X-Recipient: archive-cygwin AT delorie DOT com
DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:reply-to:from:to:references:in-reply-to
	:subject:date:message-id:mime-version:content-type
	:content-transfer-encoding; q=dns; s=default; b=trib3qf4aeGyRFkG
	rENYB81dT6dCB1t9XuowaNegotdjN7hGvNgae8EQwwFWGVyokGrI82OxYZCVarx9
	HwUhYm3Hzc/ts6OHJFHtLBiLuYQLUp7cC2BHuyDtqLYf3eqMehqClUz16ydsNQce
	+d3YSl7eDoyAnnfy6H5d/twZ0EU=
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:reply-to:from:to:references:in-reply-to
	:subject:date:message-id:mime-version:content-type
	:content-transfer-encoding; s=default; bh=I82vVRaS93hReh1VQwyFci
	TG6YE=; b=K2m9jKjT1umZpan6Mf4HQ/ku8MVPkvpwur4jLqC3DVYuWslb+521q6
	oUowqeSosMl7sKM625felj5Z2GLjkWOj5DvKrWWZGmWykNyQ403gDlCxRNpohanf
	vMZd86eGFWeh7XE7CHotuyFs9/mI3xnSlOAq27eVB/rxmMNr344a4=
Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm
List-Id: <cygwin.cygwin.com>
List-Subscribe: <mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive: <http://sourceware.org/ml/cygwin/>
List-Post: <mailto:cygwin AT cygwin DOT com>
List-Help: <mailto:cygwin-help AT cygwin DOT com>, <http://sourceware.org/ml/#faqs>
Sender: cygwin-owner AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
Delivered-To: mailing list cygwin AT cygwin DOT com
Authentication-Results: sourceware.org; auth=none
X-Virus-Found: No
X-Spam-SWARE-Status: No, score=4.3 required=5.0 tests=AWL,BAYES_40,CYGWIN_OWNER_BODY,FREEMAIL_FROM,RCVD_IN_DNSWL_NONE,RP_MATCHES_RCVD,SPF_PASS autolearn=no version=3.3.2 spammy=Hx-languages-length:1111, H*i:sk:CACoZoo, H*i:Wh9a8CDvyUHpqj5, H*f:sk:Br5xYFv
X-HELO: resqmta-po-07v.sys.comcast.net
Reply-To: <cygwin AT cygwin DOT com>
From: "David Willis" <david_willis AT comcast DOT net>
To: <cygwin AT cygwin DOT com>
References: <019c01d163bc$fe2fc500$fa8f4f00$@comcast.net>	<CANnLRdhVrFcveO_jKb3_x=44WMJNO33DPnsJZ12Wus3U7Wo_fQ AT mail DOT gmail DOT com>	<019e01d163c2$d678c7e0$836a57a0$@comcast.net>	<023901d165e4$925507d0$b6ff1770$@comcast.net>	<87d1s1c8ld DOT fsf AT Rainer DOT invalid> <CACoZoo3R4CDcgTMMex9QZ=Wh9a8CDvyUHpqj5+Br5xYFvGHvuQ AT mail DOT gmail DOT com>
In-Reply-To: <CACoZoo3R4CDcgTMMex9QZ=Wh9a8CDvyUHpqj5+Br5xYFvGHvuQ@mail.gmail.com>
Subject: RE: Possible Security Hole in SSHD w/ CYGWIN?
Date: Sat, 13 Feb 2016 17:37:32 -0800
Message-ID: <025801d166c8$462642e0$d272c8a0$@comcast.net>
MIME-Version: 1.0
Content-Type: text/plain;	charset="us-ascii"
Content-Transfer-Encoding: 7bit
X-IsSubscribed: yes

Also, just wanted to respond to this one piece of the message to clarify -
The only change I made to what ssh_host_config does is to use the existing
domain admin account cyg_server rather than creating a new local admin
account (and it actually detects it automatically if it exists already so
this isn't even really doing anything different)

-----Original Message-----
From: cygwin-owner AT cygwin DOT com [mailto:cygwin-owner AT cygwin DOT com] On Behalf Of
Erik Soderquist
Sent: Saturday, February 13, 2016 4:14 PM
To: cygwin AT cygwin DOT com
Subject: Re: Possible Security Hole in SSHD w/ CYGWIN?

> I don't know how you've arrived at the setup you just described, but 
> it's not the one that sshd_host_config produces.  Yes, setting up an 
> SSHD wrongly can open up security holes, no surprise here.

Once again, assumptions.  While I can't explicitly vouch for David's
environment, as I do not have access to check, I can vouch for mine, and
mine was configured using sshd_host_config, with the only changes after
sshd_host_config being regarding TCP and X tunneling.

--- Erik



--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple