From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 18912 invoked by alias); 12 Dec 2014 14:35:50 -0000 Mailing-List: contact cygwin-help@cygwin.com; run by ezmlm Precedence: bulk List-Id: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: cygwin-owner@cygwin.com Mail-Followup-To: cygwin@cygwin.com Received: (qmail 18901 invoked by uid 89); 12 Dec 2014 14:35:49 -0000 Authentication-Results: sourceware.org; auth=none X-Virus-Found: No X-Spam-SWARE-Status: No, score=-1.9 required=5.0 tests=AWL,BAYES_00,SPF_HELO_PASS,SPF_PASS,T_RP_MATCHES_RCVD autolearn=ham version=3.3.2 X-HELO: limerock04.mail.cornell.edu Received: from limerock04.mail.cornell.edu (HELO limerock04.mail.cornell.edu) (128.84.13.244) by sourceware.org (qpsmtpd/0.93/v0.84-503-g423c35a) with ESMTP; Fri, 12 Dec 2014 14:35:48 +0000 X-CornellRouted: This message has been Routed already. Received: from authusersmtp.mail.cornell.edu (granite3.serverfarm.cornell.edu [10.16.197.8]) by limerock04.mail.cornell.edu (8.14.4/8.14.4_cu) with ESMTP id sBCEZj0a007092 for ; Fri, 12 Dec 2014 09:35:46 -0500 Received: from [192.168.1.10] (cpe-67-249-176-138.twcny.res.rr.com [67.249.176.138]) (authenticated bits=0) by authusersmtp.mail.cornell.edu (8.14.4/8.12.10) with ESMTP id sBCEZiE4005080 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES128-SHA bits=128 verify=NOT) for ; Fri, 12 Dec 2014 09:35:45 -0500 Message-ID: <548AFD43.1040306@cornell.edu> Date: Fri, 12 Dec 2014 14:35:00 -0000 From: Ken Brown User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:31.0) Gecko/20100101 Thunderbird/31.3.0 MIME-Version: 1.0 To: cygwin@cygwin.com Subject: Re: TEST RELEASE: Cygwin 1.7.34-002 References: <20141206194943.GD3810@calimero.vinschen.de> In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit X-IsSubscribed: yes X-SW-Source: 2014-12/txt/msg00195.txt.bz2 On 12/12/2014 8:49 AM, Michael DePaulo wrote: > On Sat, Dec 6, 2014 at 2:49 PM, Corinna Vinschen > wrote: >> I finally released another TEST version of the next upcoming Cygwin >> release. The version number is 1.7.34-002. > > I *think* I am experiencing a very bad regression. > > These are the Windows permissions on my ~/.ssh/id_rsa file: > C:\cygwin\home\mike\.ssh>icacls id_rsa > id_rsa NT AUTHORITY\SYSTEM:(F) > DEPAULO\mike:(R,W,D,WDAC,WO) > > Under cygwin 1.7.33-2, I am able to use the file fine: > > mike@executor ~ > $ uname -a > CYGWIN_NT-6.3-WOW64 executor 1.7.33-2(0.280/5/3) 2014-11-13 15:45 i686 Cygwin > > mike@executor ~ > $ ssh galactica > Enter passphrase for key '/home/mike/.ssh/id_rsa': > Last login: Fri Dec 12 08:36:39 2014 from executor.depaulo.org > mike@galactica:~ :) [1] $ exit > logout > Connection to galactica closed. > > mike@executor ~ > $ cd .ssh > > mike@executor ~/.ssh > $ ls -latr id_rsa > -rw------- 1 mike mkpasswd 1743 Dec 7 2013 id_rsa > > > But under 1.7.34-002, I get a permissions error: > > mike@executor ~ > $ uname -a > CYGWIN_NT-6.3-WOW64 executor 1.7.34(0.282/5/3) 2014-12-06 18:03 i686 Cygwin > > mike@executor ~ > $ ssh galactica > @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ > @ WARNING: UNPROTECTED PRIVATE KEY FILE! @ > @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ > Permissions 0670 for '/home/mike/.ssh/id_rsa' are too open. > It is recommended that your private key files are NOT accessible by others. > This private key will be ignored. > key_load_private_type: bad permissions > mike@galactica's password: > > > mike@executor ~ > $ cd .ssh > > mike@executor ~/.ssh > $ ls -latr id_rsa > -rw-rwx---+ 1 mike Domain Users 1743 Dec 7 2013 id_rsa This isn't a regression. It's a deliberate change, so that Cygwin now takes ACLs into account when calculating permissions. The simplest fix is to use the new feature of setfacl to remove the unwanted permissions. From the release announcement: > - Add -b/--remove-all option to setfacl to reduce the ACL to only the > entries representing POSIX permission bits. Ken -- Problem reports: http://cygwin.com/problems.html FAQ: http://cygwin.com/faq/ Documentation: http://cygwin.com/docs.html Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple