X-Recipient:	archive-cygwin AT delorie DOT com
DomainKey-Signature:	a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:message-id:date:from:mime-version:to:subject
	:references:in-reply-to:content-type:content-transfer-encoding;
	q=dns; s=default; b=tMG2AooxBBQXsB3xOzDXYNEXMnjtbnar6iUDYbyUjiW
	UpSKSWC58Hpsv/rrPdUQoVQkjrEZ00iB2U/f2wc7S140G5n7AYp3tHtoCKepgyHx
	XVFys+u7lpKm885R2JeC2aHudq3hbAxF/3qYzay46ms8hWMb0+iLkBOc2Ch9ykgk
	=
DKIM-Signature:	v=1; a=rsa-sha1; c=relaxed; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:message-id:date:from:mime-version:to:subject
	:references:in-reply-to:content-type:content-transfer-encoding;
	s=default; bh=Bb9huCD6fA6XJGhxgLNZnJCWybI=; b=fYL4ryZE0dk8USu2C
	UeYpNirkTUOUX4uEns0a2TxJ3vB6xKtuv0J9RNsufRinqwlMIX8UQdXZB5/+487A
	5RG2I0QbYicuNJjQsxp7UU4GJbsmyMWqPo9pTH1kNQiOSCw9UfUzwDMjnfbSYoB4
	OIb9qf5IXfd6hE7AZQSBLJaRPE=
Mailing-List:	contact cygwin-help AT cygwin DOT com; run by ezmlm
List-Id:	<cygwin.cygwin.com>
List-Subscribe:	<mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive:	<http://sourceware.org/ml/cygwin/>
List-Post:	<mailto:cygwin AT cygwin DOT com>
List-Help:	<mailto:cygwin-help AT cygwin DOT com>, <http://sourceware.org/ml/#faqs>
Sender:	cygwin-owner AT cygwin DOT com
Mail-Followup-To:	cygwin AT cygwin DOT com
Delivered-To:	mailing list cygwin AT cygwin DOT com
Authentication-Results:	sourceware.org; auth=none
X-Virus-Found:	No
X-Spam-SWARE-Status:	No, score=-1.9 required=5.0 tests=AWL,BAYES_00,SPF_HELO_PASS,SPF_PASS,T_RP_MATCHES_RCVD autolearn=ham version=3.3.2
X-HELO:	limerock04.mail.cornell.edu
X-CornellRouted:	This message has been Routed already.
Message-ID:	<548AFD43.1040306@cornell.edu>
Date:	Fri, 12 Dec 2014 09:35:47 -0500
From:	Ken Brown <kbrown AT cornell DOT edu>
User-Agent:	Mozilla/5.0 (Windows NT 6.1; WOW64; rv:31.0) Gecko/20100101 Thunderbird/31.3.0
MIME-Version:	1.0
To:	cygwin AT cygwin DOT com
Subject:	Re: TEST RELEASE: Cygwin 1.7.34-002
References:	<20141206194943 DOT GD3810 AT calimero DOT vinschen DOT de> <CAMKht8iYnRuAJ7Eau6LDa_Jszxwo8YwybzwZNHjzWXLMUS8Y-w AT mail DOT gmail DOT com>
In-Reply-To:	<CAMKht8iYnRuAJ7Eau6LDa_Jszxwo8YwybzwZNHjzWXLMUS8Y-w@mail.gmail.com>
X-IsSubscribed:	yes

On 12/12/2014 8:49 AM, Michael DePaulo wrote:
> On Sat, Dec 6, 2014 at 2:49 PM, Corinna Vinschen
> <corinna-cygwin AT cygwin DOT com> wrote:
>> I finally released another TEST version of the next upcoming Cygwin
>> release.  The version number is 1.7.34-002.
>
> I *think* I am experiencing a very bad regression.
>
> These are the Windows permissions on my ~/.ssh/id_rsa file:
> C:\cygwin\home\mike\.ssh>icacls id_rsa
> id_rsa NT AUTHORITY\SYSTEM:(F)
>         DEPAULO\mike:(R,W,D,WDAC,WO)
>
> Under cygwin 1.7.33-2, I am able to use the file fine:
>
> mike AT executor ~
> $ uname -a
> CYGWIN_NT-6.3-WOW64 executor 1.7.33-2(0.280/5/3) 2014-11-13 15:45 i686 Cygwin
>
> mike AT executor ~
> $ ssh galactica
> Enter passphrase for key '/home/mike/.ssh/id_rsa':
> Last login: Fri Dec 12 08:36:39 2014 from executor.depaulo.org
> mike AT galactica:~ :) [1] $ exit
> logout
> Connection to galactica closed.
>
> mike AT executor ~
> $ cd .ssh
>
> mike AT executor ~/.ssh
> $ ls -latr id_rsa
> -rw------- 1 mike mkpasswd 1743 Dec  7  2013 id_rsa
>
>
> But under 1.7.34-002, I get a permissions error:
>
> mike AT executor ~
> $ uname -a
> CYGWIN_NT-6.3-WOW64 executor 1.7.34(0.282/5/3) 2014-12-06 18:03 i686 Cygwin
>
> mike AT executor ~
> $ ssh galactica
> @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
> @         WARNING: UNPROTECTED PRIVATE KEY FILE!          @
> @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
> Permissions 0670 for '/home/mike/.ssh/id_rsa' are too open.
> It is recommended that your private key files are NOT accessible by others.
> This private key will be ignored.
> key_load_private_type: bad permissions
> mike AT galactica's password:
>
>
> mike AT executor ~
> $ cd .ssh
>
> mike AT executor ~/.ssh
> $ ls -latr id_rsa
> -rw-rwx---+ 1 mike Domain Users 1743 Dec  7  2013 id_rsa

This isn't a regression.  It's a deliberate change, so that Cygwin now 
takes ACLs into account when calculating permissions.  The simplest fix 
is to use the new feature of setfacl to remove the unwanted permissions. 
  From the release announcement:

> - Add -b/--remove-all option to setfacl to reduce the ACL to only the
>   entries representing POSIX permission bits.

Ken


--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

- Raw text -