From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 23968 invoked by alias); 24 Jan 2019 16:49:05 -0000 Mailing-List: contact cygwin-help@cygwin.com; run by ezmlm Precedence: bulk List-Id: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: cygwin-owner@cygwin.com Mail-Followup-To: cygwin@cygwin.com Received: (qmail 23799 invoked by uid 89); 24 Jan 2019 16:49:00 -0000 Authentication-Results: sourceware.org; auth=none X-Spam-SWARE-Status: No, score=-2.6 required=5.0 tests=BAYES_00,FREEMAIL_FROM,HTML_MESSAGE,RCVD_IN_DNSWL_LOW,SPF_PASS autolearn=ham version=3.3.2 spammy=downloaded, H*c:alternative, download X-HELO: mout.gmx.com Received: from mout.gmx.com (HELO mout.gmx.com) (74.208.4.201) by sourceware.org (qpsmtpd/0.93/v0.84-503-g423c35a) with ESMTP; Thu, 24 Jan 2019 16:48:57 +0000 X-UI-Sender-Class: 214d933f-fd2f-45c7-a636-f5d79ae31a79 Received: from mail-lf1-f49.google.com ([209.85.167.49]) by mail.gmx.com (mrgmxus002 [74.208.5.15]) with ESMTPSA (Nemesis) id 0LaWy1-1hThdg43aB-00mJCp for ; Thu, 24 Jan 2019 17:48:32 +0100 Received: by mail-lf1-f49.google.com with SMTP id p6so4843679lfc.1 for ; Thu, 24 Jan 2019 08:48:31 -0800 (PST) MIME-Version: 1.0 References: <20190124154533.GK2802@calimero.vinschen.de> In-Reply-To: <20190124154533.GK2802@calimero.vinschen.de> From: Bill Stewart Date: Thu, 24 Jan 2019 16:49:00 -0000 Message-ID: Subject: Re: sshd permits logon using disabled user? To: cygwin@cygwin.com Content-Type: text/plain; charset="UTF-8" X-SW-Source: 2019-01/txt/msg00206.txt.bz2 Hello Corinna, I performed the following steps: 1. Downloaded cygwin-20190124.tar.xz 2. Extracted it 3. Stopped sshd 4. Renamed existing /bin/cygwin1.dll to cygwin1-20181108.dll 5. Copied cygwin1.dll from download to /bin 6. Started sshd Did I miss anything? It still allows logon with disabled account. Thanks, Bill On Thu, Jan 24, 2019 at 8:45 AM Corinna Vinschen wrote: > On Jan 24 06:28, Bill Stewart wrote: > > I am running Windows 10 (1803) and experimenting with sshd installed as a > > Windows service. > > > > The computer is a domain member. I created a local computer account for > > testing. > > > > I created host keys and a public/private key pair to use to log on the > user. > > > > This works, except I notice that if I disable the Windows user account, I > > can still log on using ssh using that account. > > > > In the shell, logged on as the disabled user, the 'whoami' command > returns > > the name of the disabled user. > > > > This seems unexpected and not good. > > > > Why does sshd allow logon for a disabled user? > > Because the underlying Cygwin function responsible for changing the user > account only checks if the account exists. It does not check for any of > the flags in the user DB. Yet. > > I pushed a patch to disallow changing the user account to a disabled or > locked out account. > > I just uploaded new developer snapshots containing this change to > https://cygwin.com/snapshots/ > > Please give them a try. > > > Thanks, > Corinna > > -- > Corinna Vinschen > Cygwin Maintainer > -- Problem reports: http://cygwin.com/problems.html FAQ: http://cygwin.com/faq/ Documentation: http://cygwin.com/docs.html Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple