DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:subject:to:references:from:message-id:date
	:mime-version:in-reply-to:content-type; q=dns; s=default; b=RoKT
	9zj6fF0l6JvjXqq4NnbGRRElw/+5fqu5LFhs97qbQXqr1z1q2Fzgv910DcFqGwZf
	Wl5Ywvv0nxXsM781gsk5Cirz322bZJXyRC5XZxwNHEM5DHHu/NX4NFNpO+XqoQBS
	T7TAXArBCE6h+zLp4GyDH519Vihhqpv+desfWgY=
Mailing-List: contact cygwin-help@cygwin.com; run by ezmlm
Sender: cygwin-owner@cygwin.com
Mail-Followup-To: cygwin@cygwin.com
Subject: Re: sshd permits logon using disabled user?
To: cygwin@cygwin.com
References: <CANV9t=SSyof86c5Yz3tNhwj4To=eKnrmveQcr59ZmMY-X9_txA@mail.gmail.com> <20190124154533.GK2802@calimero.vinschen.de>
From: Stefan Baur <X2Go-ML-1@baur-itcs.de>
Openpgp: preference=signencrypt
Message-ID: <2b348ac3-63d1-2cd3-430d-2568d650a583@baur-itcs.de>
Date: Thu, 24 Jan 2019 16:51:07 +0100
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.2.1
MIME-Version: 1.0
In-Reply-To: <20190124154533.GK2802@calimero.vinschen.de>
Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="tbPbYfSMHWKuInDWBVuksRE0RPIPq0O2c"

--tbPbYfSMHWKuInDWBVuksRE0RPIPq0O2c
Content-Type: multipart/mixed; boundary="6PG6NOoSN4q53iovAoZZ5ytaBX9O8IZx7";
 protected-headers="v1"
From: Stefan Baur <X2Go-ML-1@baur-itcs.de>
To: cygwin@cygwin.com
Message-ID: <2b348ac3-63d1-2cd3-430d-2568d650a583@baur-itcs.de>
Subject: Re: sshd permits logon using disabled user?
References: <CANV9t=SSyof86c5Yz3tNhwj4To=eKnrmveQcr59ZmMY-X9_txA@mail.gmail.com>
 <20190124154533.GK2802@calimero.vinschen.de>
In-Reply-To: <20190124154533.GK2802@calimero.vinschen.de>


--6PG6NOoSN4q53iovAoZZ5ytaBX9O8IZx7
Content-Type: text/plain; charset=utf-8
Content-Language: de-DE
Content-Transfer-Encoding: quoted-printable

Am 24.01.19 um 16:45 schrieb Corinna Vinschen:
>> In the shell, logged on as the disabled user, the 'whoami' command retur=
ns
>> the name of the disabled user.
>>
>> This seems unexpected and not good.
>>
>> Why does sshd allow logon for a disabled user?
> Because the underlying Cygwin function responsible for changing the user
> account only checks if the account exists.  It does not check for any of
> the flags in the user DB.  Yet.
>=20
> I pushed a patch to disallow changing the user account to a disabled or
> locked out account.

I would like to point out that on Linux, you can disable an account's
password ("password -l username" / "usermod -L username"), and still log
in using an SSH key pair.  This is intentional and different to
disabling an account entirely ("usermod -e 1 username" combined with the
above).

So I guess, the question is if there's a way to make Cygwin act similar
to this - maybe if you can tell disabled vs. locked out apart, allow SSH
key pair logins when locked out, but not when disabled?

Kind Regards,
Stefan Baur


--=20
BAUR-ITCS UG (haftungsbeschr=C3=A4nkt)
Gesch=C3=A4ftsf=C3=BChrer: Stefan Baur
Eichen=C3=A4ckerweg 10, 89081 Ulm | Registergericht Ulm, HRB 724364
Fon/Fax 0731 40 34 66-36/-35 | USt-IdNr.: DE268653243


--6PG6NOoSN4q53iovAoZZ5ytaBX9O8IZx7--

--tbPbYfSMHWKuInDWBVuksRE0RPIPq0O2c
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBCAAGBQJcSd7rAAoJEG7d9BjNvlEZ17UH/1iDoRGls0JyV+0IWuXogsY4
hbqHbMiZU/I4XXedw9FsLhmAJifmYXSWiIy5FANlmjMp8K4oFM8KwK4l9WRE8Cjt
T2oWz9bvWPAOEP1YK3fMiRdK+kJ2UMYXHjxqaQO4//pNlvoSCtcQVCK+10S1p0Vr
6DloVsVZjLFf86kPZGVmKRKE35KG3JrFV2gxu3kRUCrIoyLdj43r9rtwRb7F8ANO
jKyj0mxQleryNOAPGe+iIcuNQ7xAvU22N3Riui4q3Fhfka3TDdHYmIizz+BG0oS6
UMLubTkgnTqClrsjbtfp1ECvepebazvDMy4RjXEopAODkKkgoFeb6Yn1NjhfzKc=
=FvjL
-----END PGP SIGNATURE-----

--tbPbYfSMHWKuInDWBVuksRE0RPIPq0O2c--