DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:date:from:to:subject:message-id:reply-to
	:references:mime-version:content-type:in-reply-to; q=dns; s=
	default; b=k5ddIcTTcWN5paU4hALCTJ0EcIyH5c2kD8/XyRwwzxIWY1vuMgCzD
	wrjxyQKbQafaxCOMkvSpPkLCoDn+lqDIpcfEjB745l3AHm/952Jh6zCBUsZAeZWu
	l7iUox+qX+EfXv/0XVEoeINmB6MPA8nM8TH6ieM4xPrA4mYkU0Ddd4=
Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm
Sender: cygwin-owner AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
Date: Thu, 14 Aug 2014 14:17:00 +0200
From: Corinna Vinschen <corinna-cygwin AT cygwin DOT com>
To: cygwin AT cygwin DOT com
Subject: Re: sshd default user PATH
Message-ID: <20140814121700.GA25497@calimero.vinschen.de>
Reply-To: cygwin AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
References: <loom DOT 20140814T113926-374 AT post DOT gmane DOT org> <20140814112006 DOT GA22411 AT calimero DOT vinschen DOT de>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha1;	protocol="application/pgp-signature"; boundary="envbJBWh7q8WU6mo"
Content-Disposition: inline
In-Reply-To: <20140814112006.GA22411@calimero.vinschen.de>
User-Agent: Mutt/1.5.23 (2014-03-12)

--envbJBWh7q8WU6mo
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Aug 14 13:20, Corinna Vinschen wrote:
> On Aug 14 09:56, Achim Gratz wrote:
> > I'm trying to figure out how sshd comes up with the PATH for the initial
> > environment.  Currently I get the Windows sytem PATH (converted to POSI=
X)
> > and then /bin appended.  This is no good, at least /bin should be at the
> > beginning of that PATH.
>=20
> On other systems sshd sets $PATH to "/usr/bin:/bin:/usr/sbin:/sbin", but
> on Cygwin it doesn't change $PATH and just takes what it got from
> cygrunsrv so as not to break the search path for DLLs not in the system
> directories.
>=20
> So this is kind of a cygrunsrv problem.  It simply appends /bin to
> $PATH, rather than prepending it.
>=20
> > I've not been able to change this system-wide so far.  Apparently sshd =
has
> > been built on a machine where /etc/default/login wasn't present, at lea=
st it
> > doesn't appear to try to read that file (or any other system file) for
> > setting up the initial environment.
>=20
> Right, /etc/default/login and, fwiw, any method to change $PATH from the
> default path is disabled on Cygwin deliberately for the reason outlined
> above.
>=20
> > The /etc/sshrc is run if I create it,
> > but you can't set any environment variables from within it.  I don't wa=
nt to
> > enable user environments.
> >=20
> > I think it would be nice if there was a system file that could set the
> > initial environment for sshd, maybe setting external_path_file to
> > /etc/ssh_environment fits in better with the default Cygwin /etc layout=
, though.
>=20
> It's not that simple.  It requires a code change in sshd.  However,
> maybe the rigorous handling is not required anymore these days.
>=20
> Anyway, even if I re-enable /etc/default/login and the standard PATH
> handling in sshd, there's no way to set an arbitrary environment.  For
> security reasons, sshd is very selective in the environment variables it
> sets up.  From /etc/default/login, it takes *only* PATH and UMASK,
> for instance.  Everything else should be set in the shell profiles.
>=20
> So, here's what I'll do:
>=20
> - Change cygrunsrv to prepend /bin to $PATH rather then appending it.
>=20
> - Drop the Cygwin specific ignorance of /etc/default/login from the
>   source code and build a new OpenSSH package.
>=20
> Does that sound ok?

There's a problem.  On Cygwin it's not /etc/default, but /etc/defaults.
Note the trailing "s".

OpenSSH only provides support for /etc/default/login with no way to
influence the name or path.  This would require a patch to openssh just
for the sake of Cygwin.  I asked upstream, but I don't expect that this
will be changed any time soon.


Corinna

--=20
Corinna Vinschen                  Please, send mails regarding Cygwin to
Cygwin Maintainer                 cygwin AT cygwin DOT com
Red Hat

--envbJBWh7q8WU6mo
Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBAgAGBQJT7Ki8AAoJEPU2Bp2uRE+gJ8IP/iwmTJDtw9S/kLq7HgBC49CQ
vRCJV5UIbkfFXn0UaizPIlUTbOyleDolN+ZY+z6dHwD9DSgP0RUZUxYgU6HSFHjN
neUkrcrwTD8VrzCbacl1Qpfd8BHexMqaJ/2hMWDBBx2MkeYouxkBBBhFweSsp8HD
f59AAjy0E3xQ3J75TYW6kq8eRMYOfPEQgTtWJxj7/DW1uRq/Un/EPZsZJMNJG+RA
LnID3pecTM044xPijZWwclZXMGW4bxRlf9S46NEey215zrdaed7WXVyHPz9z610g
ApAQUwuWlR6DH+pWj7NUwzTv/AsfgWWA8nRMw9JfUlpLaTbcnaysUHinNSDwZFFp
rMd89BZ3zCtFo7HG1NU5QJhrft5s9/RQdwS0UDHWwIAUXA58NFhBX0s/s81m6Msa
HzEoDdo0QqmDsiLTCkt9gZmT1OGKu9MOQvykWL0wk7CrHBgXWmCoq26TjUXeDbmQ
stXPMdi6hg6GhEPfRHMe5crjzw8hAeopCrzNlGeqJQB7rq+L3IYAlgJ3Jn7Uu2BL
mzVNGhtr6b5OTW+IxE/vxs2CTnoWAMyJaPA0+cDACXKvZ2L07WHsGXfA3MXqdI5t
57pV5I+uiuIdyC+vhFExCAagkfFNNWMlwi9LY68torWeZmdtqP4D76Gky8l5RmIn
5HT+0UuFR7BLoK9QKG4a
=2Lyz
-----END PGP SIGNATURE-----

--envbJBWh7q8WU6mo--