X-Recipient: archive-cygwin AT delorie DOT com
DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:subject:to:references:from:message-id:date
	:mime-version:in-reply-to:content-type; q=dns; s=default; b=RoKT
	9zj6fF0l6JvjXqq4NnbGRRElw/+5fqu5LFhs97qbQXqr1z1q2Fzgv910DcFqGwZf
	Wl5Ywvv0nxXsM781gsk5Cirz322bZJXyRC5XZxwNHEM5DHHu/NX4NFNpO+XqoQBS
	T7TAXArBCE6h+zLp4GyDH519Vihhqpv+desfWgY=
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:subject:to:references:from:message-id:date
	:mime-version:in-reply-to:content-type; s=default; bh=JdkJr5AagB
	Z9zNX3nyt0D3Ztx1w=; b=hu+ryg8Sr7glkmNikm28VQSiUX3Z9jcQ/VHoFk59SL
	DqwKKY3c7dua24TqvBPE8DgEFnB8LCE5sJm6ddT1HZWG/B+YGaZcB5ofynLz3a71
	JbRgsFFckxzO/nyUTVneqcCAM3/vcv+MHzSXKHDnRlAQnHBgrHZVdIxSyDRaKyOJ
	M=
Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm
List-Id: <cygwin.cygwin.com>
List-Subscribe: <mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive: <http://sourceware.org/ml/cygwin/>
List-Post: <mailto:cygwin AT cygwin DOT com>
List-Help: <mailto:cygwin-help AT cygwin DOT com>, <http://sourceware.org/ml/#faqs>
Sender: cygwin-owner AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
Delivered-To: mailing list cygwin AT cygwin DOT com
Authentication-Results: sourceware.org; auth=none
X-Spam-SWARE-Status: =?ISO-8859-1?Q?No, score=-0.9 required=5.0 tests=BAYES_00,KAM_LAZY_DOMAIN_SECURITY,RCVD_IN_DNSWL_NONE autolearn=no version=3.3.2 spammy=8:t, 8:un, 8:ha, 8:=c3=a4?=
X-HELO: mout.kundenserver.de
Subject: Re: sshd permits logon using disabled user?
To: cygwin AT cygwin DOT com
References: <CANV9t=SSyof86c5Yz3tNhwj4To=eKnrmveQcr59ZmMY-X9_txA AT mail DOT gmail DOT com> <20190124154533 DOT GK2802 AT calimero DOT vinschen DOT de>
From: Stefan Baur <X2Go-ML-1 AT baur-itcs DOT de>
Openpgp: preference=signencrypt
Message-ID: <2b348ac3-63d1-2cd3-430d-2568d650a583@baur-itcs.de>
Date: Thu, 24 Jan 2019 16:51:07 +0100
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.2.1
MIME-Version: 1.0
In-Reply-To: <20190124154533.GK2802@calimero.vinschen.de>
Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="tbPbYfSMHWKuInDWBVuksRE0RPIPq0O2c"
X-IsSubscribed: yes

--tbPbYfSMHWKuInDWBVuksRE0RPIPq0O2c
Content-Type: multipart/mixed; boundary="6PG6NOoSN4q53iovAoZZ5ytaBX9O8IZx7";
 protected-headers="v1"
From: Stefan Baur <X2Go-ML-1 AT baur-itcs DOT de>
To: cygwin AT cygwin DOT com
Message-ID: <2b348ac3-63d1-2cd3-430d-2568d650a583 AT baur-itcs DOT de>
Subject: Re: sshd permits logon using disabled user?
References: <CANV9t=SSyof86c5Yz3tNhwj4To=eKnrmveQcr59ZmMY-X9_txA AT mail DOT gmail DOT com>
 <20190124154533 DOT GK2802 AT calimero DOT vinschen DOT de>
In-Reply-To: <20190124154533 DOT GK2802 AT calimero DOT vinschen DOT de>


--6PG6NOoSN4q53iovAoZZ5ytaBX9O8IZx7
Content-Type: text/plain; charset=utf-8
Content-Language: de-DE
Content-Transfer-Encoding: quoted-printable

Am 24.01.19 um 16:45 schrieb Corinna Vinschen:
>> In the shell, logged on as the disabled user, the 'whoami' command retur=
ns
>> the name of the disabled user.
>>
>> This seems unexpected and not good.
>>
>> Why does sshd allow logon for a disabled user?
> Because the underlying Cygwin function responsible for changing the user
> account only checks if the account exists.  It does not check for any of
> the flags in the user DB.  Yet.
>=20
> I pushed a patch to disallow changing the user account to a disabled or
> locked out account.

I would like to point out that on Linux, you can disable an account's
password ("password -l username" / "usermod -L username"), and still log
in using an SSH key pair.  This is intentional and different to
disabling an account entirely ("usermod -e 1 username" combined with the
above).

So I guess, the question is if there's a way to make Cygwin act similar
to this - maybe if you can tell disabled vs. locked out apart, allow SSH
key pair logins when locked out, but not when disabled?

Kind Regards,
Stefan Baur


--=20
BAUR-ITCS UG (haftungsbeschr=C3=A4nkt)
Gesch=C3=A4ftsf=C3=BChrer: Stefan Baur
Eichen=C3=A4ckerweg 10, 89081 Ulm | Registergericht Ulm, HRB 724364
Fon/Fax 0731 40 34 66-36/-35 | USt-IdNr.: DE268653243


--6PG6NOoSN4q53iovAoZZ5ytaBX9O8IZx7--

--tbPbYfSMHWKuInDWBVuksRE0RPIPq0O2c
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBCAAGBQJcSd7rAAoJEG7d9BjNvlEZ17UH/1iDoRGls0JyV+0IWuXogsY4
hbqHbMiZU/I4XXedw9FsLhmAJifmYXSWiIy5FANlmjMp8K4oFM8KwK4l9WRE8Cjt
T2oWz9bvWPAOEP1YK3fMiRdK+kJ2UMYXHjxqaQO4//pNlvoSCtcQVCK+10S1p0Vr
6DloVsVZjLFf86kPZGVmKRKE35KG3JrFV2gxu3kRUCrIoyLdj43r9rtwRb7F8ANO
jKyj0mxQleryNOAPGe+iIcuNQ7xAvU22N3Riui4q3Fhfka3TDdHYmIizz+BG0oS6
UMLubTkgnTqClrsjbtfp1ECvepebazvDMy4RjXEopAODkKkgoFeb6Yn1NjhfzKc=
=FvjL
-----END PGP SIGNATURE-----

--tbPbYfSMHWKuInDWBVuksRE0RPIPq0O2c--