X-Recipient:	archive-cygwin AT delorie DOT com
X-SWARE-Spam-Status:	No, hits=-2.6 required=5.0 tests=BAYES_00,SPF_PASS
X-Spam-Check-By:	sourceware.org
Message-ID:	<4A50EBA3.9090000@gmail.com>
Date:	Sun, 05 Jul 2009 11:06:27 -0700
From:	Ian Kelling <smallnow AT gmail DOT com>
User-Agent:	Thunderbird 2.0.0.22 (Windows/20090605)
MIME-Version:	1.0
To:	cygwin AT cygwin DOT com
Subject:	ssh-host-config eval password bug
X-IsSubscribed:	yes
Mailing-List:	contact cygwin-help AT cygwin DOT com; run by ezmlm
List-Id:	<cygwin.cygwin.com>
List-Subscribe:	<mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive:	<http://sourceware.org/ml/cygwin/>
List-Post:	<mailto:cygwin AT cygwin DOT com>
List-Help:	<mailto:cygwin-help AT cygwin DOT com>, <http://sourceware.org/ml/#faqs>
Sender:	cygwin-owner AT cygwin DOT com
Mail-Followup-To:	cygwin AT cygwin DOT com
Delivered-To:	mailing list cygwin AT cygwin DOT com

In the ssh package there is a bug in /usr/bin/ssh-host-config where if you 
select a valid password spaces or punctuation that bash knows of, it will 
fail and you could possibly shoot yourself in the foot due to evaling your 
password. I don't know who is responsible, or what mailing list to post on, 
but here is a patch.

- Ian Kelling

--- ssh-host-config.old	2009-05-29 22:35:16.244777500 -0700
+++ ssh-host-config	2009-05-29 22:40:31.234257500 -0700
@@ -323,12 +323,12 @@

  	if [ -n "${csih_cygenv}" ]
  	then
-	  cygwin_env="-e CYGWIN=\"${csih_cygenv}\""
+	  cygwin_env=( -e "CYGWIN=${csih_cygenv}" )
  	fi
  	if [ -z "${password}" ]
  	then
-	  if eval cygrunsrv -I sshd -d \"CYGWIN sshd\" -p /usr/sbin/sshd \
-			    -a "-D" -y tcpip ${cygwin_env}
+	  if cygrunsrv -I sshd -d "CYGWIN sshd" -p /usr/sbin/sshd \
+			    -a "-D" -y tcpip "${cygwin_env[@]}"
  	  then
  	    echo
  	    csih_inform "The sshd service has been installed under the LocalSystem"
@@ -337,8 +337,8 @@
  	    csih_inform "will start automatically after the next reboot."
  	  fi
  	else
-	  if eval cygrunsrv -I sshd -d \"CYGWIN sshd\" -p /usr/sbin/sshd \
-			    -a "-D" -y tcpip ${cygwin_env} \
+	  if cygrunsrv -I sshd -d "CYGWIN sshd" -p /usr/sbin/sshd \
+			    -a "-D" -y tcpip "${cygwin_env[@]}" \
  			    -u "${run_service_as}" -w "${password}"
  	  then
  	    echo


--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

- Raw text -