X-Recipient: archive-cygwin AT delorie DOT com
X-SWARE-Spam-Status: No, hits=-2.4 required=5.0	tests=BAYES_00,RP_MATCHES_RCVD,SPF_HELO_PASS
X-Spam-Check-By: sourceware.org
To: cygwin AT cygwin DOT com
From: Andrew Schulman <schulman DOT andrew AT epa DOT gov>
Subject: admin privileges when logging in by ssh?
Date: Sun, 11 Sep 2011 15:07:10 -0400
Lines: 25
Message-ID: <rg0q679hpajl00ujv34jtmavsanhpb6n2t@4ax.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
X-Archive: encrypt
X-IsSubscribed: yes
Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm
List-Id: <cygwin.cygwin.com>
List-Subscribe: <mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive: <http://sourceware.org/ml/cygwin/>
List-Post: <mailto:cygwin AT cygwin DOT com>
List-Help: <mailto:cygwin-help AT cygwin DOT com>, <http://sourceware.org/ml/#faqs>
Sender: cygwin-owner AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
Delivered-To: mailing list cygwin AT cygwin DOT com

When a user with administrative privileges logs in to sshd, it seems that the user is only granted
standard user privileges for that session.  Is there a way around that?  How can I get the admin
privileges for that session?

Cygwin 1.7.9, Windows 7 Home Premium.  I've created a user account in Windows named "backup" that I
want to use for backup operations.  So, I want to be able to log in by ssh as user backup, and
perform read/write operations.  Since my version of Windows 7 is a "Home" version there's no Backup
Operators group, so I've created the backup account as a standard user, and granted it backup and
restore privileges:

  editrights -a SeBackupPrivilege  -u backup
  editrights -a SeRestorePrivilege -u backup

From what I can tell, these privileges should be sufficient for backup to read and write any files -
see e.g. http://msdn.microsoft.com/en-us/library/bb530716(v=vs.85).aspx.  But when I log in on sshd
as user backup, I'm not able to read other users files.  It seems that I've only been granted
standard user privileges.

Might this be caused by UAC?  When I log in by ssh, there's no way for UAC to prompt me for
privilege escalation.  Or, does it have to do with the implementation of sshd in Cygwin?

Most important, is it possible for the logged in sshd user to gain its elevated privileges?

Thanks,
Andrew.


--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple