From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 97098 invoked by alias); 25 Jan 2019 17:48:42 -0000 Mailing-List: contact cygwin-help@cygwin.com; run by ezmlm Precedence: bulk List-Id: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: cygwin-owner@cygwin.com Mail-Followup-To: cygwin@cygwin.com Received: (qmail 97028 invoked by uid 89); 25 Jan 2019 17:48:40 -0000 Authentication-Results: sourceware.org; auth=none X-Spam-SWARE-Status: No, score=-1.9 required=5.0 tests=BAYES_00,RCVD_IN_DNSWL_NONE,SPF_PASS autolearn=ham version=3.3.2 spammy=California, california, Administrator, H*M:zebra X-HELO: mail-pl1-f172.google.com Received: from mail-pl1-f172.google.com (HELO mail-pl1-f172.google.com) (209.85.214.172) by sourceware.org (qpsmtpd/0.93/v0.84-503-g423c35a) with ESMTP; Fri, 25 Jan 2019 17:48:37 +0000 Received: by mail-pl1-f172.google.com with SMTP id t13so4858089ply.13 for ; Fri, 25 Jan 2019 09:48:37 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=berkeley-edu.20150623.gappssmtp.com; s=20150623; h=from:date:to:subject:message-id:references:mime-version :content-disposition:in-reply-to:user-agent; bh=ujQ/44q3FICof7k68yL/TKjcye8Vxhk4RNsMQ/q0QPA=; b=ZgiIQch//lj+PINKodwaTVGeOQ1944+/ST0ujWoDT8W4f5lv7BNEY22Zb3qxalIAs5 FTuXKqLw1fGChaWGsHXtlU+LgHzb/rFHRFTHyJMHe4p7sRs7pgRUjyLWFQTob802i+O4 iY3GkJ16CsZAow404DOYqNAwOuIXUDbDu+yz5I35wSSqkWYQi2vLXN8gRTUG30Daz0i9 xJrovZCHBHpQLHdbogXThGQo/RkYkCjPNDFyhWMB+EQd3Ytl94TNfdTHggz5QWNLZhj1 +w9mnsot2mIyMUyONEu2HJIkvJoFF/jvGPhX4bytUdiqgWz8JSKMNGHw1tjzNtBaJYdl ldxA== Return-Path: Received: from zebra.localdomain (173-164-243-238-SFBA.hfc.comcastbusiness.net. [173.164.243.238]) by smtp.gmail.com with ESMTPSA id g3sm40574948pfe.37.2019.01.25.09.48.34 for (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Fri, 25 Jan 2019 09:48:34 -0800 (PST) From: Stephen Paul Carrier Received: by zebra.localdomain (Postfix, from userid 510) id 5A50E40BC5; Fri, 25 Jan 2019 09:48:33 -0800 (PST) Date: Fri, 25 Jan 2019 17:48:00 -0000 To: cygwin@cygwin.com Subject: Re: sshd permits logon using disabled user? Message-ID: <20190125174833.GA1710@zebra> References: <1690850474.834980.1548391349102.ref@mail.yahoo.com> <1690850474.834980.1548391349102@mail.yahoo.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.9.1 (2017-09-22) X-IsSubscribed: yes X-SW-Source: 2019-01/txt/msg00229.txt.bz2 On Fri, Jan 25, 2019 at 08:34:09AM -0700, Bill Stewart wrote: > On Fri, Jan 25, 2019 at 3:36 AM Stefan Baur wrote: > > > Not on Linux (and possibly other Unices). There, it's perfectly valid > > to disable an account's password login (both locally and remote), but to > > at the same time allow ssh key file based logins for the same account. > > But disabling _password login_ is an entirely separate issue from > disabling _the account itself_. > > Before the fix, it was possible to log on to sshd using a disabled (or > locked) account. > > There should be _no_ scenario where it is possible to log on using a > disabled/locked account. There are different paths to access and to completely disable the account you need to close all of them. There are many reasons to disable some paths without disabling all paths and converting the switch that can disable one path to a switch that will disable all paths will break some setups and be less flexible. (As Stefan Baur is pointing out effectively.) To disable ssh logins really, instead of changing the way Cygwin works for everyone, you could do what UNIX/Linux admins do, something like moving the user .ssh folder to .ssh.disabled. Stephen Carrier Systems Administrator BEAR (Berkeley Evaluation & Assessment Research) Center Graduate School of Education University of California, Berkeley http://BEARcenter.Berkeley.EDU/ carrier@Berkeley.EDU -- Problem reports: http://cygwin.com/problems.html FAQ: http://cygwin.com/faq/ Documentation: http://cygwin.com/docs.html Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple