DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 9FB223858418
Message-ID: <883e0ae2-1ac7-1474-ba06-10d9de441390@aussiebb.com.au>
Date: Mon, 7 Aug 2023 22:11:18 +1000
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101
 Thunderbird/102.13.0
To: cygwin AT cygwin DOT com
Subject: sshd_config AllowStreamLocalForwarding perm off / effectively privsep
 off
From: Shaddy Baddah via Cygwin <cygwin AT cygwin DOT com>
Reply-To: Shaddy Baddah <lithium-cygwin AT shaddybaddah DOT name>
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset="us-ascii"; Format="flowed"
Sender: "Cygwin" <cygwin-bounces+archive-cygwin=delorie DOT com AT cygwin DOT com>

Hi,

For the current OpenSSH server (9.3p2),  AllowStreamLocalForwarding
defaults on. That means both local and remote unix socket port
portforwarding are possible.

For Cygwin, it appears the remote form of this is not possible. The
following message is seen on the client-side, regardless of whether
sshd_config explicitly defines AllowStreamLocalForwarding "on", or
"all":

|Forwarding port.
|debug1: Remote: Server has disabled streamlocal forwarding.

Finding the code around this, and a three(?) component conditional
expression that "fails" into that message, I discovered that the
reason it is not allowed is the following conditional:

|		    (pw->pw_uid != 0 && !use_privsep)) {

and to my surprise, after compiling a debug version of sshd to discover
this conditional, it turns out that use_privsep is set to zero (0).

I've been around the Cygwin community for many years, and I remember
the time when ssh-host-config prompted for priv sep, and the creation
of the "sshd" local user.

I remember the transition when that prompt was removed, and reading that
priv sep was now "on permanently".

I think there is a misunderstanding here though, though I'm not 100%
sure of my reading of the situation. It appears that though priv sep is
on by default, for Cygwin, it is effectively off, as it cannot be
implemented???

Because this bit of code from sshd.c suggests if DISABLE_FD_PASS is set,
then use_privsep needs to be set to false:

|#ifdef DISABLE_FD_PASSING
|	if (1) {
|#else
|	if (authctxt->pw->pw_uid == 0) {
|#endif
|		/* File descriptor passing is broken or root login */
|		use_privsep = 0;
|		goto skip;

DISABLE_FD_PASS is always set by autoconf for Cygwin. And my reading is
that not having that capability effectively means whatever the other
criteria, the executing process doesn't have sufficient "separation" of
privilege to be treated in the same manner.

Otherwise, what's the solution? Because the reason for the earlier guard
(the disallowal of streamlocal) was a fix for a CVE from very long ago,
that allowed unix-sockets to be created on the server as
"root"/privileged user.

-- 
Regards,
Shaddy

-- 
Problem reports:      https://cygwin.com/problems.html
FAQ:                  https://cygwin.com/faq/
Documentation:        https://cygwin.com/docs.html
Unsubscribe info:     https://cygwin.com/ml/#unsubscribe-simple