Domain User restrictions - Windows server 2012 R2

[Brian Inglis]

On 2019-07-03 02:41, Bergbauer, Daniel AVL/DE via cygwin wrote:
> I know the user restriction topic with ssh was discussed a lot and there are 
> also a few solutions out there but really nothing is working for me (Domain
> Users)...
> In our company we are using cygwin on each of our machines to be able to run 
> our projects with GNU make (everyone uses Windows 10)!
> I also developed a tool, with which all employees are able to synchronize 
> their projects from their (slow) machines to our server (Windows Server 2012
> R2), run the make on the (fast) server, and synch the output back.
> All that works with a cygwin ssh connection + rsync!
> Informations:
> * Cygwin (also ssh service) on the server is up and running on 
>   C:\tools\cygwin
> * Added Domain Users group to /etc/group of cygwin installation (means 
>   everyone can login with their windows password!):
>   Domain Users:S-1-5-21-1054012322-559123688-2072061207-513:1049089:
>   (Domain Users has a whitespace in it)
> * Added every Domain User to passwd file. ( with mkpasswd -d -u u89x77 )
>   After that the user is able to login with ssh to the server with his windows 
>   password (because of Domain Users of course)
>   Looks like this:
>   u89x77:*:1441234:1049123:U-OTP01\u89x77,S-1-5-21-1054012322-559123688- 
>   2072061207-398637:/home/u89x77:/bin/bash> * Mapped following directories in fstab file:
> 1. C:/tools/cygwin /
> 2. C:/projects /home (because the home folder of every user is: 
>    C:\projects\username)
> 3. C:/tools/cygwin/bin /usr/bin
> 4. C:/tools/cygwin/lib /usr/lib
>   (I cannot remember why I mapped point 3 & 4)
> * Created RSA keys for EVERY user on the user's machine and put it into 
>   his/her home folder on the server with ssh-copy-id ... 
>   (/home/u89x77/.ssh == C:\projects\u89x77\.ssh).
> Everyone is now able to connect to his folder on the server without giving 
> his/her windows password again (I had to do this because my tool to synch
> works with 'rsync')
> What I want now is, to restrict every user, who connects to the server via
> ssh, to its home folder /home/'username' == C:\projects\'username'
> For example: A user's username in our domain is u89x77. He's able to login 
> normally via ssh but is also able to cd for example into C:\Windows or worse 
> into C:\projects\'other username'\'absolute secret project'.
> And that is not what I want. The user should be blocked to cd out of 
> C:\projects\u89x77 but of course needs to look inside his folder like cd 
> C:\projects\'u89x77\'u89x77 project'.
> [X] I tried a lot of things up to now and also made a lot of research. But 
> unfortuneatly nothing worked...
> 1) Changed sshd_config file in cygwin/etc to:
>    # Subsystem        sftp    /usr/sbin/sftp-server
>    Subsystem   sftp  internal-sftp
>    ChrootDirectory   /home
>    Match user u89x77
>      ChrootDirectory /home/u89x77
>      X11Forwarding no
>      AllowTcpForwarding no
>      ForceCommand internal-sftp
> 2) Tried the same with Match group "Domain Users"...
> 3) Also changed the ID of cyg_server to *:0:  in the passwd file.
> 4) Tried to change the owner of the different folders like C:\tools\cygwin to
>    Administrator or cyg_server (but only windows/ACL rights...probably trying
>    this with chown?...)
> All that did not work.
> I am absolutely clueless right now, read so much in the last months and 
> nothing worked and now comes the time where it gets really important,
> because there'll be a few security projects and so on...
> This is the first time for me sending a mail here I don't even know if it is 
> the right way, but I did not see any other forum or whatever.
> Thank you very much in advance.
> I am happy about every idea you have!

If there is a solution, it is usually from the creative application of the
explanations given locally in:

	/usr/share/doc/cygwin-doc/html/cygwin-ug-net/ntsec.html

remotely at:

	https://cygwin.com/cygwin-ug-net/ntsec.html

-- 
Take care. Thanks, Brian Inglis, Calgary, Alberta, Canada

This email may be disturbing to some readers as it contains
too much technical detail. Reader discretion is advised.

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple