Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm
List-Subscribe: <mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive: <http://sources.redhat.com/ml/cygwin/>
List-Post: <mailto:cygwin AT cygwin DOT com>
List-Help: <mailto:cygwin-help AT cygwin DOT com>, <http://sources.redhat.com/ml/#faqs>
Sender: cygwin-owner AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
Delivered-To: mailing list cygwin AT cygwin DOT com
Date: Mon, 17 May 2004 16:51:02 +0300
From: Baurjan Ismagulov <ibr AT ata DOT cs DOT hun DOT edu DOT tr>
To: cygwin AT cygwin DOT com
Subject: sshd as an ordinary user (was: Re: user-specific mounts)
Message-ID: <20040517135100.GA9811@ata.cs.hacettepe.edu.tr>
Mail-Followup-To: cygwin AT cygwin DOT com
References: <20040513122250 DOT GA13116 AT ata DOT cs DOT hacettepe DOT edu DOT tr> <Pine DOT GSO DOT 4 DOT 56 DOT 0405131348100 DOT 16639 AT slinky DOT cs DOT nyu DOT edu> <20040514090839 DOT GB19350 AT ata DOT cs DOT hacettepe DOT edu DOT tr> <Pine DOT GSO DOT 4 DOT 58 DOT 0405141343530 DOT 29485 AT slinky DOT cs DOT nyu DOT edu> <20040514182326 DOT GB10982 AT coe DOT bosbc DOT com> <Pine DOT GSO DOT 4 DOT 58 DOT 0405141611350 DOT 29485 AT slinky DOT cs DOT nyu DOT edu>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <Pine.GSO.4.58.0405141611350.29485@slinky.cs.nyu.edu>
User-Agent: Mutt/1.5.4i
X-IsSubscribed: yes

Hello,

I've created a user lokal_sshd to run sshd. I've used the following
command:

cygrunsrv -I sshd -p /cygdrive/g/cygwin/usr/sbin/sshd -a -D \
-e "CYGWIN=ntsec tty" -d "CYGWIN sshd" -u lokal_sshd -w 123

I had to add lokal_sshd to Administrators and grant it the following
privileges:

Create a token object
Log on as a service
Replace a process level token

This setup works.

If I remove the user from Administrators and grant all privileges that
Administrators have and Users do not have, sshd does not work any more:
authentication succeeds but the shell prompt doesn't come, and I return
to the local prompt. Application event log says:
sshd: PID 2056: fatal: setuid 1005: Permission denied.

Is it possible to run sshd without making its user a member of
Administrators? Why doesn't it work if I grant all Administrators'
privileges?

I don't use sshd privilege separation. Cygcheck is still screwed, sorry.

With kind regards,
Baurjan.

--
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple
Problem reports:       http://cygwin.com/problems.html
Documentation:         http://cygwin.com/docs.html
FAQ:                   http://cygwin.com/faq/