This is the mail archive of the cygwin mailing list for the Cygwin project.
Index Nav: | [Date Index] [Subject Index] [Author Index] [Thread Index] | |
---|---|---|
Message Nav: | [Date Prev] [Date Next] | [Thread Prev] [Thread Next] |
Other format: | [Raw text] |
* This release deprecates the sshd_config UsePrivilegeSeparation option, thereby making privilege separation mandatory.
This has (probably not wholly intended) consequences when running sshd in single user (non root) mode:
$ /usr/sbin/sshd -D -f ~/.ssh/sshd_config Privilege separation user sshd does not existThe problem is not limited to Cygwin, but is unlikely to happen in a typical Unix, since ssh is probably installed globally.
If Cygwin was installed without administrative privileges, creating a dedicated sshd user would be impossible (and makes little sense if sshd runs in single user mode, anyway). I guess it would be possible to add a fake user account in /etc/passwd.
Since user sshd and chroot /var/empty are not used in single user mode, it might be better to remove the check in this case:
=== cut after === diff --git a/sshd.c b/sshd.c index 010a2c3..4f9b2c8 100644 --- a/sshd.c +++ b/sshd.c @@ -1641,7 +1641,8 @@ main(int ac, char **av) /* Store privilege separation user for later use if required. */ if ((privsep_pw = getpwnam(SSH_PRIVSEP_USER)) == NULL) { - if (use_privsep || options.kerberos_authentication) + if ((use_privsep || options.kerberos_authentication) + && (getuid() == 0 || geteuid() == 0)) fatal("Privilege separation user %s does not exist", SSH_PRIVSEP_USER); } else { @@ -1767,7 +1768,7 @@ main(int ac, char **av) key_type(key)); } - if (use_privsep) { + if (use_privsep && (getuid() == 0 || geteuid() == 0)) { struct stat st; if ((stat(_PATH_PRIVSEP_CHROOT_DIR, &st) == -1) || === cut before === Best regards, -- Lionel
Attachment:
signature.asc
Description: PGP signature
Index Nav: | [Date Index] [Subject Index] [Author Index] [Thread Index] | |
---|---|---|
Message Nav: | [Date Prev] [Date Next] | [Thread Prev] [Thread Next] |