X-Recipient:	archive-cygwin AT delorie DOT com
DKIM-Filter:	OpenDKIM Filter v2.11.0 sourceware.org B5AAA3858C60
DKIM-Signature:	v=1; a=rsa-sha256; c=relaxed/relaxed; d=cygwin.com;
	s=default; t=1707272799;
	bh=aMztMiiF+E7uuMcfdAcIPIDQlFAGeTUa8I6WQd9Gw28=;
	h=Date:Subject:To:References:In-Reply-To:List-Id:List-Unsubscribe:
	List-Archive:List-Post:List-Help:List-Subscribe:From:Reply-To:
	From;
	b=R2a4A741i9zdKAYFI0+oqRZJqjomYvRiI18MkgaLaODA3j7hhGAlhKvFYqRMD2Rbq
	CIkXWKTw7SoOJdJi3WbHnNZBSVtH4wGhzIBOZD5LQ/Mhglo0jAm79IVmlJ1IBloVw9
	lddgBsBwUmiwko22n/z3o5YHvlw/zoKbfBdl9l1Y=
X-Original-To:	cygwin AT cygwin DOT com
Delivered-To:	cygwin AT cygwin DOT com
DMARC-Filter:	OpenDMARC Filter v1.4.2 sourceware.org 7E5933858D33
ARC-Filter:	OpenARC Filter v1.0.0 sourceware.org 7E5933858D33
ARC-Seal:	i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1707272777; cv=none;
	b=NxaASFi8U/sD61Y0WDc868Yd1Zcw0IY7vtrrPwo39mIvAJbKnlDBzpR5T31m5iTsK6Qt4EC/T9Fx820l8Vrd9xdBcHQlPBHqQkGG3Bp/Jzv/OC7zJ9ZW+lpvYqoCz/ztcNHg+UcfwSOyHJVhqpZ7fzs7zI0vegxHM/tYNuQI0RI=
ARC-Message-Signature:	i=1; a=rsa-sha256; d=sourceware.org; s=key;
	t=1707272777; c=relaxed/simple;
	bh=nIiKa3cxf6JQvqRUtk4nbrxC4C/0fomFk/1IAEAZ6tM=;
	h=DKIM-Signature:Message-ID:Date:MIME-Version:Subject:To:From;
	b=xFaMwbBaqHz2jBIBZtV+EafsUepe6XeXQv+kpx4xk6Fbm5x9XbB5bHvWAOOjE8SFz7zieGJBjetsYT3ievJCTL7V8BweyfDOtxKUY5VDo8rBi0tgB232kci4ijhSQsblVgFcu3QdyTrHJIfIqpP0C3cCJj040onwo89MeLVJbHM=
ARC-Authentication-Results:	i=1; server2.sourceware.org
X-UI-Sender-Class:	724b4f7f-cbec-4199-ad4e-598c01a50d3a
Message-ID:	<14be4d61-0c8b-412d-9afe-c60f2e4b3b42@gmx.net>
Date:	Wed, 7 Feb 2024 03:26:12 +0100
MIME-Version:	1.0
User-Agent:	Mozilla Thunderbird
Subject:	Re: cygsshd fails due to bad ownership or modes of /cygdrive/c/Users
To:	cygwin AT cygwin DOT com
References:	<a2df2105-31b8-425c-a963-4ea98e2f2ffa AT f-us DOT de>
	<e10d1c13-b167-46b1-935d-edebcf307e9a AT gmx DOT net>
	<439a4aeb-e8f8-42c7-6c35-c303a9366368 AT cs DOT umass DOT edu>
	<b6f5af93-a7c1-428a-b6d3-5a9baaea3608 AT SystematicSW DOT ab DOT ca>
In-Reply-To:	<b6f5af93-a7c1-428a-b6d3-5a9baaea3608@SystematicSW.ab.ca>
X-Provags-ID:	V03:K1:tS7eK3yhoYE7sNCQVyB1cUyrZhYx+D6mN4jcjHN8Bxt/ebwrW+/
	9ltXr/x/cQTD0Vx7y92zypk2iYy/7RUaKlq2Oe4OjeWLWYR2e6VT7vZD0SRbqpDzv/JNcwO
	aJgSg3edz8op2BRgCFgm65eLFy2CzIvJQ+RJ+K4VYMvcLa7jzssuFTahhvrPQCwDdUZSXc9
	JsXTzgzEOg4hiNfoQdx4Q==
UI-OutboundReport:	notjunk:1;M01:P0:3FkpPtYLe/A=;jrNyFUnAuQjo3TYdZXYVH0RXNi+
	xd9m+BpyL2ifsUemTDDQdKVP8Cvo3pgDAETQSis2PEKtED8KGB8YZkBAndcJXMfRlSe/83KGN
	VWnmLI9V521xKVOhRlqjWXSIC/i9eBQC5anXNLMZXzhLHeTKJJy22DvZMXb7RoMigbRo6sztS
	KQFVXM0fYP2p682jMeD/2kbmQa/SCnvEOUevQ8leegJdbUhI4e6MZ2FTpF9VtiSrsOELiO8e4
	Pd0Nebhj44SR9x9oJBAeXug6hAuzj/7OMJfnFgz7t0baL85Ocv5U5jmejN/rkKlvVeFtfB55e
	69BsjJR4hVeuel2Dh2e8ZKKzvna1DmtwZU0za4VIEl/sYXgtT2SLCcFsoOshfWWuoMUNDbzVk
	+1Ac04hn8qTuKx3zFX7UarzKZ9J24f5i23kQEbkgEZdg8k0XYCVtiwik6i8N1txFhtecs/BT7
	bO7WqD3Vq/jI+Gkb8KoAynyb/b6+LOEpmiamKS6+A4EMCfnqZyjt+wCVfYBP0RNJXJF8XkNUS
	gzDcFmjuA1jbVLFspkaqbUh4cBNT8yOV3uLro5cpLsG/ReCScmbRRDnCtTuh9sOyYUW3fh7qj
	+MiFJkyCofT3ZQwSiYhhdj3RlSvMynfCeARhMfC9MeammtBqQKoDQk97RsHeLGeBYhYFPCY78
	2bL4vYhgQ0dgOaDNbVVS4UVepATK8fJJaqKdpfuslkAZRqC3ZakVew/BBzGjiJAemLmwJsekX
	1cIIkelxWjHTigH6QYiXyrYi/rZHbjxSkTwcmOkypcbiceE08mwwqqvYVvITbR5PodGMJUPT+
	ZSeHKOoVn3p3C75PFPesStCM4ROtYdprXyE92BYIUM1w0=
X-Spam-Status:	No, score=-1.1 required=5.0 tests=BAYES_00, BODY_8BITS,
	DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, FREEMAIL_FROM,
	GB_FREEMAIL_DISPTO, KAM_SHORT, RCVD_IN_DNSWL_LOW, RCVD_IN_MSPIKE_H4,
	RCVD_IN_MSPIKE_WL, SPF_HELO_NONE, SPF_PASS, TXREP,
	T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version:	SpamAssassin 3.4.6 (2021-04-09) on
	server2.sourceware.org
X-BeenThere:	cygwin AT cygwin DOT com
X-Mailman-Version:	2.1.30
List-Id:	General Cygwin discussions and problem reports <cygwin.cygwin.com>
List-Archive:	<https://cygwin.com/pipermail/cygwin/>
List-Post:	<mailto:cygwin AT cygwin DOT com>
List-Help:	<mailto:cygwin-request AT cygwin DOT com?subject=help>
List-Subscribe:	<https://cygwin.com/mailman/listinfo/cygwin>,
	<mailto:cygwin-request AT cygwin DOT com?subject=subscribe>
From:	Frank-Ulrich Sommer via Cygwin <cygwin AT cygwin DOT com>
Reply-To:	Frank-Ulrich Sommer <f-u DOT s AT gmx DOT net>
Sender:	"Cygwin" <cygwin-bounces+archive-cygwin=delorie DOT com AT cygwin DOT com>
X-MIME-Autoconverted:	from base64 to 8bit by delorie.com id 4172QfN7024124

On 06.02.2024 22:22, Brian Inglis via Cygwin wrote:
> On 2024-02-05 18:36, Eliot Moss via Cygwin wrote:
>> On 2/5/2024 8:28 PM, Frank-Ulrich Sommer via Cygwin wrote:
>>> On 05.02.2024 00:53, Frank-Ulrich Sommer via Cygwin wrote:
>>>> I'm trying to run cygsshd on my PC with Windows 11 and connect from a linux machine. I have added the public key to /cygdrive/c/Users/xxx/.ssh/authorized_keys and created a symbolic link from  /cygdrive/c/Users/xxx/.ssh to /home/xxx/.ssh. As usual I checked the access rights and mode of the .ssh directory (700 and belongs to user xxx) and the authorized_keys file (600 and also belongs to user xxx) and also of the home directory (had to change ownership).
>
> Change the symlink from Cygwin home to your home, as symlinks have a+rwx perms, so you can not use one for .ssh:
>
>     $ ln -sv `cygpath -aU "C:/Users/$USER"` /home/
>
Currently I'm reluctant to do this as my current cygwin home directory looks quite "clean" and does not contain hundreds of Windows files and subdirectories. I just added the link as the .ssh directory was automatically created as /cygdrive/c/Users/fus/.ssh and I wanted to have an easier access and avoid having two different .ssh directories which showed to be quite risky in the past.
>>>> Now I get the following strange messages:
>>>> [...]
>>>> Feb  5 00:35:50 XXXXX sshd: PID 2798: debug1: temporarily_use_uid: 197609/197121 (e=18/18)
>>>> Feb  5 00:35:50 XXXXX sshd: PID 2798: debug1: trying public key file /home/xxx/.ssh/authorized_keys
>>>> Feb  5 00:35:50 XXXXX sshd: PID 2798: debug1: fd 5 clearing O_NONBLOCK
>>>> Feb  5 00:35:50 XXXXX sshd: PID 2798: Authentication refused: bad ownership or modes for directory /cygdrive/c/Users
>>>> Feb  5 00:35:50 XXXXX sshd: PID 2798: debug1: restore_uid: 18/18
>>>> [...]
>>>> Why is cygsshd complaining about the Windows "Users" directory and not about the directory of user xxx (/cygdrive/c/Users/xxx)? And how can I solve this?
>
>>> Looking at the OpenSSH source code (on Github, not from Cygwin) I found a function "safe_path" that checks that the ownership and access modes for all path components are correct.  This relies on "platform_sys_dir_uid" which checks if a UID may own a system directory. The code checks for UID zero and might also accept an OS specific second value (PLATFORM_SYS_DIR_UID) but for Cygwin this seems not to be set. But I don't know where to find the source code for the exact version that is used in Cygwin and I'm unsure about build settings.
>
> Run Cygwin setup and select package openssh Source checkbox to download the source package, or go to your Cygwin upstream mirror and download the source tarball shown in setup.ini prefixed with your nearest Cygwin mirror site e.g.
>
> https://ftp.fau.de/cygwin/x86_64/release/openssh/openssh-9.6p1-1-src.tar.xz
>
> Build settings are in the Cygwin package build control script definitions file openssh.cygport in the source tarball or build repo:
>
>     https://cygwin.com/cgit/cygwin-packages/openssh/tree/openssh.cygport
>
> ...
>     --disable-strip
>        --with-kerberos5=/usr
>            --libexecdir=/usr/sbin
>            --with-xauth=/usr/bin/xauth
>        --with-libedit
>        --with-security-key-builtin
>
Thanks for that tip, I found and installed it and succeeded to build it with additional info in the error message (see below).
>>> A comment defines this a safe path as follows:
>>> "This is defined as all components of the path to the file must be owned by either the owner of the file or root and no directories must be group or world writable."
>
>>> The "Users" directory is owned by "SYSTEM" (numeric: 18 according to stat) and only writable by Administrators and SYSTEM. The mode cygwin shows for /cygdrive/c/Users is 0750 which should be OK.
>
>>> So my question is: are "Administrators" and "SYSTEM" different users and does cygsshd accept SYSTEM (numeric 18) as a valid user who may own system directories? If the numeric ID is really 18 I can't see how this check can succeed but I'm not sure the code used in Cygwin is the same.
>
>     $ id SYSTEM
>     uid=18(SYSTEM) gid=18(SYSTEM) groups=544(Administrators),18(SYSTEM)
>
OK, I get the same on my system which seems to be Windows standard.
>> Administrators and SYSTEM are not the same.  And neither is exactly equivalent
>> to the concept of root in POSIX.  SYSTEM (in my experience) is used for things
>> like backup tools that needs access to almost every file. Administrators is for
>> system administration.  I don't have deep knowledge of all of this - others can
>> give a deeper / more nuanced answer.
>
> Look at permissions at all levels:
>
> $ lsattr -d ~/.ssh/;echo;ls -dl ~/.ssh/;echo;getfacl ~/.ssh/;\
>                 icacls `cygpath -m ~/.ssh`
> ------------ /home/BWI/.ssh/
>
> drwx------ 1 $USER None 0 Mar  8  2023 /home/$USER/.ssh/
>
> # file: /home/$USER/.ssh/
> # owner: $USER
> # group: None
> user::rwx
> group::---
> other::---
> default:user::rwx
> default:group::---
> default:other::---
>
> .../.ssh/ $HOST\$USER:(F)
>           $HOST\None:(Rc,S,RA)
>           Everyone:(Rc,S,RA)
>           CREATOR OWNER:(OI)(CI)(IO)(F)
>           CREATOR GROUP:(OI)(CI)(IO)(Rc,S,RA)
>           Everyone:(OI)(CI)(IO)(Rc,S,RA)
>
> Successfully processed 1 files; Failed processing 0 files
>
this results in:

/home/fus

$ lsattr -d ~/.ssh/;echo;ls -dl ~/.ssh/;echo;getfacl ~/.ssh/;                icacls `cygpath -m ~/.ssh`
------------ /home/fus/.ssh/

drwx------+ 1 fus fus 0 Feb  4 23:35 /home/fus/.ssh/

# file: /home/fus/.ssh/
# owner: fus
# group: fus
user::rwx
group::---
group:SYSTEM:rw-        #effective:---
group:Administratoren:rw-       #effective:---
mask::---
other::---
default:user::rwx
default:group::---
default:group:SYSTEM:rw-        #effective:---
default:group:Administratoren:rw-       #effective:---
default:mask::---
default:other::---

C:/Users/fus/.ssh/ NT-AUTORITÄT\SYSTEM:(OI)(CI)(DENY)(X)
                    VORDEFINIERT\Administratoren:(OI)(CI)(DENY)(X)
                    NT-AUTORITÄT\SYSTEM:(OI)(CI)(RX,W,DC)
                    XEONE3_1245V6\fus:(F)
                    VORDEFINIERT\Administratoren:(OI)(CI)(RX,W,DC)

1 Dateien erfolgreich verarbeitet, bei 0 Dateien ist ein Verarbeitungsfehler aufgetreten.

> Try:
>
> # add perm query cmds for info before and after changes
> $ chmod -c u+rwx,go-rwx    ~/.ssh/
> $ setfacl -b        ~/.ssh/
> $ chmod -c u+rwx,go-rwx    ~/.ssh/    # same as before
>
> then ls -l ~/.ssh/ and ensure that:
>
> - non-key ssh files    ...        have    u+rw-x,go-rwx     perms,
> - private key files    id_...        have    u+r-wx,go-rwx perms, and
> - public key files    id_*.pub    have    a+r-wx         perms.
>

The problem seems to be that OpenSSH does not even arrive at checking the home diretory or the .ssh directory. It starts checking every directory in the path and fails already at "/cygdrive/c/Users". Now that I know how to get the sources I added debug output to the error message. OpenSSH sees this directory as belonging to user with UID 18 and it has mode 4750. Mode ist checked not to contain 0022 which is fine here. Then it checks that the owner is the correct system user and the only criteria is that the UID must be zero. Only for AIX and HPUX the user "bin" with UID 2 is also accepted. So this check fails and OpenSSH assumes that the directory does not belong to the correct privileged system user.

I think the only way to fix this with the current OpenSSH is disabling strict mode, but normally I'm quite reluctant to do something like that.2

-- 
Problem reports:      https://cygwin.com/problems.html
FAQ:                  https://cygwin.com/faq/
Documentation:        https://cygwin.com/docs.html
Unsubscribe info:     https://cygwin.com/ml/#unsubscribe-simple

- Raw text -