X-Recipient: archive-cygwin AT delorie DOT com
DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:from:subject:to:references:message-id:date
	:mime-version:in-reply-to:content-type
	:content-transfer-encoding; q=dns; s=default; b=BMyyegsZ4iwHK/R7
	V37l197O8cX9gSFTjBpNt4Euk5TG+P4o8ZccKSqCEVnInOtASWJRrDTUfNH21EFO
	Ro8zm/S8oLZ9TkrnqmnuWAL+KCg1f0zLGfqcY7SiIK7Co4glmYtSmLEVj3b0EFf5
	ecAREEmUwSlwhnMINrpINTJCB5g=
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:from:subject:to:references:message-id:date
	:mime-version:in-reply-to:content-type
	:content-transfer-encoding; s=default; bh=7Z/VcG4c/36hgOBUkVOB1a
	vJdns=; b=vrDgpwBs9obrL91A72niaJeWDoAEHbjvFLd80Yn12nQMXjpjfhkpS2
	wL5Ck/lfjM772/MASIcMlECzigUT3PGL0WAmVfAEjEr8lrH932GKNhaxlIfyz4DN
	l0jPtIk2G4sHxSo8fX0wsUzLdKGEK5U3n1NXsvtt1ic51clnE9/IU=
Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm
List-Id: <cygwin.cygwin.com>
List-Subscribe: <mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive: <http://sourceware.org/ml/cygwin/>
List-Post: <mailto:cygwin AT cygwin DOT com>
List-Help: <mailto:cygwin-help AT cygwin DOT com>, <http://sourceware.org/ml/#faqs>
Sender: cygwin-owner AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
Delivered-To: mailing list cygwin AT cygwin DOT com
Authentication-Results: sourceware.org; auth=none
X-Virus-Found: No
X-Spam-SWARE-Status: No, score=-1.8 required=5.0 tests=AWL,BAYES_00,FREEMAIL_FROM,RCVD_IN_DNSWL_NONE,SPF_PASS autolearn=ham version=3.3.2 spammy=regarded, Everyone, unnecessarily, username
X-HELO: mail-pg0-f42.google.com
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;        d=1e100.net; s=20161025;        h=x-gm-message-state:from:subject:to:references:message-id:date         :user-agent:mime-version:in-reply-to:content-transfer-encoding;        bh=8wlowk8nbMmHOjvn+VUnYSFO/lsiZCix0tkZ+bMvf0Y=;        b=BD1gPGjlooNTDl4iLaZVUHG252YXq/paAJ704w14WHyxZNiHGb2ZoBt1ogErdHa7Y8         gNu3cGwRnd3goeAoCI8DC7eX7lGD2rfxSl08OMVFF1bbUusoHgsVNobsujAaOHKKAG00         EO0UWnh24Zihw7oStM/Nak9rHqCqeOug5piYFiq+OuyKz8Uu0e8QoQHlP877V5lPz5S3         z+Z5k6OuNwSw9jb5FPj69/3LicBk4M37MCdWcS+1NTOEWPtDb4d0AjTM7mLvoPx0oplm         UjEOrMRU1z80ylUbCdie4bHgvdFvWg3koOSNhwBxPQI8g+3rHgvoXS7zvAZz12S03IDA         DSzA==
X-Gm-Message-State: AJaThX42c6276L9rNA819Tv6+4R4+xjR/MYXnXzrJhIhB1Kf/P/q+XFr	7KRKDnHSludeyp70bYI4c2Rb+t8r
X-Google-Smtp-Source: ABhQp+SszC8HzofU26rrz3NnVapy8p99wuF9p0PyojpJF6zJuDmwPWhA4Sss3XF7YY3fY0oMWXrw+A==
X-Received: by 10.98.71.194 with SMTP id p63mr2103525pfi.26.1510182446796;        Wed, 08 Nov 2017 15:07:26 -0800 (PST)
From: "Matt D." <codespunk AT gmail DOT com>
X-Google-Original-From: "Matt D." <identity AT codespunk DOT com>
Subject: Re: No way to use ssh ~/.ssh/config with "noacl" option
To: cygwin AT cygwin DOT com
References: <59FD8C99 DOT 8010703 AT gmail DOT com> <20171104113723 DOT GC18070 AT calimero DOT vinschen DOT de> <59FDA8D9 DOT 6050808 AT gmail DOT com> <59FDC12F DOT 1080005 AT codespunk DOT com> <59FDDCFA DOT 9030306 AT codespunk DOT com> <20171104163701 DOT GA23538 AT calimero DOT vinschen DOT de> <59FDF754 DOT 4040505 AT gmail DOT com> <59FDFB25 DOT 8060409 AT gmail DOT com>
Message-ID: <5A038E3C.60908@codespunk.com>
Date: Wed, 8 Nov 2017 18:07:40 -0500
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:38.0) Gecko/20100101 Thunderbird/38.3.0
MIME-Version: 1.0
In-Reply-To: <59FDFB25.8060409@gmail.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit

On 11/4/2017 1:38 PM, Matt D. wrote:
> On 11/4/2017 1:15 PM, Matt D. wrote:
>  > On 11/4/2017 11:43 AM, Achim Gratz wrote:
>  >> That's the correct thing to do, even though you made this unnecessarily
>  >> hard for yourself by mounting your home directory with "noacl".
>  >
>  > It's not perfect but I've always had trouble with all of the
>  > modifications Cygwin makes to a file's permissions to support
>  > POSIX-style ACLs. I do miss being able to manage them with chmod and
>  > setfacl though.
>  >
>  > For those wishing to set their ssh config to 600 (as recognized by
>  > Cygwin's ssh), use the following:
>  >
>  > Reset file permissions:
>  >    icacls config /t /q /c /reset
>  >
>  > Inheritence must be disabled to alter other groups:
>  >    icacls config /inheritance:d
>  >
>  > Effectively regarded as "group":
>  >    icacls config /remove:g "Authenticated Users"
>  >    icacls config /remove:g "Users"
>  >
>  > Regarded as "other":
>  >    icacls config /remove:g "Everyone"
>  >
>  > Add the current user as the owner:
>  >    icacls config /grant "%USERNAME%:rw"
>  >
>  >
>  > Matt D.
>
> My previous reply was missing "takeown" to take ownership. The correct
> sequence of commands is:
>
> icacls config /t /q /c /reset
> icacls config /inheritance:d
> takeown /f config
> icacls config /remove:g "Authenticated Users"
> icacls config /remove:g "Users"
> icacls config /remove:g "Everyone"
> icacls config /grant "%USERNAME%:rw"
>
> This is equivalent to "chmod 600 config".
>
>
> Matt D.

Here is a more portable version of taking ownership and setting 
permissions to 600. It uses SIDs instead of literal names which may vary 
between locale:

icacls "id_rsa" /t /q /c /reset
icacls "id_rsa" /inheritance:d
takeown /f "id_rsa"
icacls "id_rsa" /remove *S-1-5-11
icacls "id_rsa" /remove *S-1-5-32-545
icacls "id_rsa" /remove *S-1-1-0
icacls "id_rsa" /grant "%USERNAME%:rw"

S-1-5-11 (Authenticated Users group)
S-1-5-32-545 (Users group)
S-1-1-0 (Everyone group)


Matt D.

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple