From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 1353 invoked by alias); 13 Mar 2019 15:29:06 -0000 Mailing-List: contact cygwin-help@cygwin.com; run by ezmlm Precedence: bulk List-Id: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: cygwin-owner@cygwin.com Mail-Followup-To: cygwin@cygwin.com Received: (qmail 1342 invoked by uid 89); 13 Mar 2019 15:29:06 -0000 Authentication-Results: sourceware.org; auth=none X-Spam-SWARE-Status: No, score=-102.6 required=5.0 tests=AWL,BAYES_00,GOOD_FROM_CORINNA_CYGWIN,RCVD_IN_DNSWL_NONE autolearn=ham version=3.3.1 spammy=password, she, H*F:D*cygwin.com X-HELO: mout.kundenserver.de Received: from mout.kundenserver.de (HELO mout.kundenserver.de) (217.72.192.75) by sourceware.org (qpsmtpd/0.93/v0.84-503-g423c35a) with ESMTP; Wed, 13 Mar 2019 15:29:04 +0000 Received: from calimero.vinschen.de ([24.134.7.25]) by mrelayeu.kundenserver.de (mreue109 [212.227.15.183]) with ESMTPSA (Nemesis) id 1Mj8eB-1gaHEZ0AYn-00f8t4 for ; Wed, 13 Mar 2019 16:29:02 +0100 Received: by calimero.vinschen.de (Postfix, from userid 500) id 6C341A80741; Wed, 13 Mar 2019 16:29:01 +0100 (CET) Date: Wed, 13 Mar 2019 15:29:00 -0000 From: Corinna Vinschen To: cygwin@cygwin.com Subject: Re: sshd privsep user still required? Message-ID: <20190313152901.GA18873@calimero.vinschen.de> Reply-To: cygwin@cygwin.com Mail-Followup-To: cygwin@cygwin.com References: <20190313085650.GS3785@calimero.vinschen.de> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="AhhlLboLdkugWU4S" Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.11.3 (2019-02-01) X-SW-Source: 2019-03/txt/msg00350.txt.bz2 --AhhlLboLdkugWU4S Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Content-length: 1420 On Mar 13 09:11, Bill Stewart wrote: > On Wed, Mar 13, 2019 at 2:57 AM Corinna Vinschen wrote: >=20 > > > a) Why is it necessary to specify SYSTEM as user number 0 in the > > > /etc/password file? > > > > > > b) Why is the sshd account required? > > > > sshd checks for uid 0 and requires the sshd account when chroot is > > requested. > > > > > c) Why are /cygdrive and /dev directories visible when connecting usi= ng > a > > > sftp client? > > > > The Cygwin chroot implementation is pure fake. It's not backed by the > > OS and it's failry easy to break out of the jail. As such, the chroot > > implementation is deprecated and only kept for backward compatibility. > > I suggest not to use it. It gives a wrong sense of security. >=20 > Right: I totally understand that Cygwin's chroot implementation does not > add any security (because chroot doesn't exist natively on Windows). >=20 > However: It's still the case that the user cannot bypass OS security even > if he or she "escapes" from the jail, right? >=20 > My goal is to restrict sftp browsing on the client side. >=20 > Using ChrootDirectory with "ForceCommand internal-sftp" in sshd_config > seems to accomplish this. >=20 > Is this not correct? It seems like it, but I wouldn't bet on it. The fact that /cygdrive and /dev directories are still visible inside the chroot jail speaks against that. Corinna --=20 Corinna Vinschen Cygwin Maintainer --AhhlLboLdkugWU4S Content-Type: application/pgp-signature; name="signature.asc" Content-length: 833 -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEoVYPmneWZnwT6kwF9TYGna5ET6AFAlyJIb0ACgkQ9TYGna5E T6D4Vw/9E/GrjoHs4Wx5oeJpN8NHr207pxwJGX/u43EfWYqEaX4NKQ8SCLY0fabE /UhobaPk97OLfXUCgUFafGLGJn/2Eyj4x788ZIN4D8KA+7zNTS0Lx1U029XtQRZ/ CVYiAFwwBtqVlUndJZwJbe8PaXyzbTxrQ3ty4AWKMDy0D0eO2pDMo7XA3rRwfOvs uzuHg+UKIn51JhrF+/WWEbs3KvHwaq3Z4OK9a4hBDR53MQhWfA08rUHkp8zNJl0Q 13c7D0kfFhAwf3D1BiQJl1vhjxMNJ7J8164WaPuhn68aZffPg3BYV9IhRX/veCIh OfouOy700nTWlpDdsd/ru0ZAHSYjqzxveNjewxldXBaA9Ua00K22g9X9LjmzoWyQ y5I+smor4YFgskMbez8kAsSVVjA8Yp+ExyYLPPW1NajRmwCp4G7XzywIgNfC0gKj 0gDoCodQXtXkbk5sihv5DKS7o7s+jaGkq4FyJcaKUROxiUTQe4DUlWPO9IU2wXZv LBEPUGxIoP+wzRabZMiPug6HspUdEnPeNWkYmHgwMedAOiR1TF4JEFSoESAeMvT8 wGumxaeZyiZ+O34KEy50vnk6AnuMpo/wGjPLnx4bP5ONNf/Ft9/np2uEjxGyLleP EkteJ0Mu9AqXBe3rNA4JhFMUCzrHHSKBdf+z5y5hwcyFei+tMuY= =7xO/ -----END PGP SIGNATURE----- --AhhlLboLdkugWU4S--