From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 41484 invoked by alias); 3 Jul 2019 17:01:54 -0000 Mailing-List: contact cygwin-help@cygwin.com; run by ezmlm Precedence: bulk List-Id: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: cygwin-owner@cygwin.com Mail-Followup-To: cygwin@cygwin.com Received: (qmail 41449 invoked by uid 89); 3 Jul 2019 17:01:52 -0000 Authentication-Results: sourceware.org; auth=none X-Spam-SWARE-Status: No, score=-2.5 required=5.0 tests=AWL,BAYES_00,FREEMAIL_FROM,KAM_NUMSUBJECT,RCVD_IN_DNSWL_LOW,SPF_PASS autolearn=ham version=3.3.1 spammy=AVL, HX-Gm-Message-State:APjAAAV X-HELO: mout.gmx.com Received: from mout.gmx.com (HELO mout.gmx.com) (74.208.4.200) by sourceware.org (qpsmtpd/0.93/v0.84-503-g423c35a) with ESMTP; Wed, 03 Jul 2019 17:01:51 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=mail.com; s=dbd5af2cbaf7; t=1562173308; bh=kgmSZxVMZYW3peNKOSkJw4kgJ6/zA587RGmRoS1kY/w=; h=X-UI-Sender-Class:References:In-Reply-To:From:Date:Subject:To; b=volq7FjKVC34zBnEvQURoIq3uwOf+8VKq8D56IjJTCv3DnmXGTY+E1gar50rBv1xf frv0AZmI441xualDCdi5cD7afMJa7Y3aJO412zs0wDT9ommsTsNGtiFPDjLZnoNIkk CMB1savcJnixE2O+myjoN0Tyy6ns/C+FTwJEwOL0= X-UI-Sender-Class: 214d933f-fd2f-45c7-a636-f5d79ae31a79 Received: from mail-lj1-f176.google.com ([209.85.208.176]) by mail.gmx.com (mrgmxus002 [74.208.5.15]) with ESMTPSA (Nemesis) id 0LtIq5-1igky03Phr-012rfO for ; Wed, 03 Jul 2019 19:01:48 +0200 Received: by mail-lj1-f176.google.com with SMTP id 131so3248130ljf.4 for ; Wed, 03 Jul 2019 10:01:46 -0700 (PDT) MIME-Version: 1.0 References: <9e8b10829e18453f9e3af064a0d67c7c@ATGRZSW1694.avl01.avlcorp.lan> In-Reply-To: <9e8b10829e18453f9e3af064a0d67c7c@ATGRZSW1694.avl01.avlcorp.lan> From: Bill Stewart Date: Wed, 03 Jul 2019 17:01:00 -0000 Message-ID: Subject: Re: Domain User restrictions - Windows server 2012 R2 To: cygwin@cygwin.com Content-Type: text/plain; charset="UTF-8" X-IsSubscribed: yes X-SW-Source: 2019-07/txt/msg00020.txt.bz2 On Wed, Jul 3, 2019 at 2:41 AM Bergbauer, Daniel AVL/DE vwrote: > What I want now is, to restrict every user, who connects to the server via ssh, to its home folder /home/'username' == C:\projects\'username' If I understand, you are asking if you can restrict the user that connects to a specific subdirectory structure? If that's what you are asking, this is possible on POSIX because of chroot. However chroot is only emulated on Cygwin and is not a true security control, so this doesn't work on Windows, unfortunately. The good thing is that Windows permissions still apply, so for example if the user is only a member of Users, they can do "cd \windows", but they can't change any files in there. The ChrootDirectory can be used for sftp-only accounts, however, if configured correctly. If you're interested, I created a Windows Cygwin OpenSSH package that might be useful: https://github.com/Bill-Stewart/Cygwin-OpenSSH Bill -- Problem reports: http://cygwin.com/problems.html FAQ: http://cygwin.com/faq/ Documentation: http://cygwin.com/docs.html Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple