Re: openssh: privilege separation no longer supported on Cygwin? SURPRISE!

2017-05-31 Thread Larry Hall (Cygwin)
On 05/31/2017 05:37 AM, Houder wrote: On Tue, 30 May 2017 21:28:41, "Larry Hall (Cygwin)" wrote: [snip] Cygwin's link to the Windows user ID is through the UID/SID mapping. In your case, you're apparently using /etc/passwd and so that's where the mapping happens. You can map the UID of a Cygw

Re: openssh: privilege separation no longer supported on Cygwin? SURPRISE!

2017-05-31 Thread Andrey Repin
Greetings, Houder! > Anyone out there, who uses AD, in stead of /etc/{passwd,group}, Nobody here uses "/etc/{passwd,group}" anymore, except for very special cases. This is not related to AD. -- With best regards, Andrey Repin Wednesday, May 31, 2017 23:14:34 Sorry for my terrible english...

Re: openssh: privilege separation no longer supported on Cygwin? SURPRISE!

2017-05-31 Thread cyg Simple
On 5/31/2017 12:34 PM, Houder wrote: > On Wed, 31 May 2017 10:59:38, cyg Simple wrote: >> On 5/31/2017 10:16 AM, Houder wrote: >>> On Wed, 31 May 2017 09:27:02, cyg Simple wrote: >>> >>> [snip] All of this talk of /etc/passwd leads me to point you to https://cygwin.com/cygwin-ug-net/ntsec

Re: openssh: privilege separation no longer supported on Cygwin? SURPRISE!

2017-05-31 Thread Houder
On Wed, 31 May 2017 10:59:38, cyg Simple wrote: > On 5/31/2017 10:16 AM, Houder wrote: > > On Wed, 31 May 2017 09:27:02, cyg Simple wrote: > > > > [snip] > >> All of this talk of /etc/passwd leads me to point you to > >> https://cygwin.com/cygwin-ug-net/ntsec.html. > > > > cyg, > > > > Do you wa

Re: openssh: privilege separation no longer supported on Cygwin? SURPRISE!

2017-05-31 Thread cyg Simple
On 5/31/2017 10:16 AM, Houder wrote: > On Wed, 31 May 2017 09:27:02, cyg Simple wrote: > > [snip] >> All of this talk of /etc/passwd leads me to point you to >> https://cygwin.com/cygwin-ug-net/ntsec.html. > > cyg, > > Do you want me to study that text a second, third, fourth or Xth time ...? >

Re: openssh: privilege separation no longer supported on Cygwin? SURPRISE! -- minor correction

2017-05-31 Thread Houder
On Wed, 31 May 2017 16:16:38, Houder wrote: [snip] > Anyone out there, who uses AD, in stead of /etc/{passwd,group}, and is brave > enough to delete the sshd account? Is ssh still working? i.e. NOT from AD, but delete as an account (net user sshd /delete). Regards, Henri -- Problem reports:

Re: openssh: privilege separation no longer supported on Cygwin? SURPRISE!

2017-05-31 Thread Houder
On Wed, 31 May 2017 09:27:02, cyg Simple wrote: [snip] > All of this talk of /etc/passwd leads me to point you to > https://cygwin.com/cygwin-ug-net/ntsec.html. cyg, Do you want me to study that text a second, third, fourth or Xth time ...? However, let me take another angle now ... Active Dir

Re: openssh: privilege separation no longer supported on Cygwin? SURPRISE!

2017-05-31 Thread cyg Simple
On 5/31/2017 5:37 AM, Houder wrote: > On Tue, 30 May 2017 21:28:41, "Larry Hall (Cygwin)" wrote: > > [snip] >> Cygwin's link to the Windows user ID is through the UID/SID mapping. In >> your case, you're apparently using /etc/passwd and so that's where the >> mapping happens. You can map the UID

Re: openssh: privilege separation no longer supported on Cygwin? SURPRISE!

2017-05-31 Thread Houder
On Tue, 30 May 2017 21:28:41, "Larry Hall (Cygwin)" wrote: [snip] > Cygwin's link to the Windows user ID is through the UID/SID mapping. In > your case, you're apparently using /etc/passwd and so that's where the > mapping happens. You can map the UID of a Cygwin user to any valid Windows > SID

Re: openssh: privilege separation no longer supported on Cygwin? SURPRISE!

2017-05-30 Thread Larry Hall (Cygwin)
On 05/30/2017 09:50 AM, Houder wrote: On Mon, 29 May 2017 19:14:30, Houder wrote: [snip] As if the "sshd" account is NEVER, NEVER used during the _whole_ process (that is, there is NO privilege separation, as far as I can tell). .. wanted to share this experience with you. - deleted user/a

Re: openssh: privilege separation no longer supported on Cygwin? SURPRISE!

2017-05-30 Thread Houder
On Mon, 29 May 2017 19:14:30, Houder wrote: [snip] > As if the "sshd" account is NEVER, NEVER used during the _whole_ process > (that is, there is NO privilege separation, as far as I can tell). .. wanted to share this experience with you. - deleted user/account 'sshd' # net user sshd /delete

Re: openssh: privilege separation no longer supported on Cygwin? SURPRISE!

2017-05-29 Thread Houder
On 2017-05-29 21:57, Andrey Repin wrote: Greetings, Houder! - however, the userid of the grandchild of the sshd listener, is STILL cyg_server ... NOT sshd! Exactly. cyg_server is the user which does impersonation. You've been told that when you've been setting up your host. http:

Re: openssh: privilege separation no longer supported on Cygwin? SURPRISE!

2017-05-29 Thread Andrey Repin
Greetings, Houder! > - however, the userid of the grandchild of the sshd listener, is STILL > cyg_server ... NOT sshd! Exactly. cyg_server is the user which does impersonation. You've been told that when you've been setting up your host. > As if the "sshd" account is NEVER, NEVER used duri

Re: openssh: privilege separation no longer supported on Cygwin? SURPRISE!

2017-05-29 Thread Houder
On 2017-05-29 11:48, Houder wrote: On 2017-05-29 10:39, Marco Atzeri wrote: On 29/05/2017 07:23, Houder wrote: [snip] ... because, that is, I think, what I am seeing: - the userid of child sshd is still 'cyg_server' ... - and I get an elevated shell when I login ... Not what I expected ..