From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 11397 invoked by alias); 26 May 2011 22:19:31 -0000 Received: (qmail 11386 invoked by uid 22791); 26 May 2011 22:19:30 -0000 X-SWARE-Spam-Status: No, hits=-0.6 required=5.0 tests=AWL,BAYES_00,RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_DNSWL_NONE X-Spam-Check-By: sourceware.org Received: from nm9-vm0.bullet.mail.ne1.yahoo.com (HELO nm9-vm0.bullet.mail.ne1.yahoo.com) (98.138.91.67) by sourceware.org (qpsmtpd/0.43rc1) with SMTP; Thu, 26 May 2011 22:19:14 +0000 Received: from [98.138.90.52] by nm9.bullet.mail.ne1.yahoo.com with NNFMP; 26 May 2011 22:19:13 -0000 Received: from [98.138.226.59] by tm5.bullet.mail.ne1.yahoo.com with NNFMP; 26 May 2011 22:19:13 -0000 Received: from [127.0.0.1] by smtp210.mail.ne1.yahoo.com with NNFMP; 26 May 2011 22:19:13 -0000 Received: from [192.168.1.231] (reply-to-list-only-lh@108.7.36.4 with plain) by smtp210.mail.ne1.yahoo.com with SMTP; 26 May 2011 15:19:10 -0700 PDT X-Yahoo-SMTP: Uu383n6swBCEN1G9up0WSnxbvN8fCPmk Message-ID: <4DDED1D5.3060404@cygwin.com> Date: Thu, 26 May 2011 22:19:00 -0000 From: "Larry Hall (Cygwin)" Reply-To: cygwin@cygwin.com User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.17) Gecko/20110414 Lightning/1.0b2 Mnenhy/0.8.3 Thunderbird/3.1.10 ThunderBrowse/3.3.5 MIME-Version: 1.0 To: cygwin@cygwin.com Subject: Re: Troubleshooting SSH connection as SYSTEM user. References: <4DDEBC7A.5050009@cygwin.com> In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Mailing-List: contact cygwin-help@cygwin.com; run by ezmlm Precedence: bulk List-Id: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: cygwin-owner@cygwin.com Mail-Followup-To: cygwin@cygwin.com X-SW-Source: 2011-05/txt/msg00416.txt.bz2 On 5/26/2011 5:46 PM, Matthew Leonhardt wrote: > On Thu, May 26, 2011 at 4:47 PM, Larry Hall (Cygwin) wrote: >> On 5/26/2011 11:10 AM, Matthew Leonhardt wrote: >>> >>> Hello all, >>> >>> I'm trying to install a service to keep some SSH tunnels alive using >>> the following script: >>> >>> $ cat ssh_tunnel.exe >>> #!/usr/bin/bash >>> while : >>> do >>> /cygdrive/c/WINDOWS/system32/netstat -an | grep 192\.168\.0\.1:139 \ >>> | grep LISTENING> /dev/null >>> if (( $? )); then >>> /usr/bin/ssh -v -v -v -x -i/home/user/.ssh/id_rsa -2 \ >>> -L 192.168.0.1:139:127.0.0.1:139 -N remote_user@remote.host 2>&1& >>> fi >>> /cygdrive/c/WINDOWS/system32/netstat -an | grep 192\.168\.0\.1:3306 \ >>> | grep LISTENING> /dev/null >>> if (( $? )); then >>> /usr/bin/ssh -v -v -v -x -i/home/user/.ssh/id_rsa -2 \ >>> -L 192.168.0.1:3306:127.0.0.1:3306 -N remote_user@remote.host 2>&1& >>> fi >>> sleep 300 >>> done >>> >>> The script works fine at the command line, but fails when running as a >>> service. My vain attempt to gather info (-v -v -v) only yields: >>> >>> Permission denied, please try again. >>> Permission denied, please try again. >>> Permission denied (publickey,gssapi-with-mic,password). >>> >>> in the service log (all three lines for each instance of an ssh command). >>> >>> SYSTEM should have access to id_rsa: >>> >>> $ getfacl id_rsa >>> # file: id_rsa >>> # owner: user >>> # group: Domain Users >>> user::rw- >>> group::--- >>> group:SYSTEM:r-- >>> mask:rwx >>> other:--- >>> >>> $ ls -l id_rsa >>> -rw-------+ 1 user Domain Users 1679 Dec 13 13:40 id_rsa >>> >>> But, id_rsa was generated as "user", not as "SYSTEM," so I'm wondering >>> if SYSTEM needs it's own private RSA key, and how one would go about >>> generating one, since I don't seem to be able to su to the SYSTEM >>> user. >> >> Correct. What you propose could be a work-around for your case. Check >> out the link below for how to create a SYSTEM-owned shell that you can >> then experiment with. >> >> > > Brilliant! That's exactly what I was looking for and it totally did > the trick. TY! You're welcome. > FWIW, I had to modify the shortcut to use full paths to the date and > sleep commands. Smart move. :-) -- Larry _____________________________________________________________________ A: Yes. > Q: Are you sure? >> A: Because it reverses the logical flow of conversation. >>> Q: Why is top posting annoying in email? -- Problem reports: http://cygwin.com/problems.html FAQ: http://cygwin.com/faq/ Documentation: http://cygwin.com/docs.html Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple