DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:reply-to:from:to:references:in-reply-to
	:subject:date:message-id:mime-version:content-type
	:content-transfer-encoding; q=dns; s=default; b=trib3qf4aeGyRFkG
	rENYB81dT6dCB1t9XuowaNegotdjN7hGvNgae8EQwwFWGVyokGrI82OxYZCVarx9
	HwUhYm3Hzc/ts6OHJFHtLBiLuYQLUp7cC2BHuyDtqLYf3eqMehqClUz16ydsNQce
	+d3YSl7eDoyAnnfy6H5d/twZ0EU=
Mailing-List: contact cygwin-help@cygwin.com; run by ezmlm
Sender: cygwin-owner@cygwin.com
Mail-Followup-To: cygwin@cygwin.com
Reply-To: <cygwin@cygwin.com>
From: "David Willis" <david_willis@comcast.net>
To: <cygwin@cygwin.com>
References: <019c01d163bc$fe2fc500$fa8f4f00$@comcast.net>	<CANnLRdhVrFcveO_jKb3_x=44WMJNO33DPnsJZ12Wus3U7Wo_fQ@mail.gmail.com>	<019e01d163c2$d678c7e0$836a57a0$@comcast.net>	<023901d165e4$925507d0$b6ff1770$@comcast.net>	<87d1s1c8ld.fsf@Rainer.invalid> <CACoZoo3R4CDcgTMMex9QZ=Wh9a8CDvyUHpqj5+Br5xYFvGHvuQ@mail.gmail.com>
In-Reply-To: <CACoZoo3R4CDcgTMMex9QZ=Wh9a8CDvyUHpqj5+Br5xYFvGHvuQ@mail.gmail.com>
Subject: RE: Possible Security Hole in SSHD w/ CYGWIN?
Date: Sat, 13 Feb 2016 17:37:32 -0800
Message-ID: <025801d166c8$462642e0$d272c8a0$@comcast.net>
MIME-Version: 1.0
Content-Type: text/plain;	charset="us-ascii"
Content-Transfer-Encoding: 7bit

Also, just wanted to respond to this one piece of the message to clarify -
The only change I made to what ssh_host_config does is to use the existing
domain admin account cyg_server rather than creating a new local admin
account (and it actually detects it automatically if it exists already so
this isn't even really doing anything different)

-----Original Message-----
From: cygwin-owner@cygwin.com [mailto:cygwin-owner@cygwin.com] On Behalf Of
Erik Soderquist
Sent: Saturday, February 13, 2016 4:14 PM
To: cygwin@cygwin.com
Subject: Re: Possible Security Hole in SSHD w/ CYGWIN?

> I don't know how you've arrived at the setup you just described, but 
> it's not the one that sshd_host_config produces.  Yes, setting up an 
> SSHD wrongly can open up security holes, no surprise here.

Once again, assumptions.  While I can't explicitly vouch for David's
environment, as I do not have access to check, I can vouch for mine, and
mine was configured using sshd_host_config, with the only changes after
sshd_host_config being regarding TCP and X tunneling.

--- Erik


--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple