From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 102936 invoked by alias); 3 Jul 2019 08:41:36 -0000 Mailing-List: contact cygwin-help@cygwin.com; run by ezmlm Precedence: bulk List-Id: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: cygwin-owner@cygwin.com Mail-Followup-To: cygwin@cygwin.com Received: (qmail 102619 invoked by uid 89); 3 Jul 2019 08:41:36 -0000 Authentication-Results: sourceware.org; auth=none X-Spam-SWARE-Status: No, score=-2.1 required=5.0 tests=AWL,BAYES_00,HTML_MESSAGE,KAM_NUMSUBJECT,RCVD_IN_DNSWL_LOW,SPF_PASS autolearn=ham version=3.3.1 spammy=username, connection, Administrator, H*MI:lan X-HELO: mx08-002cda01.pphosted.com Received: from mx08-002cda01.pphosted.com (HELO mx08-002cda01.pphosted.com) (185.183.28.84) by sourceware.org (qpsmtpd/0.93/v0.84-503-g423c35a) with ESMTP; Wed, 03 Jul 2019 08:41:31 +0000 Received: from pps.filterd (m0135532.ppops.net [127.0.0.1]) by mx07-002cda01.pphosted.com (8.16.0.27/8.16.0.27) with SMTP id x638dhxD001556 for ; Wed, 3 Jul 2019 08:41:26 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=avl.com; h=from : to : subject : date : message-id : content-type : mime-version; s=19122018; bh=RHTtFLfQIReU+7o8TpeRtaiHMlsTSCUQOIq0JWjD6Dg=; b=U95lxOmai6m/cdXmpTTAoPaAAFa4jTFpXYmGvT9YrG0/ywzZPaM87fCjz/+ND9UJonmM c7pE3OeOOFjI3AvqbBI+DgOwPEe3xrdBMGt//ID1vl+hmszSAHUQ/n0ouNcZc3pvZPr6 VoRYYjscyqxyy8pQ/LRFJCnb0mDD8m1TR+IfGP0/S1S3VCrhTAPVyu1ZMH+dpsFEGSqG zaQtZ4RtXz6sKWvAEpi0cBtM8x2vMILhnQ1EEQ6cZ7nE/EVuH7p87S+xRj+GRrmNQu9J zblrn8z848Fl7LmOCju2lOGoWAYVELcbgQjSKSV417dL1fhVVEFAhXGi+vd5ygZI0XD0 7Q== Received: from atgrzso2833.avl01.avlcorp.lan ([192.102.17.76]) by mx07-002cda01.pphosted.com with ESMTP id 2tgk208r56-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Wed, 03 Jul 2019 08:41:26 +0000 Received: from pps.filterd (atgrzso2833.avl01.avlcorp.lan [127.0.0.1]) by atgrzso2833.avl01.avlcorp.lan (8.16.0.27/8.16.0.27) with SMTP id x638cWmq019630 for ; Wed, 3 Jul 2019 10:41:24 +0200 Received: from atgrzsw1692.avl01.avlcorp.lan ([10.13.100.86]) by atgrzso2833.avl01.avlcorp.lan with ESMTP id 2tdypksq65-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT) for ; Wed, 03 Jul 2019 10:41:24 +0200 Received: from ATGRZSW1694.avl01.avlcorp.lan (10.12.64.115) by ATGRZSW1692.avl01.avlcorp.lan (10.12.64.113) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Wed, 3 Jul 2019 10:41:23 +0200 Received: from ATGRZSW1694.avl01.avlcorp.lan ([172.18.42.158]) by ATGRZSW1694.avl01.avlcorp.lan ([172.18.42.158]) with mapi id 15.00.1473.004; Wed, 3 Jul 2019 10:41:23 +0200 From: "Bergbauer, Daniel AVL/DE via cygwin" Reply-To: "Bergbauer, Daniel AVL/DE" To: "cygwin@cygwin.com" Subject: Domain User restrictions - Windows server 2012 R2 Date: Wed, 03 Jul 2019 08:41:00 -0000 Message-ID: <9e8b10829e18453f9e3af064a0d67c7c@ATGRZSW1694.avl01.avlcorp.lan> x-exclaimer-md-config: f9e74532-fb7d-4806-8539-2b9574eafa9a MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable X-IsSubscribed: yes X-SW-Source: 2019-07/txt/msg00018.txt.bz2 Hi everyone, I know the user restriction topic with ssh was discussed a lot and there ar= e also a few solutions out there but really nothing is working for me (Domain Users)... In our company we are using cygwin on each of our machines to be able to ru= n our projects with GNU make (everyone uses Windows 10)! I also developed a tool, with which all employees are able to synchronize t= heir projects from their (slow) machines to our server (Windows Server 2012= R2), run the make on the (fast) server, and synch the output back. All that works with a cygwin ssh connection + rsync! Informations: * Cygwin (also ssh service) on the server is up and running on C:\too= ls\cygwin * Added Domain Users group to /etc/group of cygwin installation (mean= s everyone can login with their windows password!): Domain Users:S-1-5-21-1054012322-559123688-2072061207-513:1049089: (Domain Users has a whitespace in it) * Added every Domain User to passwd file. ( with mkpasswd -d -u u89x7= 7 ) After that the user is able to login with ssh to the server with his win= dows password (because of Domain Users of course) Looks like this: u89x77:*:1441234:1049123:U-OTP01\u89x77,S-1-5-21-1054012322-559123688-20= 72061207-398637:/home/u89x77:/bin/bash * Mapped following directories in fstab file: 1. C:/tools/cygwin / 2. C:/projects /home (because the home folder of every user is: C:\pro= jects\username) 3. C:/tools/cygwin/bin /usr/bin 4. C:/tools/cygwin/lib /usr/lib (I cannot remember why I mapped point = 3 & 4) * Created RSA keys for EVERY user on the user's machine and put it in= to his/her home folder on the server with ssh-copy-id ... (/home/u89x77/.ss= h =3D=3D C:\projects\u89x77\.ssh). Everyone is now able to connect to his folder on the server without givi= ng his/her windows password again (I had to do this because my tool to sync= h works with 'rsync') What I want now is, to restrict every user, who connects to the server via = ssh, to its home folder /home/'username' =3D=3D C:\projects\'username' For example: A user's username in our domain is u89x77. He's able to login = normally via ssh but is also able to cd for example into C:\Windows or wors= e into C:\projects\'other username'\'absolute secret project'. And that is not what I want. The user should be blocked to cd out of C:\pro= jects\u89x77 but of course needs to look inside his folder like cd C:\proje= cts\'u89x77\'u89x77 project'. [X] I tried a lot of things up to now and also made a lot of research. But unfo= rtuneatly nothing worked... 1) Changed sshd_config file in cygwin/etc to: # Subsystem sftp /usr/sbin/sftp-server Subsystem sftp internal-sftp ChrootDirectory /home Match user u89x77 ChrootDirectory /home/u89x77 X11Forwarding no AllowTcpForwarding no ForceCommand internal-sftp 2) Tried the same with Match group "Domain Users"... 3) Also changed the ID of cyg_server to *:0: in the passwd file. 4) Tried to change the owner of the different folders like C:\tools\cygwin = to Administrator or cyg_server (but only windows/ACL rights...probably trying this with chown?...) All that did not work. I am absolutely clueless right now, read so much in the last months and not= hing worked and now comes the time where it gets really important, because = there'll be a few security projects and so on... This is the first time for me sending a mail here I don't even know if it i= s the right way, but I did not see any other forum or whatever. Thank you very much in advance. I am happy about every idea you have! Best regards Daniel Bergbauer -- Problem reports: http://cygwin.com/problems.html FAQ: http://cygwin.com/faq/ Documentation: http://cygwin.com/docs.html Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple