X-Recipient: archive-cygwin AT delorie DOT com X-SWARE-Spam-Status: No, hits=-2.6 required=5.0 tests=BAYES_00,SPF_PASS X-Spam-Check-By: sourceware.org Message-ID: <4A50EBA3.9090000@gmail.com> Date: Sun, 05 Jul 2009 11:06:27 -0700 From: Ian Kelling User-Agent: Thunderbird 2.0.0.22 (Windows/20090605) MIME-Version: 1.0 To: cygwin AT cygwin DOT com Subject: ssh-host-config eval password bug Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-IsSubscribed: yes Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm List-Id: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: cygwin-owner AT cygwin DOT com Mail-Followup-To: cygwin AT cygwin DOT com Delivered-To: mailing list cygwin AT cygwin DOT com In the ssh package there is a bug in /usr/bin/ssh-host-config where if you select a valid password spaces or punctuation that bash knows of, it will fail and you could possibly shoot yourself in the foot due to evaling your password. I don't know who is responsible, or what mailing list to post on, but here is a patch. - Ian Kelling --- ssh-host-config.old 2009-05-29 22:35:16.244777500 -0700 +++ ssh-host-config 2009-05-29 22:40:31.234257500 -0700 @@ -323,12 +323,12 @@ if [ -n "${csih_cygenv}" ] then - cygwin_env="-e CYGWIN=\"${csih_cygenv}\"" + cygwin_env=( -e "CYGWIN=${csih_cygenv}" ) fi if [ -z "${password}" ] then - if eval cygrunsrv -I sshd -d \"CYGWIN sshd\" -p /usr/sbin/sshd \ - -a "-D" -y tcpip ${cygwin_env} + if cygrunsrv -I sshd -d "CYGWIN sshd" -p /usr/sbin/sshd \ + -a "-D" -y tcpip "${cygwin_env[@]}" then echo csih_inform "The sshd service has been installed under the LocalSystem" @@ -337,8 +337,8 @@ csih_inform "will start automatically after the next reboot." fi else - if eval cygrunsrv -I sshd -d \"CYGWIN sshd\" -p /usr/sbin/sshd \ - -a "-D" -y tcpip ${cygwin_env} \ + if cygrunsrv -I sshd -d "CYGWIN sshd" -p /usr/sbin/sshd \ + -a "-D" -y tcpip "${cygwin_env[@]}" \ -u "${run_service_as}" -w "${password}" then echo -- Problem reports: http://cygwin.com/problems.html FAQ: http://cygwin.com/faq/ Documentation: http://cygwin.com/docs.html Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple