Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm
List-Subscribe: <mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive: <http://sourceware.org/ml/cygwin/>
List-Post: <mailto:cygwin AT cygwin DOT com>
List-Help: <mailto:cygwin-help AT cygwin DOT com>, <http://sourceware.org/ml/#faqs>
Sender: cygwin-owner AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
Delivered-To: mailing list cygwin AT cygwin DOT com
Date: Mon, 06 Jun 2005 17:02:17 -0400
To: cygwin AT cygwin DOT com
Subject: Re: Login & Something diff since cygwin 1.5.15-1 release - could it be security changes that were made
Message-Id: <VA.000011af.013e5ade@thesoftwaresource.com>
In-Reply-To: <20050606104023.GG3268@calimero.vinschen.de>
References: <VA DOT 000011ab DOT 0053f8b1 AT thesoftwaresource DOT com> <20050606104023 DOT GG3268 AT calimero DOT vinschen DOT de>
From: Brian Keener <bkeenerReMoVeAnTiSpAm AT thesoftwaresource DOT com>
Reply-To: Brian Keener <bkeenerReMoVeAnTiSpAm AT thesoftwaresource DOT com>

Corinna Vinschen wrote:
> On Jun  1 13:22, Brian Keener wrote: 
> > I realize that login is not the normal mode of access for most Cygwin users and 
> > that most use simply the cygwin.bat to start one of the shells.  I have my 
> > cygwin.bat set to run login.exe which then runs the appropriate shell based on 
> > the login I use - actually it starts several login sessions and depending on 
> > the login I use (each unique to Cygwins passwd file ) it will run a different 
> > shell (IE briank runs bash, briankt runs tcsh, briankz runs zsh).   
> > 
> > This also keeps some one who sits down at my machine from accidentally 
> > accessing my cygwin install without knowing one of my logins or passwords.   
> > 
> > Up until 1.5.15-1 this worked perfectly and with 1.5.15-1 and since this has 
> > changed.  Login runs but no matter what login or password I use - I am told it 
> > is an incorrect login.  Simply rolling back to 1.5.14-1 corrects this and all 
> > works as expected.  I notice in the release for 1.5.15-1   
> > 
> > http://cygwin.com/ml/cygwin-announce/2005-04/msg00022.html 
> > 
> > that there were several security changes (or at least what I perceive to be 
> > security changes) and wonder if this could have affected my use of login.  Or 
> > was the fact my use of login worked a fluke and that has since been corrected.   
>  
> There were a couple of security changes in recent releases.  What about 
> 1.5.17?  Does it solve your problem?  I just tried using login using 
> my own account and it works correctly.  You should carefully inspect 
> your /etc/passwd and /etc/group files because recent changes are more 
> sensitive to wrong entries, especially in relation to group settings. 
>  
> Corinna 

Thanks for the response.  1.5.17 doesn't correct it either. I have tried each release 
since 1.5.14 and and always end up rolling back to 1.5.14.  I even tried simply 
accessing the bash prompt and then running login from there (without running it 
directly from cygwin.bat) and it still says Login Incorrect .

Based on your results I will go back and review /etc/passwd and /etc/group as you 
suggest and see what I can find.  I'm going to have to do a little digging it looks 
like - I updated to 1.5.17, removed my passwd and group file and rebuilt using:

mkgroup -l >/etc/group
mkpasswd -l -p "/$HOME" >/etc/passwd

still won't login.  Then I rebuilt them with 

mkgroup -d >/etc/group
mkpasswd -d -p "/$HOME" >/etc/passwd

but sill no luck either from cygwin.bat or just login from the shell prompt.  I'll 
keep digging.  Not sure what to look at now though.

Thanks for the follow-up.

bk





--
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple
Problem reports:       http://cygwin.com/problems.html
Documentation:         http://cygwin.com/docs.html
FAQ:                   http://cygwin.com/faq/