DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:from:reply-to:subject:references:to:message-id
	:date:mime-version:in-reply-to:content-type
	:content-transfer-encoding; q=dns; s=default; b=WzaU2o/il/kGQ1bG
	MiZ8dbGZXfFLlYB7VWGgJK/FWhkDCuCsZEy2nT3TjrrMsPK4kIJya9t8lH0tZqaw
	/ft0Vb5Ax3o+lOGUVAKn7XOsodLhee6LRHBcNJxpOoFtV/ZLWy9uGzB9H184EbT4
	pA/p1dW+2wezWhaBNLwdYo6oEWk=
Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm
Sender: cygwin-owner AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
From: "Matt D." <codespunk AT gmail DOT com>
Reply-To: codespunk+cygwin AT gmail DOT com
Subject: Re: No way to use ssh ~/.ssh/config with "noacl" option
References: <59FD8C99 DOT 8010703 AT gmail DOT com> <20171104113723 DOT GC18070 AT calimero DOT vinschen DOT de>
To: cygwin AT cygwin DOT com
Message-ID: <59FDA8D9.6050808@gmail.com>
Date: Sat, 4 Nov 2017 07:47:37 -0400
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:38.0) Gecko/20100101 Thunderbird/38.3.0
MIME-Version: 1.0
In-Reply-To: <20171104113723.GC18070@calimero.vinschen.de>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit

On 11/4/2017 7:37 AM, Corinna Vinschen wrote:
> On Nov  4 05:47, Matt D. wrote:
>> I mount with "noacl" as I don't need ACLs for my purposes and prefer to
>> leave everything up to Windows permissions.
>>
>> The problem with this is that ssh insists that ~/.ssh/config be less
>> permissive. But this file is bound to --rw-r--r-- for this option.
>>
>> Would it be appropriate to request ssh to ignore this requirement when
>> "noacl" present on the mounted volume?
>
> Yes, in theory.  However, this shouldn't be necessary.
>
> Ssh already has code to check extrem perms only in "acl" mounted
> directories, but it does not have this extra check for config files,
> basically because it was never necessary:
>
> If you use noacl, your file perms are faked to always be 644, or
> 444 if the DOS R/O bit is set, or 755/555 if executable/directory.
> Additionally all files are faked as if they are owned by your own
> account.
>
> Ssh checks the config file like this:
>
>    if (((sb.st_uid != 0 && sb.st_uid != getuid()) ||
>        (sb.st_mode & 022) != 0))
> 	  fatal("Bad owner or permissions on %s", filename);
>
> Which means, 0644 permissions are perfectly fine.  As are 755 perms
> for the ~/.ssh and ~ dirs.
>
> I just mounted my home dir "noacl".  The perms are as expected:
>
>    $ ls -ld . .ssh .ssh/config .ssh/id_local
>    drwxr-xr-x 1 corinna vinschen    0 Nov  4 12:27 .
>    drwxr-xr-x 1 corinna vinschen    0 Mar 14  2017 .ssh
>    -rw-r--r-- 1 corinna vinschen  703 Jan 19  2017 .ssh/config
>    -rw-r--r-- 1 corinna vinschen 7329 Jan 12  2017 .ssh/id_local
>
> Note especially the too open perms in case of the private keyfile
> "id_local".  Still, I can ssh into one of my other machines just fine.
>
> How come this doesn't work for you?
>
>
> Corinna
>

I don't know why it doesn't work for me other than the reported error. I 
am trying to use ssh combined with git. My .ssh permissions are:

$ls -ld . .ssh .ssh/config .ssh/github
drwxr-xr-x 1 Matthew D'Onofrio None    0 Nov  4 06:42 .
drwxr-xr-x 1 Matthew D'Onofrio None    0 Nov  4 04:51 .ssh
-rw-r--r-- 1 Matthew D'Onofrio None   80 Nov  4 04:51 .ssh/config
-rw-r--r-- 1 Matthew D'Onofrio None 3243 Nov  3 10:53 .ssh/github

I removed the noacl option in fstab, re-ran Cygwin setup, set 
.ssh/config to 600 and ssh was happy. I then reverted back to noacl and 
the problem returned.

I'm in the process of trying to build openssh with cygpath for debugging 
but this is my first time building anything from Cygwin or using 
cygports so it's taking some time.


Matt D.

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple