X-Recipient:	archive-cygwin AT delorie DOT com
X-SWARE-Spam-Status:	No, hits=-1.6 required=5.0 tests=AWL,BAYES_00,RCVD_IN_DNSWL_NONE,RP_MATCHES_RCVD,UNPARSEABLE_RELAY
X-Spam-Check-By:	sourceware.org
Message-ID:	<4E91A543.4050200@t-online.de>
Date:	Sun, 09 Oct 2011 15:44:35 +0200
From:	Christian Franke <Christian DOT Franke AT t-online DOT de>
User-Agent:	Mozilla/5.0 (Windows NT 6.1; WOW64; rv:7.0.1) Gecko/20110928 Firefox/7.0.1 SeaMonkey/2.4.1
MIME-Version:	1.0
To:	cygwin AT cygwin DOT com
Subject:	Re: 1.7.9: login via ssh allows Administrator privileges
References:	<loom DOT 20111009T004052-731 AT post DOT gmane DOT org>
In-Reply-To:	<loom.20111009T004052-731@post.gmane.org>
X-IsSubscribed:	yes
Mailing-List:	contact cygwin-help AT cygwin DOT com; run by ezmlm
List-Id:	<cygwin.cygwin.com>
List-Subscribe:	<mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive:	<http://sourceware.org/ml/cygwin/>
List-Post:	<mailto:cygwin AT cygwin DOT com>
List-Help:	<mailto:cygwin-help AT cygwin DOT com>, <http://sourceware.org/ml/#faqs>
Sender:	cygwin-owner AT cygwin DOT com
Mail-Followup-To:	cygwin AT cygwin DOT com
Delivered-To:	mailing list cygwin AT cygwin DOT com

Michael Hoffman wrote:
> When I log in via ssh I find I have Administrator privileges:
>
> $ id -a
> uid=1000(Michael) gid=513(None) groups=513(None),545(Users)
>
> $ ssh localhost
>
> # id -a
> uid=1000(Michael) gid=513(None)
> groups=513(None),0(root),544(Administrators),545(Users)
>
> Is there a way to turn this off or remove myself from the Administrators and
> root groups? I prefer not to have administrative access unless I explicitly
> request it.

Restarting the shell through cygdrop from cygutils package may help:

# exec cygdrop /bin/bash -l

This does essentially the same as Windows if UAC is enabled: The process 
is started with a restricted token where admin group(s) and privileges 
are removed.

The cygdrop -v option prints the removed groups and privileges, -vv 
prints also the preserved ones. There are also options to control which 
groups or privileges are removed in case the default is not suitable.

-- 
Christian Franke


--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

- Raw text -