From: "Matt D." <codespunk@gmail.com>
To: cygwin@cygwin.com
Subject: Re: No way to use ssh ~/.ssh/config with "noacl" option
Date: Wed, 08 Nov 2017 23:07:00 -0000 [thread overview]
Message-ID: <5A038E3C.60908@codespunk.com> (raw)
In-Reply-To: <59FDFB25.8060409@gmail.com>
On 11/4/2017 1:38 PM, Matt D. wrote:
> On 11/4/2017 1:15 PM, Matt D. wrote:
> > On 11/4/2017 11:43 AM, Achim Gratz wrote:
> >> That's the correct thing to do, even though you made this unnecessarily
> >> hard for yourself by mounting your home directory with "noacl".
> >
> > It's not perfect but I've always had trouble with all of the
> > modifications Cygwin makes to a file's permissions to support
> > POSIX-style ACLs. I do miss being able to manage them with chmod and
> > setfacl though.
> >
> > For those wishing to set their ssh config to 600 (as recognized by
> > Cygwin's ssh), use the following:
> >
> > Reset file permissions:
> > icacls config /t /q /c /reset
> >
> > Inheritence must be disabled to alter other groups:
> > icacls config /inheritance:d
> >
> > Effectively regarded as "group":
> > icacls config /remove:g "Authenticated Users"
> > icacls config /remove:g "Users"
> >
> > Regarded as "other":
> > icacls config /remove:g "Everyone"
> >
> > Add the current user as the owner:
> > icacls config /grant "%USERNAME%:rw"
> >
> >
> > Matt D.
>
> My previous reply was missing "takeown" to take ownership. The correct
> sequence of commands is:
>
> icacls config /t /q /c /reset
> icacls config /inheritance:d
> takeown /f config
> icacls config /remove:g "Authenticated Users"
> icacls config /remove:g "Users"
> icacls config /remove:g "Everyone"
> icacls config /grant "%USERNAME%:rw"
>
> This is equivalent to "chmod 600 config".
>
>
> Matt D.
Here is a more portable version of taking ownership and setting
permissions to 600. It uses SIDs instead of literal names which may vary
between locale:
icacls "id_rsa" /t /q /c /reset
icacls "id_rsa" /inheritance:d
takeown /f "id_rsa"
icacls "id_rsa" /remove *S-1-5-11
icacls "id_rsa" /remove *S-1-5-32-545
icacls "id_rsa" /remove *S-1-1-0
icacls "id_rsa" /grant "%USERNAME%:rw"
S-1-5-11 (Authenticated Users group)
S-1-5-32-545 (Users group)
S-1-1-0 (Everyone group)
Matt D.
--
Problem reports: http://cygwin.com/problems.html
FAQ: http://cygwin.com/faq/
Documentation: http://cygwin.com/docs.html
Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple
prev parent reply other threads:[~2017-11-08 23:07 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-11-04 9:47 Matt D.
2017-11-04 11:37 ` Corinna Vinschen
2017-11-04 11:47 ` Matt D.
2017-11-04 13:31 ` Matt D.
2017-11-04 15:30 ` Matt D.
2017-11-04 15:43 ` Achim Gratz
2017-11-04 17:15 ` Matt D.
2017-11-04 18:25 ` Achim Gratz
2017-11-04 21:20 ` Brian Inglis
2017-11-04 16:37 ` Corinna Vinschen
2017-11-04 17:22 ` Matt D.
2017-11-04 17:38 ` Matt D.
2017-11-08 23:07 ` Matt D. [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=5A038E3C.60908@codespunk.com \
--to=codespunk@gmail.com \
--cc=cygwin@cygwin.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).