public inbox for cygwin-apps@cygwin.com
 help / color / mirror / Atom feed
* Updated: 1.7.0-33 (New method to logon without password ... with  password)
@ 2008-11-26 12:44 Corinna Vinschen
  2008-12-05 11:07 ` Updated: 1.7.0-34 (...and a plea) Corinna Vinschen
  0 siblings, 1 reply; 17+ messages in thread
From: Corinna Vinschen @ 2008-11-26 12:44 UTC (permalink / raw)
  To: cygwin-developers, cygwin-apps

Hi,

I just uploaded a cygwin-1.7.0-33 release which contains the new feature
explained below.

For a long time we have the feature that you can use ssh or rsh or
cron without password.  But all methods which don't use a password have
a major drawback:  The user token has no credentials which allow the
usual simple network access without additional hassle.  This makes, for
instance, automated remote scripting which need network access a rather
painful experience.

Interix, OTOH, has a command called `regpwd', which allows to specify a
password for the current user, which then is stored in some hidden,
obfuscated area in the registry (HKLM\SECURITY\Policy\Secrets).  This
same area in the registry is also used by the OS to store passowrds of
accounts running Windows services.

The latest changes I applied today add this ability to Cygwin as well.
I'm only disappointed that it took me so long because the LSA functions
to access this area are documented since ages and I've read the LSA docs
a lot.  Oh well.

When a privileged process calls setuid/seteuid, Cygwin now first checks
if a password has been stored for the uid given as argument.  It checks
in two locations, the one maintained by Cygwin as well as the one
maintained by Interix.  So, if your account has already a password
stored by Interix' regpwd, you can just use it in Cygwin.  If a password
is found, it's used in a call to LogonUser.  If this call succeeds, the
token is used to switch the user context and you get all your usual
network access "for free"(*).  Otherwise Cygwin falls back to the other
methods, LSA authentication using Cygwin's LSA authentication DLL, or
using NtCreateToken as last resort.

To store a password in the registry, use the new -R/--reg-store-pwd
option to passwd(1).  Note that storing a password in the registry this
way is a privileged operation.  It's only accessible to Administrators.
When a normal user wants to store a password in the registry this way,
a workaround is necessary.  The workaround is cygserver running as
privileged service.  So, when cygserver is running, even a normal user
can enter his/her password with

  bash$ CYGWIN=server passwd -R

I also added the changes to passwd to the docs (which I uploaded to
http://cygwin.com/1.7/cygwin-ug-net.html and
http://cygwin.com/1.7/cygwin-ug-net/cygwin-ug-net.html), but there's
still a lot missing in the ntsec documentation.  Sorry about that.


Have fun,
Corinna


(*) "for free" isn't quite right, of course.  You're giving up on
    security.  The passwords are stored two-way encrypted in a registry
    area only accessible to admins and the system.  The Cygwin password
    is accessible only for local admins, not from remote as is the
    Interix password.  However, if somebody gets admin access to your
    machine, you lost.  OTOH, if somebody got admin access to your
    machine anyway, you probably have other, more pressing problems.

-- 
Corinna Vinschen                  Please, send mails regarding Cygwin to
Cygwin Project Co-Leader          cygwin AT cygwin DOT com
Red Hat

^ permalink raw reply	[flat|nested] 17+ messages in thread

end of thread, other threads:[~2008-12-09 15:02 UTC | newest]

Thread overview: 17+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2008-11-26 12:44 Updated: 1.7.0-33 (New method to logon without password ... with password) Corinna Vinschen
2008-12-05 11:07 ` Updated: 1.7.0-34 (...and a plea) Corinna Vinschen
2008-12-05 13:06   ` Chris Sutcliffe
2008-12-05 14:07     ` Corinna Vinschen
2008-12-05 17:00     ` Charles Wilson
2008-12-05 13:59   ` Eric Blake
2008-12-05 14:09     ` Corinna Vinschen
2008-12-08 17:02   ` Christopher Faylor
2008-12-08 17:15     ` Corinna Vinschen
2008-12-08 18:01       ` Christopher Faylor
2008-12-08 18:15         ` Corinna Vinschen
2008-12-08 19:56           ` Christopher Faylor
2008-12-09 10:19             ` Corinna Vinschen
2008-12-09 13:48               ` Corinna Vinschen
2008-12-09 14:47                 ` Brian Dessent
2008-12-09 14:59                   ` Corinna Vinschen
2008-12-09 15:02                   ` Christopher Faylor

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).