Mail Archives: cygwin/2004/08/30/01:00:29
Introduction
There is another message with this message, "OpenSSH-3.9p1-1, mysterious
-r option, and documented steps to resolve "Connection to host closed."
message was sshd privilege" DO NOT USE IT. This email has been revised
from that original message.
This document is a temporary workaround. Do not use it in the future
once the corrected Cygwin DLL has been published. Do not link to this
message because it will be wrong in the future once the corrected Cygwin
DLL has been published.
I decided on the -r option verses installing a new Cygwin DLL. It
sounded like the more conservative repair approach. It also sounded
like it my take more time than I had. If you use the Cygwin DLL repair
approach, then you do not need the reset of this email message.
If you are looking for the undocumented -r option a brief note can be
found here http://www.mail-archive.com/cygwin AT cygwin DOT com/msg43331.html.
There's nothing that I found in the man page nor on
http://www.openssh.org about the sshd -r option. Again you do not have
to use this -r option in the future with Cygwin. It is a temporary
workaround for a Cygwin DLL issue that occurs with the OpenSSH-3.9p1-1
Cygwin package.
Google Terms
If the subject title of "OpenSSH-3.9p1-1, mysterious -r option, and
documented steps to resolve "Connection to host closed." message was
sshd privilege separation problem" did not provide you enough search
terms here are some more cygwin-1.5.10-3 package
upgrading openssh 3.8.1p1-1 -> 3.9p1-1 breaks privilege separation.
Background
I spent several hours trying to find the correct workaround. Part of
the problem was this -r that does not _appear_ to be documented
anywhere. I offer my notes to hopefully save you some time if you
should run in to the privilege separation problem. This problem appears
to occur with openssh 3.0p1-1 and cygwin-1.5.10-3.
Moreover, the Cygwin approved install script needed an edit because two
options were supplied to it for the cygrunsrv command. I have tested and
documented two ways to solve this problem. If editing files and regular
expressions bother you then try the first option. A third option was
proposed on this list, but it does not look like it was tested. I will
offer only what I know and appears to work for me to solve the
"Connection to host closed" message. Moreover, you will still need to
test what I offer here and see if it works for you. Finally, my
solution was tested behind a firewall so if there are any security risks
they are limited. The -r option is solves a DLL bug. I don't know if
it reduces security with the OpenSSH Cygwin package.
The Solutions
OPTION 1.)
I ran
ssh-host-config y
at the command prompt just to make sure I had the rest of ssh setup
correctly. I performed this step because of all the fooling around I
tried to resolve the "Connection to host closed." messages without
knowing what the problem was. You may not need to perform this step
depending on what happened to you.
Then I removed the services entry by entering
cygrunsrv -R sshd
at the command prompt. A harmless error message will be displayed if
you do not have the service running. But you will know that the sshd
service has been removed and that you can proceed.
I looked at Cygwin /usr/bin/ssh-host-config configuration script and
found the command line that I would use:
cygrunsrv -I sshd -d "CYGWIN sshd" -p /usr/sbin/sshd \
-a -D -e "CYGWIN=ntsec"
Please note there is another version of this command in the shell
script. That may be the correct version for you. Option 2 may be a
better solution if you are not sure.
I modified this command string to
cygrunsrv -I sshd -d "CYGWIN sshd" -p /usr/sbin/sshd \
-a "-D -r" -e "CYGWIN=ntsec"
This was the command line I ran at the command prompt to supply the -r
option that Corinna said was required _for_the_temporary_workaround_.
Please enter the command all on one line without the \, or make sure the
\, the continuation character, is the last character on the line before
starting the -a on the second line.
Finally, I started the service by issuing this command at the Cygwin
command prompt.
cygrunsrv -S sshd
OPTION 2.)
An alternate method is to enter
vim /usr/bin/ssh-host-config
on the command line. Then use vim's search and replace functions to
change all the sshd -a -D occurrences to sshd -a "-D -r" like so
:%s/sshd -a -D/sshd -a "-D -r"/g
Finally, issue the following commands at the command prompt.
cygrunsrv -R sshd
ssh-host-config -y -c "ntsec"
cygrunsrv -S sshd
The Good Luck Disclaimer
Please note there are many links out on the Internet that still show
ntsec and tty. It sounds like these are wrong for some combinations of
Cygwin and MS Windows platforms. I don't know what they are so I cannot
offer you a solution. The ntsec is redundant. Again it may be required
for some earlier versions of MS Windows but that I cannot tell you if
that is correct. The solutions were tested on an MS Windows 2000 box.
ntsec sounds correct for this box but redundant. The reason I bothered
typing it in is that if you run ssh-host-config -y or ssh-host-config -y
-c, the shell script prompts you for something to put in the CYGWIN
environment variable. ntsec appears to be redundant but seems harmless
in this context of MS Windows 2000. The ntsec is supposed to be
redundant because sshd uses it by default as I recall.
I successfully sshed into my Cygwin PC with the new ssh package
OpenSSH_3.9p1, OpenSSL 0.9.7d 17 Mar 2004 using both resolution
procedures above. Note that scp operations were not affected by the
Cygwin DLL issue. If you have read this far, then you would know that
this is just a temporary solution. LOL I am not affiliated with Cygwin.
I am just a user on the Cygwin mailing list. "But,...I mean where
else would you expect to find cygwin ssh help than on a..." Cygwin
mailing list. But would trust a user providing help with a user id
called "drkludge"? LOL
Greg
--
Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple
Problem reports: http://cygwin.com/problems.html
Documentation: http://cygwin.com/docs.html
FAQ: http://cygwin.com/faq/
- Raw text -