X-Recipient: archive-cygwin AT delorie DOT com
X-SWARE-Spam-Status: No, hits=-1.6 required=5.0	tests=AWL,BAYES_00,RCVD_IN_DNSWL_NONE,RP_MATCHES_RCVD,UNPARSEABLE_RELAY
X-Spam-Check-By: sourceware.org
Message-ID: <4E91A543.4050200@t-online.de>
Date: Sun, 09 Oct 2011 15:44:35 +0200
From: Christian Franke <Christian DOT Franke AT t-online DOT de>
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:7.0.1) Gecko/20110928 Firefox/7.0.1 SeaMonkey/2.4.1
MIME-Version: 1.0
To: cygwin AT cygwin DOT com
Subject: Re: 1.7.9: login via ssh allows Administrator privileges
References: <loom DOT 20111009T004052-731 AT post DOT gmane DOT org>
In-Reply-To: <loom.20111009T004052-731@post.gmane.org>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-IsSubscribed: yes
Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm
List-Id: <cygwin.cygwin.com>
List-Subscribe: <mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive: <http://sourceware.org/ml/cygwin/>
List-Post: <mailto:cygwin AT cygwin DOT com>
List-Help: <mailto:cygwin-help AT cygwin DOT com>, <http://sourceware.org/ml/#faqs>
Sender: cygwin-owner AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
Delivered-To: mailing list cygwin AT cygwin DOT com

Michael Hoffman wrote:
> When I log in via ssh I find I have Administrator privileges:
>
> $ id -a
> uid=1000(Michael) gid=513(None) groups=513(None),545(Users)
>
> $ ssh localhost
>
> # id -a
> uid=1000(Michael) gid=513(None)
> groups=513(None),0(root),544(Administrators),545(Users)
>
> Is there a way to turn this off or remove myself from the Administrators and
> root groups? I prefer not to have administrative access unless I explicitly
> request it.

Restarting the shell through cygdrop from cygutils package may help:

# exec cygdrop /bin/bash -l

This does essentially the same as Windows if UAC is enabled: The process 
is started with a restricted token where admin group(s) and privileges 
are removed.

The cygdrop -v option prints the removed groups and privileges, -vv 
prints also the preserved ones. There are also options to control which 
groups or privileges are removed in case the default is not suitable.

-- 
Christian Franke


--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple