DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:date:from:to:subject:message-id:reply-to
	:references:mime-version:content-type:in-reply-to; q=dns; s=
	default; b=K0IQJsyJ85aRfKowd8SESfBNS0ojz83fmnGE3Wz6dHY94qmSpLWwY
	RTRwrI/OyHzpB+sNFO9LE+TJa9/+w81LNI5Rvahw5KLyNGR5QCTXasEMTwIIyg7j
	7WAK5by66OeytpKZO3tZrvoG5QS4H3gZfKq4EPRfB5IpI+Dk6GkYGw=
Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm
Sender: cygwin-owner AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
Date: Sat, 4 Nov 2017 12:37:23 +0100
From: Corinna Vinschen <corinna-cygwin AT cygwin DOT com>
To: cygwin AT cygwin DOT com
Subject: Re: No way to use ssh ~/.ssh/config with "noacl" option
Message-ID: <20171104113723.GC18070@calimero.vinschen.de>
Reply-To: cygwin AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
References: <59FD8C99 DOT 8010703 AT gmail DOT com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha256;	protocol="application/pgp-signature"; boundary="dTy3Mrz/UPE2dbVg"
Content-Disposition: inline
In-Reply-To: <59FD8C99.8010703@gmail.com>
User-Agent: Mutt/1.9.1 (2017-09-22)

--dTy3Mrz/UPE2dbVg
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Nov  4 05:47, Matt D. wrote:
> I mount with "noacl" as I don't need ACLs for my purposes and prefer to
> leave everything up to Windows permissions.
>=20
> The problem with this is that ssh insists that ~/.ssh/config be less
> permissive. But this file is bound to --rw-r--r-- for this option.
>=20
> Would it be appropriate to request ssh to ignore this requirement when
> "noacl" present on the mounted volume?

Yes, in theory.  However, this shouldn't be necessary.

Ssh already has code to check extrem perms only in "acl" mounted
directories, but it does not have this extra check for config files,
basically because it was never necessary:

If you use noacl, your file perms are faked to always be 644, or
444 if the DOS R/O bit is set, or 755/555 if executable/directory.
Additionally all files are faked as if they are owned by your own
account.

Ssh checks the config file like this:

  if (((sb.st_uid !=3D 0 && sb.st_uid !=3D getuid()) ||
      (sb.st_mode & 022) !=3D 0))
	  fatal("Bad owner or permissions on %s", filename);

Which means, 0644 permissions are perfectly fine.  As are 755 perms
for the ~/.ssh and ~ dirs.

I just mounted my home dir "noacl".  The perms are as expected:

  $ ls -ld . .ssh .ssh/config .ssh/id_local
  drwxr-xr-x 1 corinna vinschen    0 Nov  4 12:27 .
  drwxr-xr-x 1 corinna vinschen    0 Mar 14  2017 .ssh
  -rw-r--r-- 1 corinna vinschen  703 Jan 19  2017 .ssh/config
  -rw-r--r-- 1 corinna vinschen 7329 Jan 12  2017 .ssh/id_local

Note especially the too open perms in case of the private keyfile
"id_local".  Still, I can ssh into one of my other machines just fine.

How come this doesn't work for you?


Corinna

--=20
Corinna Vinschen                  Please, send mails regarding Cygwin to
Cygwin Maintainer                 cygwin AT cygwin DOT com
Red Hat

--dTy3Mrz/UPE2dbVg
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQIcBAEBCAAGBQJZ/aZzAAoJEPU2Bp2uRE+gk44P/i4CQSVaTOXZDLGQgM0xW9ty
kIFEfMFIWwoBHfYrqpI1PhaLLYZJE1M8DpY5gMl04J5XLnS/aX3dHCsDfWKmRfZd
FNGmpO/GDJto5Mog8AKcEIlGtRaiTARdzbHovLqxgUGhWssDhWAM9G1rGeGlUQvk
QKFSQhVybxNLrDeX61TarNh4EnnQjUMTh1i5REuL/7qqnFlRCnFmcpHUgTBzlOUZ
sdQvFkYaUkc4S3yB13NPV/kGLod+HLv90SX1nyVFzb77CHfnm+ifnZ2ocEXdrxwA
mw2JyWlQpWlDYMyrBxfV4Ceq6y+LBj72mgtl32+zTnMcmKCc4EvXDbnM9Ybhthqw
G1WA7q1u6v/R9JtYhZ14jErjsFQUytCCVQNt5AAsky7akbiv0BRaNIGHnQL7Cumd
ThhvAPPppX8v5xi2YlmstLLuVDnzXhV9n0ylIYPCc17zifffj0CYeCBJn2vFjHiF
i+NItLGHYu8YnO8vbCh5E1tWGe+94O8X7gSn0qYPrvI27WCq1vuitEnGUgZspkVC
tXZITE7d3hdDMzmbOa8eongPHsk9HFO/0WYeqBxwCC5kL6g+JvN2zGpof6FU5QlY
X/ziVQqpZvI1f8eXBO8qg/1kZncA85G3MPeP/u26PZEklnBQqoIgwUZvo3W1DVs0
1YTVKhs7t6iToEy+xzG/
=GvwD
-----END PGP SIGNATURE-----

--dTy3Mrz/UPE2dbVg--