DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:from:date:to:subject:message-id:references
	:mime-version:content-type:in-reply-to; q=dns; s=default; b=p/cl
	7CEOTx8323FpTwnNTOjWBz5HyyOr5TdvdmKMwlFx4TWPBmAKnsP3RoWk3LdMIgzO
	BhLuFigNjybYwQdz/f7pfS1mjDkNrdWVlmr4b7HPjvxlGl9TXSt/G3n4DA3/IxFc
	pRvq1kl4ZYqiH8CwrurkA4B10xn6InxiAFmuU+0=
Mailing-List: contact cygwin-help@cygwin.com; run by ezmlm
Sender: cygwin-owner@cygwin.com
Mail-Followup-To: cygwin@cygwin.com
From: Stephen Paul Carrier <carrier@berkeley.edu>
Date: Fri, 25 Jan 2019 09:48:33 -0800
To: cygwin@cygwin.com
Subject: Re: sshd permits logon using disabled user?
Message-ID: <20190125174833.GA1710@zebra>
References: <1690850474.834980.1548391349102.ref@mail.yahoo.com> <1690850474.834980.1548391349102@mail.yahoo.com> <d6f98cbc-bd2f-1c13-98bb-7ef42c000115@baur-itcs.de> <CANV9t=RKVWPfiqNMbnSgevTBvm8S1G-oFWK3BEisdgaSGz2OzA@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <CANV9t=RKVWPfiqNMbnSgevTBvm8S1G-oFWK3BEisdgaSGz2OzA@mail.gmail.com>
User-Agent: Mutt/1.9.1 (2017-09-22)

On Fri, Jan 25, 2019 at 08:34:09AM -0700, Bill Stewart wrote:
> On Fri, Jan 25, 2019 at 3:36 AM Stefan Baur <X2Go-ML-1@baur-itcs.de> wrote:
> 
> > Not on Linux (and possibly other Unices).  There, it's perfectly valid
> > to disable an account's password login (both locally and remote), but to
> > at the same time allow ssh key file based logins for the same account.
> 
> But disabling _password login_ is an entirely separate issue from
> disabling _the account itself_.
> 
> Before the fix, it was possible to log on to sshd using a disabled (or
> locked) account.
> 
> There should be _no_ scenario where it is possible to log on using a
> disabled/locked account.

There are different paths to access and to completely disable the account
you need to close all of them.  There are many reasons to disable some
paths without disabling all paths and converting the switch that can
disable one path to a switch that will disable all paths will break
some setups and be less flexible.  (As Stefan Baur is pointing out
effectively.)

To disable ssh logins really, instead of changing the way Cygwin works
for everyone, you could do what UNIX/Linux admins do, something like
moving the user .ssh folder to .ssh.disabled.

Stephen Carrier
Systems Administrator 
BEAR (Berkeley Evaluation & Assessment Research) Center
Graduate School of Education
University of California, Berkeley
http://BEARcenter.Berkeley.EDU/
carrier@Berkeley.EDU

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple