From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 103194 invoked by alias); 24 Jan 2019 20:23:48 -0000 Mailing-List: contact cygwin-help@cygwin.com; run by ezmlm Precedence: bulk List-Id: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: cygwin-owner@cygwin.com Mail-Followup-To: cygwin@cygwin.com Received: (qmail 103166 invoked by uid 89); 24 Jan 2019 20:23:48 -0000 Authentication-Results: sourceware.org; auth=none X-Spam-SWARE-Status: No, score=-100.9 required=5.0 tests=BAYES_00,GOOD_FROM_CORINNA_CYGWIN,KAM_LAZY_DOMAIN_SECURITY,RCVD_IN_DNSWL_NONE autolearn=ham version=3.3.2 spammy=download X-HELO: mout.kundenserver.de Received: from mout.kundenserver.de (HELO mout.kundenserver.de) (217.72.192.74) by sourceware.org (qpsmtpd/0.93/v0.84-503-g423c35a) with ESMTP; Thu, 24 Jan 2019 20:23:46 +0000 Received: from calimero.vinschen.de ([24.134.7.25]) by mrelayeu.kundenserver.de (mreue108 [212.227.15.183]) with ESMTPSA (Nemesis) id 1MjjKf-1hSRx02JUh-00lDES; Thu, 24 Jan 2019 21:23:41 +0100 Received: by calimero.vinschen.de (Postfix, from userid 500) id 63BF3A824DA; Thu, 24 Jan 2019 21:23:40 +0100 (CET) Date: Thu, 24 Jan 2019 20:23:00 -0000 From: Corinna Vinschen To: Bill Stewart Cc: cygwin@cygwin.com Subject: Re: sshd permits logon using disabled user? Message-ID: <20190124202340.GN2802@calimero.vinschen.de> Reply-To: cygwin@cygwin.com Mail-Followup-To: Bill Stewart , cygwin@cygwin.com References: <20190124154533.GK2802@calimero.vinschen.de> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="T/yvDUeUQRtJzDrt" Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.10.1 (2018-07-13) X-SW-Source: 2019-01/txt/msg00216.txt.bz2 --T/yvDUeUQRtJzDrt Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Content-length: 2345 On Jan 24 09:48, Bill Stewart wrote: > Hello Corinna, >=20 > I performed the following steps: >=20 > 1. Downloaded cygwin-20190124.tar.xz > 2. Extracted it > 3. Stopped sshd > 4. Renamed existing /bin/cygwin1.dll to cygwin1-20181108.dll > 5. Copied cygwin1.dll from download to /bin > 6. Started sshd >=20 > Did I miss anything? No, I did. > It still allows logon with disabled account. I should have tested pubkey auth as well but as it was I just tested with pathword auth. These methods take slightly different paths in Cygwin when trying to switch the user account. I pushed another patch and created new snapshots in the same location https://cygwin.com/snapshots/. HTH, Corinna >=20 > Thanks, >=20 > Bill >=20 >=20 > On Thu, Jan 24, 2019 at 8:45 AM Corinna Vinschen > wrote: >=20 > > On Jan 24 06:28, Bill Stewart wrote: > > > I am running Windows 10 (1803) and experimenting with sshd installed = as a > > > Windows service. > > > > > > The computer is a domain member. I created a local computer account f= or > > > testing. > > > > > > I created host keys and a public/private key pair to use to log on the > > user. > > > > > > This works, except I notice that if I disable the Windows user accoun= t, I > > > can still log on using ssh using that account. > > > > > > In the shell, logged on as the disabled user, the 'whoami' command > > returns > > > the name of the disabled user. > > > > > > This seems unexpected and not good. > > > > > > Why does sshd allow logon for a disabled user? > > > > Because the underlying Cygwin function responsible for changing the user > > account only checks if the account exists. It does not check for any of > > the flags in the user DB. Yet. > > > > I pushed a patch to disallow changing the user account to a disabled or > > locked out account. > > > > I just uploaded new developer snapshots containing this change to > > https://cygwin.com/snapshots/ > > > > Please give them a try. > > > > > > Thanks, > > Corinna > > > > -- > > Corinna Vinschen > > Cygwin Maintainer > > >=20 > -- > Problem reports: http://cygwin.com/problems.html > FAQ: http://cygwin.com/faq/ > Documentation: http://cygwin.com/docs.html > Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple --=20 Corinna Vinschen Cygwin Maintainer --T/yvDUeUQRtJzDrt Content-Type: application/pgp-signature; name="signature.asc" Content-length: 833 -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEoVYPmneWZnwT6kwF9TYGna5ET6AFAlxKHswACgkQ9TYGna5E T6Dq3g/7BRWAsxmzmAOsI4ZU1oWhxV5okbxci6v8KsqunAlgdwj1ZeqqOmYKTjDO XLzaa32g1BKHIKTxRDt7BvccHJfCamB8YxU+LpXUT4Op6GrUoDUtdftvQNNPlt04 Us7Voi98pg8Q4U1bhbSkBKiqYAPLFavXgq3IZ1PEXVgiCDJUWzv0IcGVfmreH44f FEBed4KLZ6BUcoulh7NTwFk5rVhjZuVxTJlUB5vx6TpboRl0ockPQ/fKr7LZDuc0 VMDOH02F1HzUAl0uu9wewKMltlMYGcnbmglZTnMcatI2TU4ICbBYD1nqNQTc3is4 V0klIaEEk0CxFwBSgZ3X9LGQAYh1jAAXmOKrigyqxS/KwRjiuInFCfC3v1Ra/vgQ Exc14iFmk9+NsKEKaFgRmnHYBVfWPnpBY7wsqyYbWnzV1iRjnq3S0KbM/8/wShA5 YxxOA6YscB/+0PiCJz5d2essuThp+RR4yG/2A4F3rogZOGeGAenXCPZTWBeeCZR0 XtXyPOtPKiNdUYB5IOLdD9TbQDZWegmf5ayUXdCKftErM0a6zWXfJDkVGU4EGqrj w1nNQRFJJ4sUTUvLNO9dYVvuOCvdqpXLpdfhrElXAApkXVpvkXaW0Yu+zY3lZeUN p690L+JfAxWIOV0IhmR5QuYckx2H0ekhzTakeF3AK5obeN6nxNc= =JbTU -----END PGP SIGNATURE----- --T/yvDUeUQRtJzDrt--