X-Recipient:	archive-cygwin AT delorie DOT com
DomainKey-Signature:	a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:mime-version:references:in-reply-to:from:date
	:message-id:subject:to:content-type; q=dns; s=default; b=YhGX9m7
	9CtPQAo3CswDAVaPEdbXanyh7SNkbaSH+fYrglvGKeS7RtqLA+Yoj1Kf5PstgppX
	mmPxZzO1AmvvbOMeJepFvptT/8K0gR/xS6/4blKovaojQ6PgV4pQbooX12Rl1yQu
	zzR80R+17cUucbYuV3d24guiHs7yK9lnEeho=
DKIM-Signature:	v=1; a=rsa-sha1; c=relaxed; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:mime-version:references:in-reply-to:from:date
	:message-id:subject:to:content-type; s=default; bh=USeTm9hJTJWR+
	RpRPnSRaTUDiTg=; b=lcVdIVIVBZLfkgEIFxksZiPC6N1VfzFklStHmDgAk214F
	lE5sUwPv6t0V38smjZV3nFm/5ZHqrJQ+JmuYzckIm9pNobQc8lcJK7uXRsZX8W54
	+ydctRgkOWdWsf3ow/WbpoI19EATd7aGS4MQpS33UCqXNTBU8nO/c6e3IlDMkE=
Mailing-List:	contact cygwin-help AT cygwin DOT com; run by ezmlm
List-Id:	<cygwin.cygwin.com>
List-Subscribe:	<mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive:	<http://sourceware.org/ml/cygwin/>
List-Post:	<mailto:cygwin AT cygwin DOT com>
List-Help:	<mailto:cygwin-help AT cygwin DOT com>, <http://sourceware.org/ml/#faqs>
Sender:	cygwin-owner AT cygwin DOT com
Mail-Followup-To:	cygwin AT cygwin DOT com
Delivered-To:	mailing list cygwin AT cygwin DOT com
Authentication-Results:	sourceware.org; auth=none
X-Spam-SWARE-Status:	No, score=-2.6 required=5.0 tests=BAYES_00,FREEMAIL_FROM,HTML_MESSAGE,RCVD_IN_DNSWL_LOW,SPF_PASS autolearn=ham version=3.3.2 spammy=downloaded, H*c:alternative, download
X-HELO:	mout.gmx.com
X-UI-Sender-Class:	214d933f-fd2f-45c7-a636-f5d79ae31a79
MIME-Version:	1.0
References:	<CANV9t=SSyof86c5Yz3tNhwj4To=eKnrmveQcr59ZmMY-X9_txA AT mail DOT gmail DOT com> <20190124154533 DOT GK2802 AT calimero DOT vinschen DOT de>
In-Reply-To:	<20190124154533.GK2802@calimero.vinschen.de>
From:	Bill Stewart <bstewart AT iname DOT com>
Date:	Thu, 24 Jan 2019 09:48:17 -0700
Message-ID:	<CANV9t=RAGYEqEXi3SHDR397TzvE9O3AUGaMJMCzk+_d3uM1d+Q@mail.gmail.com>
Subject:	Re: sshd permits logon using disabled user?
To:	cygwin AT cygwin DOT com

Hello Corinna,

I performed the following steps:

1. Downloaded cygwin-20190124.tar.xz
2. Extracted it
3. Stopped sshd
4. Renamed existing /bin/cygwin1.dll to cygwin1-20181108.dll
5. Copied cygwin1.dll from download to /bin
6. Started sshd

Did I miss anything?

It still allows logon with disabled account.

Thanks,

Bill


On Thu, Jan 24, 2019 at 8:45 AM Corinna Vinschen <corinna-cygwin AT cygwin DOT com>
wrote:

> On Jan 24 06:28, Bill Stewart wrote:
> > I am running Windows 10 (1803) and experimenting with sshd installed as a
> > Windows service.
> >
> > The computer is a domain member. I created a local computer account for
> > testing.
> >
> > I created host keys and a public/private key pair to use to log on the
> user.
> >
> > This works, except I notice that if I disable the Windows user account, I
> > can still log on using ssh using that account.
> >
> > In the shell, logged on as the disabled user, the 'whoami' command
> returns
> > the name of the disabled user.
> >
> > This seems unexpected and not good.
> >
> > Why does sshd allow logon for a disabled user?
>
> Because the underlying Cygwin function responsible for changing the user
> account only checks if the account exists.  It does not check for any of
> the flags in the user DB.  Yet.
>
> I pushed a patch to disallow changing the user account to a disabled or
> locked out account.
>
> I just uploaded new developer snapshots containing this change to
> https://cygwin.com/snapshots/
>
> Please give them a try.
>
>
> Thanks,
> Corinna
>
> --
> Corinna Vinschen
> Cygwin Maintainer
>

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

- Raw text -