From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 103157 invoked by alias); 8 Nov 2017 23:07:30 -0000 Mailing-List: contact cygwin-help@cygwin.com; run by ezmlm Precedence: bulk List-Id: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: cygwin-owner@cygwin.com Mail-Followup-To: cygwin@cygwin.com Received: (qmail 103146 invoked by uid 89); 8 Nov 2017 23:07:29 -0000 Authentication-Results: sourceware.org; auth=none X-Virus-Found: No X-Spam-SWARE-Status: No, score=-1.8 required=5.0 tests=AWL,BAYES_00,FREEMAIL_FROM,RCVD_IN_DNSWL_NONE,SPF_PASS autolearn=ham version=3.3.2 spammy=regarded, Everyone, unnecessarily, username X-HELO: mail-pg0-f42.google.com Received: from mail-pg0-f42.google.com (HELO mail-pg0-f42.google.com) (74.125.83.42) by sourceware.org (qpsmtpd/0.93/v0.84-503-g423c35a) with ESMTP; Wed, 08 Nov 2017 23:07:28 +0000 Received: by mail-pg0-f42.google.com with SMTP id a192so3115785pge.9 for ; Wed, 08 Nov 2017 15:07:28 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:subject:to:references:message-id:date :user-agent:mime-version:in-reply-to:content-transfer-encoding; bh=8wlowk8nbMmHOjvn+VUnYSFO/lsiZCix0tkZ+bMvf0Y=; b=BD1gPGjlooNTDl4iLaZVUHG252YXq/paAJ704w14WHyxZNiHGb2ZoBt1ogErdHa7Y8 gNu3cGwRnd3goeAoCI8DC7eX7lGD2rfxSl08OMVFF1bbUusoHgsVNobsujAaOHKKAG00 EO0UWnh24Zihw7oStM/Nak9rHqCqeOug5piYFiq+OuyKz8Uu0e8QoQHlP877V5lPz5S3 z+Z5k6OuNwSw9jb5FPj69/3LicBk4M37MCdWcS+1NTOEWPtDb4d0AjTM7mLvoPx0oplm UjEOrMRU1z80ylUbCdie4bHgvdFvWg3koOSNhwBxPQI8g+3rHgvoXS7zvAZz12S03IDA DSzA== X-Gm-Message-State: AJaThX42c6276L9rNA819Tv6+4R4+xjR/MYXnXzrJhIhB1Kf/P/q+XFr 7KRKDnHSludeyp70bYI4c2Rb+t8r X-Google-Smtp-Source: ABhQp+SszC8HzofU26rrz3NnVapy8p99wuF9p0PyojpJF6zJuDmwPWhA4Sss3XF7YY3fY0oMWXrw+A== X-Received: by 10.98.71.194 with SMTP id p63mr2103525pfi.26.1510182446796; Wed, 08 Nov 2017 15:07:26 -0800 (PST) Received: from [10.0.1.111] (ip68-230-148-254.ri.ri.cox.net. [68.230.148.254]) by smtp.gmail.com with ESMTPSA id t84sm10824996pfa.91.2017.11.08.15.07.25 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 08 Nov 2017 15:07:26 -0800 (PST) From: "Matt D." X-Google-Original-From: "Matt D." Subject: Re: No way to use ssh ~/.ssh/config with "noacl" option To: cygwin@cygwin.com References: <59FD8C99.8010703@gmail.com> <20171104113723.GC18070@calimero.vinschen.de> <59FDA8D9.6050808@gmail.com> <59FDC12F.1080005@codespunk.com> <59FDDCFA.9030306@codespunk.com> <20171104163701.GA23538@calimero.vinschen.de> <59FDF754.4040505@gmail.com> <59FDFB25.8060409@gmail.com> Message-ID: <5A038E3C.60908@codespunk.com> Date: Wed, 08 Nov 2017 23:07:00 -0000 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:38.0) Gecko/20100101 Thunderbird/38.3.0 MIME-Version: 1.0 In-Reply-To: <59FDFB25.8060409@gmail.com> Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit X-SW-Source: 2017-11/txt/msg00163.txt.bz2 On 11/4/2017 1:38 PM, Matt D. wrote: > On 11/4/2017 1:15 PM, Matt D. wrote: > > On 11/4/2017 11:43 AM, Achim Gratz wrote: > >> That's the correct thing to do, even though you made this unnecessarily > >> hard for yourself by mounting your home directory with "noacl". > > > > It's not perfect but I've always had trouble with all of the > > modifications Cygwin makes to a file's permissions to support > > POSIX-style ACLs. I do miss being able to manage them with chmod and > > setfacl though. > > > > For those wishing to set their ssh config to 600 (as recognized by > > Cygwin's ssh), use the following: > > > > Reset file permissions: > > icacls config /t /q /c /reset > > > > Inheritence must be disabled to alter other groups: > > icacls config /inheritance:d > > > > Effectively regarded as "group": > > icacls config /remove:g "Authenticated Users" > > icacls config /remove:g "Users" > > > > Regarded as "other": > > icacls config /remove:g "Everyone" > > > > Add the current user as the owner: > > icacls config /grant "%USERNAME%:rw" > > > > > > Matt D. > > My previous reply was missing "takeown" to take ownership. The correct > sequence of commands is: > > icacls config /t /q /c /reset > icacls config /inheritance:d > takeown /f config > icacls config /remove:g "Authenticated Users" > icacls config /remove:g "Users" > icacls config /remove:g "Everyone" > icacls config /grant "%USERNAME%:rw" > > This is equivalent to "chmod 600 config". > > > Matt D. Here is a more portable version of taking ownership and setting permissions to 600. It uses SIDs instead of literal names which may vary between locale: icacls "id_rsa" /t /q /c /reset icacls "id_rsa" /inheritance:d takeown /f "id_rsa" icacls "id_rsa" /remove *S-1-5-11 icacls "id_rsa" /remove *S-1-5-32-545 icacls "id_rsa" /remove *S-1-1-0 icacls "id_rsa" /grant "%USERNAME%:rw" S-1-5-11 (Authenticated Users group) S-1-5-32-545 (Users group) S-1-1-0 (Everyone group) Matt D. -- Problem reports: http://cygwin.com/problems.html FAQ: http://cygwin.com/faq/ Documentation: http://cygwin.com/docs.html Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple