X-Recipient: archive-cygwin AT delorie DOT com
DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:date:from:to:cc:subject:message-id:reply-to
	:references:mime-version:content-type:in-reply-to; q=dns; s=
	default; b=tKMS0pcvMuJqbmP5++J4P8HuT2SvLkmct+Kl3mOw3LShzkuFA98KW
	STfutEhoQiFnPRzuB8hAyWx8z1GIQGXTwio0RcMbJWk0wav5rIwdQpQMWv7MjErQ
	CSSq/SpsCKz84dM+7flgfxmyM2OeSchX7aWmvj85/zmmcHw7/GkU8I=
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:date:from:to:cc:subject:message-id:reply-to
	:references:mime-version:content-type:in-reply-to; s=default;
	 bh=a5/rUiHD5dHk86h24SiMdNWzPyY=; b=dr9yPOJbv4tuqjokbV8aPx+E3uwU
	HMB8LWCaZxnF59E59wKiNesSoV84c4h8n0HCGR8jPN+Nbjo8ysUtnwrdraFRJFfO
	+UT2EbE27fujCje4Bnlq4fnWYsMiUyeIZA4qA/3R+fGhQAa7cua9wHCu6sld7/kZ
	FNf8XTqHgeo7vyg=
Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm
List-Id: <cygwin.cygwin.com>
List-Subscribe: <mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive: <http://sourceware.org/ml/cygwin/>
List-Post: <mailto:cygwin AT cygwin DOT com>
List-Help: <mailto:cygwin-help AT cygwin DOT com>, <http://sourceware.org/ml/#faqs>
Sender: cygwin-owner AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
Delivered-To: mailing list cygwin AT cygwin DOT com
Authentication-Results: sourceware.org; auth=none
X-Spam-SWARE-Status: No, score=-100.9 required=5.0 tests=BAYES_00,GOOD_FROM_CORINNA_CYGWIN,KAM_LAZY_DOMAIN_SECURITY,RCVD_IN_DNSWL_NONE autolearn=ham version=3.3.2 spammy=download
X-HELO: mout.kundenserver.de
Date: Thu, 24 Jan 2019 21:23:40 +0100
From: Corinna Vinschen <corinna-cygwin AT cygwin DOT com>
To: Bill Stewart <bstewart AT iname DOT com>
Cc: cygwin AT cygwin DOT com
Subject: Re: sshd permits logon using disabled user?
Message-ID: <20190124202340.GN2802@calimero.vinschen.de>
Reply-To: cygwin AT cygwin DOT com
Mail-Followup-To: Bill Stewart <bstewart AT iname DOT com>, cygwin AT cygwin DOT com
References: <CANV9t=SSyof86c5Yz3tNhwj4To=eKnrmveQcr59ZmMY-X9_txA AT mail DOT gmail DOT com> <20190124154533 DOT GK2802 AT calimero DOT vinschen DOT de> <CANV9t=RAGYEqEXi3SHDR397TzvE9O3AUGaMJMCzk+_d3uM1d+Q AT mail DOT gmail DOT com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha256;	protocol="application/pgp-signature"; boundary="T/yvDUeUQRtJzDrt"
Content-Disposition: inline
In-Reply-To: <CANV9t=RAGYEqEXi3SHDR397TzvE9O3AUGaMJMCzk+_d3uM1d+Q@mail.gmail.com>
User-Agent: Mutt/1.10.1 (2018-07-13)

--T/yvDUeUQRtJzDrt
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Jan 24 09:48, Bill Stewart wrote:
> Hello Corinna,
>=20
> I performed the following steps:
>=20
> 1. Downloaded cygwin-20190124.tar.xz
> 2. Extracted it
> 3. Stopped sshd
> 4. Renamed existing /bin/cygwin1.dll to cygwin1-20181108.dll
> 5. Copied cygwin1.dll from download to /bin
> 6. Started sshd
>=20
> Did I miss anything?

No, I did.

> It still allows logon with disabled account.

I should have tested pubkey auth as well but as it was I just tested
with pathword auth.  These methods take slightly different paths in
Cygwin when trying to switch the user account.

I pushed another patch and created new snapshots in the same location
https://cygwin.com/snapshots/.


HTH,
Corinna


>=20
> Thanks,
>=20
> Bill
>=20
>=20
> On Thu, Jan 24, 2019 at 8:45 AM Corinna Vinschen <corinna-cygwin AT cygwin DOT c=
om>
> wrote:
>=20
> > On Jan 24 06:28, Bill Stewart wrote:
> > > I am running Windows 10 (1803) and experimenting with sshd installed =
as a
> > > Windows service.
> > >
> > > The computer is a domain member. I created a local computer account f=
or
> > > testing.
> > >
> > > I created host keys and a public/private key pair to use to log on the
> > user.
> > >
> > > This works, except I notice that if I disable the Windows user accoun=
t, I
> > > can still log on using ssh using that account.
> > >
> > > In the shell, logged on as the disabled user, the 'whoami' command
> > returns
> > > the name of the disabled user.
> > >
> > > This seems unexpected and not good.
> > >
> > > Why does sshd allow logon for a disabled user?
> >
> > Because the underlying Cygwin function responsible for changing the user
> > account only checks if the account exists.  It does not check for any of
> > the flags in the user DB.  Yet.
> >
> > I pushed a patch to disallow changing the user account to a disabled or
> > locked out account.
> >
> > I just uploaded new developer snapshots containing this change to
> > https://cygwin.com/snapshots/
> >
> > Please give them a try.
> >
> >
> > Thanks,
> > Corinna
> >
> > --
> > Corinna Vinschen
> > Cygwin Maintainer
> >
>=20
> --
> Problem reports:       http://cygwin.com/problems.html
> FAQ:                   http://cygwin.com/faq/
> Documentation:         http://cygwin.com/docs.html
> Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

--=20
Corinna Vinschen
Cygwin Maintainer

--T/yvDUeUQRtJzDrt
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEoVYPmneWZnwT6kwF9TYGna5ET6AFAlxKHswACgkQ9TYGna5E
T6Dq3g/7BRWAsxmzmAOsI4ZU1oWhxV5okbxci6v8KsqunAlgdwj1ZeqqOmYKTjDO
XLzaa32g1BKHIKTxRDt7BvccHJfCamB8YxU+LpXUT4Op6GrUoDUtdftvQNNPlt04
Us7Voi98pg8Q4U1bhbSkBKiqYAPLFavXgq3IZ1PEXVgiCDJUWzv0IcGVfmreH44f
FEBed4KLZ6BUcoulh7NTwFk5rVhjZuVxTJlUB5vx6TpboRl0ockPQ/fKr7LZDuc0
VMDOH02F1HzUAl0uu9wewKMltlMYGcnbmglZTnMcatI2TU4ICbBYD1nqNQTc3is4
V0klIaEEk0CxFwBSgZ3X9LGQAYh1jAAXmOKrigyqxS/KwRjiuInFCfC3v1Ra/vgQ
Exc14iFmk9+NsKEKaFgRmnHYBVfWPnpBY7wsqyYbWnzV1iRjnq3S0KbM/8/wShA5
YxxOA6YscB/+0PiCJz5d2essuThp+RR4yG/2A4F3rogZOGeGAenXCPZTWBeeCZR0
XtXyPOtPKiNdUYB5IOLdD9TbQDZWegmf5ayUXdCKftErM0a6zWXfJDkVGU4EGqrj
w1nNQRFJJ4sUTUvLNO9dYVvuOCvdqpXLpdfhrElXAApkXVpvkXaW0Yu+zY3lZeUN
p690L+JfAxWIOV0IhmR5QuYckx2H0ekhzTakeF3AK5obeN6nxNc=
=JbTU
-----END PGP SIGNATURE-----

--T/yvDUeUQRtJzDrt--