From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 5423 invoked by alias); 26 May 2011 20:48:15 -0000 Received: (qmail 5394 invoked by uid 22791); 26 May 2011 20:48:13 -0000 X-SWARE-Spam-Status: No, hits=-1.3 required=5.0 tests=AWL,BAYES_00,RCVD_IN_DNSWL_NONE X-Spam-Check-By: sourceware.org Received: from nm22-vm0.bullet.mail.bf1.yahoo.com (HELO nm22-vm0.bullet.mail.bf1.yahoo.com) (98.139.212.126) by sourceware.org (qpsmtpd/0.43rc1) with SMTP; Thu, 26 May 2011 20:47:56 +0000 Received: from [98.139.212.148] by nm22.bullet.mail.bf1.yahoo.com with NNFMP; 26 May 2011 20:47:54 -0000 Received: from [98.139.213.11] by tm5.bullet.mail.bf1.yahoo.com with NNFMP; 26 May 2011 20:47:54 -0000 Received: from [127.0.0.1] by smtp111.mail.bf1.yahoo.com with NNFMP; 26 May 2011 20:47:54 -0000 Received: from [10.0.0.2] (reply-to-list-only-lh@108.7.36.4 with plain) by smtp111.mail.bf1.yahoo.com with SMTP; 26 May 2011 13:47:54 -0700 PDT X-Yahoo-SMTP: Uu383n6swBCEN1G9up0WSnxbvN8fCPmk Message-ID: <4DDEBC7A.5050009@cygwin.com> Date: Thu, 26 May 2011 20:48:00 -0000 From: "Larry Hall (Cygwin)" Reply-To: cygwin@cygwin.com User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.17) Gecko/20110414 Lightning/1.0b2 Mnenhy/0.8.3 Thunderbird/3.1.10 ThunderBrowse/3.3.5 MIME-Version: 1.0 To: cygwin@cygwin.com Subject: Re: Troubleshooting SSH connection as SYSTEM user. References: In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Mailing-List: contact cygwin-help@cygwin.com; run by ezmlm Precedence: bulk List-Id: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: cygwin-owner@cygwin.com Mail-Followup-To: cygwin@cygwin.com X-SW-Source: 2011-05/txt/msg00412.txt.bz2 On 5/26/2011 11:10 AM, Matthew Leonhardt wrote: > Hello all, > > I'm trying to install a service to keep some SSH tunnels alive using > the following script: > > $ cat ssh_tunnel.exe > #!/usr/bin/bash > while : > do > /cygdrive/c/WINDOWS/system32/netstat -an | grep 192\.168\.0\.1:139 \ > | grep LISTENING> /dev/null > if (( $? )); then > /usr/bin/ssh -v -v -v -x -i/home/user/.ssh/id_rsa -2 \ > -L 192.168.0.1:139:127.0.0.1:139 -N remote_user@remote.host 2>&1& > fi > /cygdrive/c/WINDOWS/system32/netstat -an | grep 192\.168\.0\.1:3306 \ > | grep LISTENING> /dev/null > if (( $? )); then > /usr/bin/ssh -v -v -v -x -i/home/user/.ssh/id_rsa -2 \ > -L 192.168.0.1:3306:127.0.0.1:3306 -N remote_user@remote.host 2>&1& > fi > sleep 300 > done > > The script works fine at the command line, but fails when running as a > service. My vain attempt to gather info (-v -v -v) only yields: > > Permission denied, please try again. > Permission denied, please try again. > Permission denied (publickey,gssapi-with-mic,password). > > in the service log (all three lines for each instance of an ssh command). > > SYSTEM should have access to id_rsa: > > $ getfacl id_rsa > # file: id_rsa > # owner: user > # group: Domain Users > user::rw- > group::--- > group:SYSTEM:r-- > mask:rwx > other:--- > > $ ls -l id_rsa > -rw-------+ 1 user Domain Users 1679 Dec 13 13:40 id_rsa > > But, id_rsa was generated as "user", not as "SYSTEM," so I'm wondering > if SYSTEM needs it's own private RSA key, and how one would go about > generating one, since I don't seem to be able to su to the SYSTEM > user. Correct. What you propose could be a work-around for your case. Check out the link below for how to create a SYSTEM-owned shell that you can then experiment with. -- Larry _____________________________________________________________________ A: Yes. > Q: Are you sure? >> A: Because it reverses the logical flow of conversation. >>> Q: Why is top posting annoying in email? -- Problem reports: http://cygwin.com/problems.html FAQ: http://cygwin.com/faq/ Documentation: http://cygwin.com/docs.html Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple