DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:to:from:subject:date:message-id:references
	:mime-version:content-type:content-transfer-encoding; q=dns; s=
	default; b=RNjxJXk9qvgVjiErJx2WckWxxSkaox5sNOAwcvf74wuT/L/7Md3mQ
	TbrRqFj9U38nWUESp2cRHMWjvjdx7d8dSzX3GMnBUlUNIoah6VQeHLHO01D+VfOq
	56bjNz4AgOvUkc88e869O4TheasO6EmHb53KvLCie2Kicjamo5k2RY=
Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm
Sender: cygwin-owner AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
To: cygwin AT cygwin DOT com
From: Achim Gratz <Stromeko AT NexGo DOT DE>
Subject: Re: sshd default user PATH
Date: Thu, 14 Aug 2014 12:28:05 +0000 (UTC)
Lines: 65
Message-ID: <loom.20140814T134740-103@post.gmane.org>
References: <loom DOT 20140814T113926-374 AT post DOT gmane DOT org> <20140814112006 DOT GA22411 AT calimero DOT vinschen DOT de>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
User-Agent: Loom/3.14 (http://gmane.org/)

Corinna Vinschen <corinna-cygwin <at> cygwin.com> writes:
> On other systems sshd sets $PATH to "/usr/bin:/bin:/usr/sbin:/sbin", but
> on Cygwin it doesn't change $PATH and just takes what it got from
> cygrunsrv so as not to break the search path for DLLs not in the system
> directories.

I'm running Cygwin since years with all traces of the Windows path
deliberately deleted and never hit any problem.  That would be different if
I tried to mix windows applications in, but I prefer to have wrapper scripts
for those anyway.

> So this is kind of a cygrunsrv problem.  It simply appends /bin to
> $PATH, rather than prepending it.

Ah, I was wondering where that comes from since nothing in sshd does it.  So
sshd just takes over the environment as set up by cygrunsrv?  Then it might
be a lot easier to just tell cygrunsrv what to put into PATH.

> Right, /etc/default/login and, fwiw, any method to change $PATH from the
> default path is disabled on Cygwin deliberately for the reason outlined
> above.

Thanks for confirming, after staring at the configure output for a while
I've finally found that #ifdef in the source...

> It's not that simple.  It requires a code change in sshd.  However,
> maybe the rigorous handling is not required anymore these days.

May not be necessary anyway.
 
> Anyway, even if I re-enable /etc/default/login and the standard PATH
> handling in sshd, there's no way to set an arbitrary environment.  For
> security reasons, sshd is very selective in the environment variables it
> sets up.  From /etc/default/login, it takes *only* PATH and UMASK,
> for instance.  Everything else should be set in the shell profiles.

I really only need PATH at the moment.  If I bounce commands directly onto
the server without going through a login shell nothing really works as
expected at the moment since Cygwin is last in path.  I don't want to add
Cygwin to the Windows path for other reasons and I really don't have control
what else gets added there and in which order.

> So, here's what I'll do:
> 
> - Change cygrunsrv to prepend /bin to $PATH rather then appending it.

I would appreciate if it could (optionally) look in some configuration file
(/etc/environment ?) and use PATH as defined there and store the path as set
up in Windows in ORIGINAL_PATH (like done in /etc/profile, where this is
conditional on CYGWIN_NOWINPATH being present).

> - Drop the Cygwin specific ignorance of /etc/default/login from the
>   source code and build a new OpenSSH package.
> 
> Does that sound ok?

Very much.  If the environment can be controlled via cygrunsrv, then the
changes to sshd might not be necessary.  I've just tried using "-e
PATH=/bin" in the sshd service startup, but PATH still seems to be
hardcopied from Windows (the setting is ignored if the environment variable
already exists?).


Regards,
Achim.


--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple