X-Recipient: archive-cygwin AT delorie DOT com
X-SWARE-Spam-Status: No, hits=-1.6 required=5.0	tests=AWL,BAYES_00,RCVD_IN_DNSWL_NONE,RP_MATCHES_RCVD,UNPARSEABLE_RELAY
X-Spam-Check-By: sourceware.org
Message-ID: <4E9736B4.9050403@t-online.de>
Date: Thu, 13 Oct 2011 21:06:28 +0200
From: Christian Franke <Christian DOT Franke AT t-online DOT de>
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:7.0.1) Gecko/20110928 Firefox/7.0.1 SeaMonkey/2.4.1
MIME-Version: 1.0
To: cygwin AT cygwin DOT com
Subject: Re: 1.7.9: login via ssh allows Administrator privileges
References: <loom DOT 20111009T004052-731 AT post DOT gmane DOT org> <4E91A543 DOT 4050200 AT t-online DOT de> <loom DOT 20111009T203606-94 AT post DOT gmane DOT org>
In-Reply-To: <loom.20111009T203606-94@post.gmane.org>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-IsSubscribed: yes
Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm
List-Id: <cygwin.cygwin.com>
List-Subscribe: <mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive: <http://sourceware.org/ml/cygwin/>
List-Post: <mailto:cygwin AT cygwin DOT com>
List-Help: <mailto:cygwin-help AT cygwin DOT com>, <http://sourceware.org/ml/#faqs>
Sender: cygwin-owner AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
Delivered-To: mailing list cygwin AT cygwin DOT com

Michael Hoffman wrote:
> Christian Franke<...>  writes:
>
>> Michael Hoffman wrote:
>>> When I log in via ssh I find I have Administrator privileges:
>>>
>>> [snip]
>>>
>>> Is there a way to turn this off or remove myself from the Administrators and
>>> root groups? I prefer not to have administrative access unless I explicitly
>>> request it.
>> Restarting the shell through cygdrop from cygutils package may help:
>>
>> # exec cygdrop /bin/bash -l
> Thanks for the helpful response! I was able to get the behavior I wanted by
> adding this to /etc/sshd_config:
> ...

You're welcome. I'm glad my cygdrop tool is useful here.

Meantime I noticed one difference: If Cygwin shell started normally from 
explorer, UAC-Virtualization is effective. This is not the case if the 
shell is started through cygdrop. Should not make much difference for 
the typical use cases of Cygwin which normally do not change files below 
$PROGRAMFILES or $WINDIR.

-- 
Christian Franke


--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple