Re: Cygwin 3.1.5, 3.1.6 and 3.1.7 builds reporting tty errors with OpenSSH Services in indows Event Logs

[Stephen Carrier <carrier@berkeley.edu>]

Please don't top-post in this list.  I'll move your reply down.

>    From: [2]Stephen Carrier
>    Sent: Wednesday, 16 September 2020 2:22 AM
>    To: [3]Peter Board
>    Cc: [4]cygwin@cygwin.com
>    Subject: Re: Cygwin 3.1.5, 3.1.6 and 3.1.7 builds reporting tty errors
>    with OpenSSH Services in indows Event Logs
> 
> 
>    On Mon, Sep 14, 2020 at 08:18:53AM +0000, Peter Board via Cygwin wrote:
>    > Hi,
>    >
>    > I am trying to update our Cygwin libraries at work, which we use on
>    many servers to provide OpenSSH services.
>    > I have been making update packages for many years from a Cygwin
>    install on a development server, and went to update our systems to the
>    latest OpenSSH 8.3p1 build.
>    >
>    > However after making the update package, I found that the Windows
>    Event Log (or if Syslogd is setup – which we do have in our general
>    Cygwin deployment /var/log/messages) gets two errors when using any
>    version of the Cygwin Libraries after the 3.1.4 build.
>    >
>    >
>    > Sep 14 12:06:48 hostname sshd: PID 2093: error: Failed to disconnect
>    from controlling tty.
>    >
>    > Sep 14 12:06:48 hostname sshd: PID 2093: error: ioctl(TIOCSCTTY):
>    Operation not permitted
>    Can this be reproduced in a standard cygwin install?  It seems as if
>    your have a customized environment where you compile your own packages,
>    and updated the cygwin libs perhaps w/o updating openssh at the same
>    time.
>    Stephen
> 
> References
> 
>    1. https://go.microsoft.com/fwlink/?LinkId=550986
>    2. mailto:carrier@berkeley.edu
>    3. mailto:p_board@hotmail.com
>    4. mailto:cygwin@cygwin.com

On Tue, Sep 15, 2020 at 11:46:30PM +0000, Peter Board wrote:
>    Hi Stephen,
> 
> 
>    Thanks for responding. I have a standard Cygwin install on my
>    Development server (32bit and 64bit setups) that I extract the updates
>    from for our custom package and I tested for the fault after I saw it
>    was occurring in our custom Cygwin install using the standard Cygwin
>    setup. The same errors are being logged in the standard Cygwin install.
>    I ran the Cygwin sshd installation script in the standard 64bit Cygwin
>    install, to create the Cygwin OpenSSH service, authorised my user
>    account to login and found that the Windows Event logs also logged the
>    same errors as our normal package location.
> 
> 
>    I keep the standard installs on “F:\Cygwin” (32bit Cygwin) and
>    “F:\Cygwin64” (64bit Cygwin).
> 
> 
>    Our Custom Cygwin \ OpenSSH package lives on “C:\Program
>    Files(x86)\OpenSSH”, which is where we have kept it for 15+ odd years.
> 
> 
>    After setting up the Cygwin (64bit version) just using a out of the box
>    Cygwin installer on F:\Cygwin64, I setup OpenSSH using the built in
>    /bin/ssh-host-config script and then authorised my user to login to the
>    “cygsshd” service. The standard SSH service with no modifications from
>    me, produces these errors in the Windows Event Logs.
> 
> 
>    It accepted the password and logged the user in fine to bash shell.
>    (I’ve removed the hostname and username from the example below)
> 
> 
>    ---------- Event Log Entries ------------
> 
> 
>    Log Name:      Application
> 
>    Source:        sshd
> 
>    Date:          14/09/2020 4:30:26 PM
> 
>    Event ID:      0
> 
>    Task Category: None
> 
>    Level:         Information
> 
>    Keywords:      Classic
> 
>    User:          SYSTEM
> 
>    Computer:      hostname
> 
>    Description:
> 
>    The description for Event ID 0 from source sshd cannot be found. Either
>    the component that raises this event is not installed on your local
>    computer or the installation is corrupted. You can install or repair
>    the component on the local computer.
> 
> 
>    If the event originated on another computer, the display information
>    had to be saved with the event.
> 
> 
>    The following information was included with the event:
> 
> 
>    sshd: PID 1620: Accepted password for USERNAME from X.X.X.X port 56545
>    ssh2
> 
> 
>    Event Xml:
> 
>    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
> 
>      <System>
> 
>        <Provider Name="sshd" />
> 
>        <EventID Qualifiers="0">0</EventID>
> 
>        <Level>4</Level>
> 
>        <Task>0</Task>
> 
>        <Keywords>0x80000000000000</Keywords>
> 
>        <TimeCreated SystemTime="2020-09-14T06:30:26.000000000Z" />
> 
>        <EventRecordID>2427841</EventRecordID>
> 
>        <Channel>Application</Channel>
> 
>        <Computer>hostname</Computer>
> 
>        <Security UserID="S-1-5-18" />
> 
>      </System>
> 
>      <EventData>
> 
>        <Data>sshd: PID 1620: Accepted password for USERNAME from X.X.X.X
>    port 56545 ssh2</Data>
> 
>      </EventData>
> 
>    </Event>
> 
> 
>    ---------- Event Log Entries ------------
> 
> 
>    Log Name:      Application
> 
>    Source:        sshd
> 
>    Date:          14/09/2020 4:30:27 PM
> 
>    Event ID:      0
> 
>    Task Category: None
> 
>    Level:         Error
> 
>    Keywords:      Classic
> 
>    User:          SYSTEM
> 
>    Computer:      hostname
> 
>    Description:
> 
>    The description for Event ID 0 from source sshd cannot be found. Either
>    the component that raises this event is not installed on your local
>    computer or the installation is corrupted. You can install or repair
>    the component on the local computer.
> 
> 
>    If the event originated on another computer, the display information
>    had to be saved with the event.
> 
> 
>    The following information was included with the event:
> 
> 
>    sshd: PID 1622: error: Failed to disconnect from controlling tty.
> 
> 
>    Event Xml:
> 
>    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
> 
>      <System>
> 
>        <Provider Name="sshd" />
> 
>        <EventID Qualifiers="0">0</EventID>
> 
>        <Level>2</Level>
> 
>        <Task>0</Task>
> 
>        <Keywords>0x80000000000000</Keywords>
> 
>        <TimeCreated SystemTime="2020-09-14T06:30:27.000000000Z" />
> 
>        <EventRecordID>2427842</EventRecordID>
> 
>        <Channel>Application</Channel>
> 
>        <Computer>hostname</Computer>
> 
>        <Security UserID="S-1-5-18" />
> 
>      </System>
> 
>      <EventData>
> 
>        <Data>sshd: PID 1622: error: Failed to disconnect from controlling
>    tty.</Data>
> 
>      </EventData>
> 
>    </Event>
> 
>    ---------- Event Log Entries ------------
> 
> 
>    Log Name:      Application
> 
>    Source:        sshd
> 
>    Date:          14/09/2020 4:30:27 PM
> 
>    Event ID:      0
> 
>    Task Category: None
> 
>    Level:         Error
> 
>    Keywords:      Classic
> 
>    User:          SYSTEM
> 
>    Computer:      hostname
> 
>    Description:
> 
>    The description for Event ID 0 from source sshd cannot be found. Either
>    the component that raises this event is not installed on your local
>    computer or the installation is corrupted. You can install or repair
>    the component on the local computer.
> 
> 
>    If the event originated on another computer, the display information
>    had to be saved with the event.
> 
> 
>    The following information was included with the event:
> 
> 
>    sshd: PID 1622: error: ioctl(TIOCSCTTY): Operation not permitted
> 
> 
>    Event Xml:
> 
>    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
> 
>      <System>
> 
>        <Provider Name="sshd" />
> 
>        <EventID Qualifiers="0">0</EventID>
> 
>        <Level>2</Level>
> 
>        <Task>0</Task>
> 
>        <Keywords>0x80000000000000</Keywords>
> 
>        <TimeCreated SystemTime="2020-09-14T06:30:27.000000000Z" />
> 
>        <EventRecordID>2427843</EventRecordID>
> 
>        <Channel>Application</Channel>
> 
>        <Computer> hostname </Computer>
> 
>        <Security UserID="S-1-5-18" />
> 
>      </System>
> 
>      <EventData>
> 
>        <Data>sshd: PID 1622: error: ioctl(TIOCSCTTY): Operation not
>    permitted</Data>
> 
>      </EventData>
> 
>    </Event>
> 
> 
>    -------------- End of Entries ------------------
> 
> 
>    Regards,
> 
> 
>    Peter
> 
> 
>    Sent from [1]Mail for Windows 10

Hi Peter.

If you can reproduce the error with a standard cygwin install as
you claim, why muddy the waters by talking about your custom builds?
A problem in the standard install is of much more interest to the list
and would provide some focus that is missing from this report, which is
all over the place and has me confused about how anyone would go about 
helping you.

Is it possible that the message is coming from the Windows OpenSSH
server?  Finding errors in the Event Log instead of /var/log/cygsshd.log
suggests this to me.  Also, the fact that the service name is 'sshd'
instead of 'cygsshd'.  Maybe have a look at /var/log/cygsshd.log to see
if some other process grabbed port 22 preventing cygsshd from starting.

Also, you don't say what client you are using.  Are these errors in
response to an attempted client connection or do they happen at service
startup?  How about with different clients?

Stephen