RE: Possible Security Hole in SSHD w/ CYGWIN?

["David Willis" <david_willis@comcast.net>]

First let me say that I'm not too well-versed in coding and the ins and outs
of how processes utilize credentials when they are spawned. However, the
jist of it seems to be that if there are no credentials saved with passwd -R
to replace the current user token with that of the user that is SSH'd in,
then there is no way to change that token at all (or get rid of it) meaning
the token used when accessing a share will stay as the token of the caller -
namely cyg_server? Please correct me if I'm way off-base but that seems to
be my interpretation of this.

If that is the case, it seems this is an unintended side effect of the way
CYGWIN and sshd work together, and with the current state of Windows there
isn't really a way around it. And that's OK (I can work around it if that's
the case), I just wanted to get to the bottom of why this was happening and
let people know the situation because I wasn't sure if anyone was aware of
this behavior.

Thank you very much Erik and everyone else for the help with this. This is
my first time posting on these mailing lists and I appreciate people taking
the time to reproduce the issue and help work it out.

Thanks,

David

-----Original Message-----
From: cygwin-owner@cygwin.com [mailto:cygwin-owner@cygwin.com] On Behalf Of
Corinna Vinschen
Sent: Monday, February 15, 2016 4:11 AM
To: cygwin@cygwin.com
Subject: Re: Possible Security Hole in SSHD w/ CYGWIN?

On Feb 14 13:36, Erik Soderquist wrote:
> I think the key point is that if no network password is stored using 
> the "passwd -R" option, then there should be absolutely no network 
> access at all in the current code/design, not a fall through to the 
> cyg_server account's network access, regardless of how much or little 
> network access that account has.

The problem is this:

I'm not aware of any explicit OS call which allows the process calling
CreateProcessAsUser to drop network credentials of the *caller* in the child
process running under another user token.

In fact, I'm not even aware of any call which allows to drop network
credentials even for the calling process, and that would be the wrong thing
to do anyway.

This is a clear cut case of "I need help" and "Patches gratefully accepted".


Corinna

-- 
Corinna Vinschen                  Please, send mails regarding Cygwin to
Cygwin Maintainer                 cygwin AT cygwin DOT com
Red Hat


--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple