Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm
List-Subscribe: <mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive: <http://sources.redhat.com/ml/cygwin/>
List-Post: <mailto:cygwin AT cygwin DOT com>
List-Help: <mailto:cygwin-help AT cygwin DOT com>, <http://sources.redhat.com/ml/#faqs>
Sender: cygwin-owner AT cygwin DOT com
Delivered-To: mailing list cygwin AT cygwin DOT com
Message-ID: <001301c1c90d$00d1ecc0$6fc82486@medschool.dundee.ac.uk>
Reply-To: "fergus at bonhard dot uklinux dot net" <fergus AT bonhard DOT uklinux DOT net>
From: "fergus at bonhard dot uklinux dot net" <fergus AT bonhard DOT uklinux DOT net>
To: <cygwin AT cygwin DOT com>
Cc: <fergus AT bonhard DOT uklinux DOT net>
Subject: Setting and using a password in W98
Date: Mon, 11 Mar 2002 14:57:02 -0000
MIME-Version: 1.0
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000

All this is in W98:

I pasted the output from crypt {mypassword}into the appropriate place in
/etc/passwd as shown

    {myusername}:{output}:500:544::/home/{myusername}:/bin/bash

and now I get prompted for a password when starting Cygwin. Nice.

(This is when starting Cygwin with "c:\Cygwin\bin\rxvt -e /bin/login" but I
know there are lots of variations in how Cygwin may be started. Most of them
are successfully tripped up by this new setting.)

It's not really very secure, of course: anybody who knew even a bit about
things could hack /etc/passwd from Windows and climb in that way. But it
serves a small purpose. However: I hadn't expected that two of the simpler
startup modes

    c:\Cygwin\bin\bash --login
and
    c:\Cygwin\bin\bash --login -i

(the latter being exactly what's in c:\Cygwin\cygwin.bat) would both let me
straight in, by-passing the password protection.

Q1. Is there some way, in W98, that I can protect myself further?

By the way, other startup modes I have tried include

    1. c:\Cygwin\bin\bash followed by ./login at the bash-2.05a$ prompt
    2. c:\Cygwin\bin\rxvt followed by ./login at the $ prompt
    3. c:\Cygwin\bin\login
    4. c:\Cygwin\bin\rxvt -e /bin/login
    5. c:\Cygwin\bin\rxvt -e /bin/bash --login

It is not easy to distinguish quite what's optimal/ redundant/ inefficient
here. I use (4) and have seen (5) recommended. (3) is beautifully sparse.
Several other possibilities, not all that different from these, are clearly
"wrong" in that they cause what looks like a working terminal window  to be
flashed briefly to the screen before instantly disappearing. I'm sure there
are many other alternatives that work.

Summarising: I had been going to ask

Q2. what the "approved" startup sequence would be for somebody requiring
password protection and wanting also to start in a rxvt terminal. Is it (4)?

Q3. Could the contents of c:\Cygwin\cygwin.bat be "officially" tweaked to
c:\Cygwin\bin\login in order to gain the password-protection that is not
conferred by the current contents of c:\Cygwin\cygwin.bat, or would this
change simply induce other, different, equally bad consequences?!

Fergus

Fergus



Fergus


--
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple
Bug reporting:         http://cygwin.com/bugs.html
Documentation:         http://cygwin.com/docs.html
FAQ:                   http://cygwin.com/faq/