From: Eliot Moss <moss@cs.umass.edu>
To: cygwin@cygwin.com
Subject: Re: Permissions question / issue
Date: Fri, 14 Apr 2023 15:49:55 -0400 [thread overview]
Message-ID: <1e61ce54-407c-a719-f55a-c8c8ccbc4d6b@cs.umass.edu> (raw)
In-Reply-To: <87c859fc-0bfb-e6cc-a29e-29ba4eaa1820@cs.umass.edu>
On 4/14/2023 3:43 PM, Eliot Moss via Cygwin wrote:
> On 4/14/2023 3:11 PM, Corinna Vinschen via Cygwin wrote:
>> On Apr 13 23:03, Eliot Moss via Cygwin wrote:
>>> Dear cygwin'ers -
>>>
>>> I seem to be caught in a bind with the Cygwin permissions setup.
>>>
>>> ssh insists that ~/.ssh/config have permissions no less permissive than rw------- (600).
>>
>> Huh? No, it doesn't, usually. My file has perms rw-r--r-- (644) and
>> that's perfectly fine. Also, I tried the same setting as you did,
>> i. e.
>>
>> $ getfacl config
>> # file: config
>> # owner: corinna
>> # group: vinschen
>> user::rw-
>> group::---
>> group:SYSTEM:r-x
>> mask::r-x
>> other::---
>>
>> And ssh still works as desired and does not throw any error.
>>
>> You can also add g:SYSTEM:r-x to the directories and it should have
>> no negative side effect. I just did that with ~/.ssh and ssh still
>> works as expected.
>
> Of course you're entirely right, Corinna! Not sure how I got it
> in my head that it needed 600 permissions. Thank you for clarifying!
>
> However ... ssh *does* demand that key files be accessible only by
> the user. Is there a solution - if necessary using Windows tools -
> to make ssh happy while allowing a SYSTEM backup tool to back up
> the file?
More info:
At present I have:
$ getfacl id_rsa2
# file: id_rsa2
# owner: moss
# group: moss
user::rw-
group::---
group:SYSTEM:r-- #effective:---
mask::---
other::---
$ icacls id_rsa2
id_rsa2 NULL SID:(DENY)(Rc,DC)
ELIOT-SURFACE-3\moss:(R,W,D,WDAC,WO)
ELIOT-SURFACE-3\moss:(Rc,S,RA)
NT AUTHORITY\SYSTEM:(R)
Everyone:(Rc,S,RA)
I don't claim expert level understanding of the Windows access
scheme, but Windows Explorer believes that SYSTEM has read access
to the file, so I suppose this will work. I guess we're kind of
lying to cygwin a little - but in a way that is useful here.
Best wishes - Eliot
next prev parent reply other threads:[~2023-04-14 19:49 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-04-14 3:03 Eliot Moss
2023-04-14 13:25 ` Eliot Moss
2023-04-14 19:11 ` Corinna Vinschen
2023-04-14 19:43 ` Eliot Moss
2023-04-14 19:49 ` Eliot Moss [this message]
2023-04-14 20:17 ` Corinna Vinschen
2023-04-14 20:13 ` Corinna Vinschen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1e61ce54-407c-a719-f55a-c8c8ccbc4d6b@cs.umass.edu \
--to=moss@cs.umass.edu \
--cc=cygwin@cygwin.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).