From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 96008 invoked by alias); 27 May 2017 04:58:34 -0000 Mailing-List: contact cygwin-help@cygwin.com; run by ezmlm Precedence: bulk List-Id: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: cygwin-owner@cygwin.com Mail-Followup-To: cygwin@cygwin.com Received: (qmail 95992 invoked by uid 89); 27 May 2017 04:58:32 -0000 Authentication-Results: sourceware.org; auth=none X-Virus-Found: No X-Spam-SWARE-Status: No, score=-1.4 required=5.0 tests=AWL,BAYES_00,KAM_LAZY_DOMAIN_SECURITY,RCVD_IN_DNSWL_LOW autolearn=no version=3.3.2 spammy=homes, SAM, comprehensive, userid X-HELO: smtp-out-no.shaw.ca Received: from smtp-out-no.shaw.ca (HELO smtp-out-no.shaw.ca) (64.59.134.9) by sourceware.org (qpsmtpd/0.93/v0.84-503-g423c35a) with ESMTP; Sat, 27 May 2017 04:58:30 +0000 Received: from [192.168.1.100] ([174.0.238.184]) by shaw.ca with SMTP id ETo7dvJWBM9gtETo8dOIkw; Fri, 26 May 2017 22:58:33 -0600 X-Authority-Analysis: v=2.2 cv=a+JAzQaF c=1 sm=1 tr=0 a=WqCeCkldcEjBO3QZneQsCg==:117 a=WqCeCkldcEjBO3QZneQsCg==:17 a=IkcTkHD0fZMA:10 a=IfeSEywh06YWHtK3V3UA:9 a=6qCkASFwxmhN0JbL:21 a=QEXdDO2ut3YA:10 Reply-To: Brian.Inglis@SystematicSw.ab.ca Subject: Re: Problems with ssh-host-config and /var/run directory References: <59272F87.9050300@faroul.de> <63db7c1b-bb96-c809-4a47-e727089d0c8a@SystematicSw.ab.ca> <59289C75.2020307@faroul.de> To: cygwin@cygwin.com From: Brian Inglis Message-ID: Date: Sat, 27 May 2017 08:17:00 -0000 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Thunderbird/52.1.1 MIME-Version: 1.0 In-Reply-To: <59289C75.2020307@faroul.de> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit X-CMAE-Envelope: MS4wfJmCcn9c88XX61k485IqEiKW4WWLE6udPpblTAFKQlHMZyFpiEXFNkWHtbmPdkkUW7DE2fofxAHVKHwEL0yMulT3K0XI+rcF72naUqVJ+9nATsw7mppq wdYEagF3J0RsVwGkbiaTEEHzWs1CxlVMC/EMnvYjMZqkrgnhEr+4lVNyb0epmRaPwMgH2u91Y+dWpg== X-IsSubscribed: yes X-SW-Source: 2017-05/txt/msg00445.txt.bz2 On 2017-05-26 15:21, Henning Peters wrote: > Am 25.05.17 23:36, schrieb Brian Inglis: >> On 2017-05-25 13:24, Henning Peters wrote: >>> I switched from 32bit to 64 bis a week ago, moved "cygwin" to "cygwin32" and >>> reinstalled from scratch into a new "cygwin" directory. >>> when trying to setup sshd using ssh-host-config, I get this message when >>> using StrictModes (which I want to and did before on cygwin32 on this system): >>> *** Warning: The owner and the Administrators need >>> *** Warning: to have .w. permission to /var/run. >>> *** Warning: Here are the current permissions and ACLS: >>> *** Warning: drwxrwxrwt+ 1 faroul root 0 May 19 20:56 /var/run >>> *** Warning: # file: /var/run >>> *** Warning: # owner: faroul >>> *** Warning: # group: root >>> *** Warning: # flags: --t >>> *** Warning: user::rwx >>> *** Warning: group::rwx >>> *** Warning: group:root:rwx >>> *** Warning: group:SYSTEM:rwx >>> *** Warning: mask:rwx >>> *** Warning: other:rwx >>> *** Warning: default:user::rwx >>> *** Warning: default:group::rwx >>> *** Warning: default:other:r-x >>> *** Warning: >>> *** Warning: Please change the user and/or group ownership, >>> *** Warning: permissions, or ACLs of /var/run. >>> *** ERROR: Problem with /var/run directory. Exiting. >>> I tried a lot, but cannot find any solution. >>> Any hints? >> It's telling you that the Administrators group is missing write access. >> Do you have a root id on your system or are you using passwd and group >> files? > passwd/group files. > root and admin entries: > root:S-1-5-32-544:0: > Administratoren:S-1-5-32-544:544: >> You could either change group ownership from root to Administrators: >> $ chgrp -cR Administrators /var/run >> and if your admin id is not faroul: >> $ chown -cR /var/run >> or, to add explicit Administrators group access, and default access to >> files created, explicit admin id ACL and DACL, and others read and search: >> $ setfacl -m g:Administrators:rwx,d:g:Administrators:rwx,\ >> u::rwx,d:g::rwx,o::r-x /var/run >> add Administrators and admin id to existing files: >> $ setfacl -m g:Administrators:rwx,u::rwx,\ >> o::r-x /var/run/* > Nothing helps... (German Windows, "Administratoren" is "Administrators") > *** Warning: The owner and the Administrators need > *** Warning: to have .w. permission to /var/run. > *** Warning: Here are the current permissions and ACLS: > *** Warning: drwxrwxrwt+ 1 Administratoren root 0 May 25 21:07 /var/run > *** Warning: # file: /var/run > *** Warning: # owner: Administratoren > *** Warning: # group: root > *** Warning: # flags: --t > *** Warning: user::rwx > *** Warning: user:Administratoren:rwx > *** Warning: group::rwx > *** Warning: group:SYSTEM:rwx > *** Warning: mask:rwx > *** Warning: other:rwx > *** Warning: default:user::rwx > *** Warning: default:user:Administratoren:rwx > *** Warning: default:group::rwx > *** Warning: default:mask:rwx > *** Warning: default:other:r-x > *** Warning: > *** Warning: Please change the user and/or group ownership, > *** Warning: permissions, or ACLs of /var/run. > *** ERROR: Problem with /var/run directory. Exiting. > /var> la > total 18 > drwxr-xr-x+ 1 faroul None 0 May 25 21:17 ./ > drwxr-xr-x+ 1 faroul None 0 May 19 20:15 ../ > drwxr-xr-x+ 1 faroul None 0 May 18 23:21 cache/ > drwxr-xr-x+ 1 cyg_server root 0 May 18 23:25 empty/ > drwxr-xr-x+ 1 faroul None 0 May 18 23:21 lib/ > drwxrwxrwt+ 1 faroul None 0 May 19 21:40 log/ > drwxrwxrwt+ 1 Administratoren root 0 May 25 21:07 run/ I would expect the group owner to be Administratoren not root and the user owner of run to be faroul or root: # ls -dl /var/{run,empty}/ drwxr-xr-x+ 1 cyg_server Administrators 0 Nov 19 2013 /var/empty/ drwxrwxrwt+ 1 userid Administrators 0 May 23 19:01 /var/run/ except on my system actually /var/run -> ../run, as on Linux, and don't have any problems - I have a bunch of Linux-compatible symlinks all over, including to Windows directories for homes and other non-Cygwin stuff, and other similar customizations to make working with Windows from Cygwin easier, with no problems. You might want to try: # chgrp Administratoren /var/{empty,run} # chown root /var/run or compare your old and current directories: # ls -dl {/proc/cygdrive/c/cygwin32,}/var/{empty,run} and reset security by reference to your old directories: # chown --reference {/proc/cygdrive/c/cygwin32,}/var/empty # chgrp --reference {/proc/cygdrive/c/cygwin32,}/var/empty # chmod --reference {/proc/cygdrive/c/cygwin32,}/var/empty # chown --reference {/proc/cygdrive/c/cygwin32,}/var/run # chgrp --reference {/proc/cygdrive/c/cygwin32,}/var/run # chmod --reference {/proc/cygdrive/c/cygwin32,}/var/run Ensure your /etc/passwd and /etc/group files are complete by adding required entries with: # mkpasswd >> /etc/passwd # mkgroup >> /etc/group and edit those files carefully to remove any duplicates, and add any missing fields to root. Try typing: # id root and see if root has all of the required group memberships like: # id SYSTEM uid=18(SYSTEM) gid=18(SYSTEM) groups=544(Administrators),18(SYSTEM) # id Administrators uid=544(Administrators) gid=544(Administrators) groups=11(Authenticated Users),544(Administrators) and add any missing group memberships to root in /etc/group. Also check /etc/nsswitch.conf to ensure either the defaults, or your settings, are appropriate, comprehensive, and necessary for your setup. Last thought is to try: # find /var/run/ | xargs setfacl -bk to remove ACLs and use only straight POSIX permissions, but you may want to save those first by running getfacl once for each directory and file: # find /var/run/ | xargs savefacl.sh where savefacl.sh loops thru all args, runs getfacl on each file and saves each output in a unique file in some other directory like /tmp. The current default in /etc/sshd_config for StrictModes is yes so we should all be running like this unless manually changed, and no other problems have been reported with this, although most probably use SAM instead of files now. -- Take care. Thanks, Brian Inglis, Calgary, Alberta, Canada -- Problem reports: http://cygwin.com/problems.html FAQ: http://cygwin.com/faq/ Documentation: http://cygwin.com/docs.html Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple