't return any output
On 21/06/06, Larry Hall (Cygwin) [EMAIL PROTECTED] wrote: What does 'ssh [EMAIL PROTECTED] cygcheck ls' say? If I ssh login and then run 'cygcheck ls' then I get... $ cygcheck ls Found: C:\cygwin\bin\ls.exe C:/cygwin/bin/ls.exe C:\cygwin\bin\cygwin1.dll C:\WINDOWS\system32\ADVAPI32.DLL C:\WINDOWS\system32\KERNEL32.dll C:\WINDOWS\system32\ntdll.dll C:\WINDOWS\system32\RPCRT4.dll C:\cygwin\bin\cygintl-3.dll C:\cygwin\bin\cygiconv-2.dll Doing is as a remote command didn't output anything. However, I just noticed something really else really weird. Repeating the remote 'ls' command in succession _sometimes_ works. # ssh [EMAIL PROTECTED] ls # ssh [EMAIL PROTECTED] ls # ssh [EMAIL PROTECTED] ls bar exit-bad exit-good saved-files # # ssh [EMAIL PROTECTED] ls # ssh [EMAIL PROTECTED] ls # ssh [EMAIL PROTECTED] ls # ssh [EMAIL PROTECTED] ls # ssh [EMAIL PROTECTED] ls bar exit-bad exit-good saved-files ??? Regards, John -- Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple Problem reports: http://cygwin.com/problems.html Documentation: http://cygwin.com/docs.html FAQ: http://cygwin.com/faq/
Re: ssh password-less cmds to Windows 2003 don't return any output
--On 21 June 2006 18:50 +0100 John McNulty wrote: However, I just noticed something really else really weird. Repeating the remote 'ls' command in succession _sometimes_ works. # ssh [EMAIL PROTECTED] ls # ssh [EMAIL PROTECTED] ls # ssh [EMAIL PROTECTED] ls bar exit-bad exit-good saved-files # # ssh [EMAIL PROTECTED] ls # ssh [EMAIL PROTECTED] ls # ssh [EMAIL PROTECTED] ls # ssh [EMAIL PROTECTED] ls # ssh [EMAIL PROTECTED] ls bar exit-bad exit-good saved-files Check the Windows 2003 Server Event Viewer for entries from sshd in the Application Event Log. -- Robin Walker -- Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple Problem reports: http://cygwin.com/problems.html Documentation: http://cygwin.com/docs.html FAQ: http://cygwin.com/faq/
Re: Re: ssh password
On Aug 11 12:58, fishing wrote: please delete my email address from mail list.thanks! === 2004-05-06 21:27:53 === [...] -- Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple ^^^ Did you read this? Corinna Problem reports: http://cygwin.com/problems.html Documentation: http://cygwin.com/docs.html FAQ: http://cygwin.com/faq/ -- Corinna Vinschen Please, send mails regarding Cygwin to Cygwin Co-Project Leader mailto:[EMAIL PROTECTED] Red Hat, Inc. -- Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple Problem reports: http://cygwin.com/problems.html Documentation: http://cygwin.com/docs.html FAQ: http://cygwin.com/faq/
Re: Re: ssh password
please delete my email address from mail list.thanks! === 2004-05-06 21:27:53 === On Thu, 6 May 2004, David Corbin wrote: I'm very confused. When ssh to cygwin sshd, how does it try to match the password? It doesn't. It delegates to Windows. Igor -- http://cs.nyu.edu/~pechtcha/ |\ _,,,---,,_ [EMAIL PROTECTED] ZZZzz /,`.-'`'-. ;-;;,_ [EMAIL PROTECTED] |,4- ) )-,_. ,\ ( `'-' Igor Pechtchanski, Ph.D. '---''(_/--' `-'\_) fLa.k.a JaguaR-R-R-r-r-r-.-.-. Meow! I have since come to realize that being between your mentor and his route to the bathroom is a major career booster. -- Patrick Naughton -- Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple Problem reports: http://cygwin.com/problems.html Documentation: http://cygwin.com/docs.html FAQ: http://cygwin.com/faq/ = = = = = = = = = = = = = = = = = = = = fishing [EMAIL PROTECTED] 2004-08-11
Re: ssh password
On Thu, 6 May 2004, David Corbin wrote: I'm very confused. When ssh to cygwin sshd, how does it try to match the password? It doesn't. It delegates to Windows. Igor -- http://cs.nyu.edu/~pechtcha/ |\ _,,,---,,_[EMAIL PROTECTED] ZZZzz /,`.-'`'-. ;-;;,_[EMAIL PROTECTED] |,4- ) )-,_. ,\ ( `'-' Igor Pechtchanski, Ph.D. '---''(_/--' `-'\_) fL a.k.a JaguaR-R-R-r-r-r-.-.-. Meow! I have since come to realize that being between your mentor and his route to the bathroom is a major career booster. -- Patrick Naughton -- Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple Problem reports: http://cygwin.com/problems.html Documentation: http://cygwin.com/docs.html FAQ: http://cygwin.com/faq/
Re: ssh password
On Thu, 6 May 2004, Igor Pechtchanski wrote: On Thu, 6 May 2004, David Corbin wrote: I'm very confused. When ssh to cygwin sshd, how does it try to match the password? It doesn't. It delegates to Windows. Upon re-reading the above, I realized that you didn't clarify which Windows version you were asking about. IIRC, on Win9x the passwords can be crypted into /etc/passwd directly. On WinNT/2k/XP, the authentication is delegated to the OS. Igor -- http://cs.nyu.edu/~pechtcha/ |\ _,,,---,,_[EMAIL PROTECTED] ZZZzz /,`.-'`'-. ;-;;,_[EMAIL PROTECTED] |,4- ) )-,_. ,\ ( `'-' Igor Pechtchanski, Ph.D. '---''(_/--' `-'\_) fL a.k.a JaguaR-R-R-r-r-r-.-.-. Meow! I have since come to realize that being between your mentor and his route to the bathroom is a major career booster. -- Patrick Naughton -- Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple Problem reports: http://cygwin.com/problems.html Documentation: http://cygwin.com/docs.html FAQ: http://cygwin.com/faq/
Re: ssh password
On Thursday 06 May 2004 09:30, Igor Pechtchanski wrote: On Thu, 6 May 2004, Igor Pechtchanski wrote: On Thu, 6 May 2004, David Corbin wrote: I'm very confused. When ssh to cygwin sshd, how does it try to match the password? It doesn't. It delegates to Windows. Upon re-reading the above, I realized that you didn't clarify which Windows version you were asking about. IIRC, on Win9x the passwords can be crypted into /etc/passwd directly. On WinNT/2k/XP, the authentication is delegated to the OS. Igor Well, I'm dealing with a WIN2K Pro box that is part of a Domain. However, my password will not work. David -- Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple Problem reports: http://cygwin.com/problems.html Documentation: http://cygwin.com/docs.html FAQ: http://cygwin.com/faq/
Re: ssh password
On Thursday 06 May 2004 20:49, David Corbin wrote: On Thursday 06 May 2004 09:30, Igor Pechtchanski wrote: On Thu, 6 May 2004, Igor Pechtchanski wrote: On Thu, 6 May 2004, David Corbin wrote: I'm very confused. When ssh to cygwin sshd, how does it try to match the password? It doesn't. It delegates to Windows. Upon re-reading the above, I realized that you didn't clarify which Windows version you were asking about. IIRC, on Win9x the passwords can be crypted into /etc/passwd directly. On WinNT/2k/XP, the authentication is delegated to the OS. Igor Well, I'm dealing with a WIN2K Pro box that is part of a Domain. However, my password will not work. Please Ignore this last message. -- Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple Problem reports: http://cygwin.com/problems.html Documentation: http://cygwin.com/docs.html FAQ: http://cygwin.com/faq/
