From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 107900 invoked by alias); 29 May 2017 20:30:33 -0000 Mailing-List: contact cygwin-help@cygwin.com; run by ezmlm Precedence: bulk List-Id: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: cygwin-owner@cygwin.com Mail-Followup-To: cygwin@cygwin.com Received: (qmail 107499 invoked by uid 89); 29 May 2017 20:30:23 -0000 Authentication-Results: sourceware.org; auth=none X-Virus-Found: No X-Spam-SWARE-Status: No, score=-1.6 required=5.0 tests=AWL,BAYES_00,PLING_QUERY,RCVD_IN_DNSWL_LOW,SPF_PASS autolearn=ham version=3.3.2 spammy=H*f:sk:b16023a, H*F:D*nl, userid, surprise X-HELO: lb3-smtp-cloud3.xs4all.net Received: from lb3-smtp-cloud3.xs4all.net (HELO lb3-smtp-cloud3.xs4all.net) (194.109.24.30) by sourceware.org (qpsmtpd/0.93/v0.84-503-g423c35a) with ESMTP; Mon, 29 May 2017 20:30:21 +0000 Received: from webmail.xs4all.nl ([IPv6:2001:888:0:22:194:109:20:212]) by smtp-cloud3.xs4all.net with ESMTP id SLWF1v00R4SpUcq01LWFtY; Mon, 29 May 2017 22:30:15 +0200 Received: from a83-162-234-136.adsl.xs4all.nl ([83.162.234.136]) by webmail.xs4all.nl with HTTP (HTTP/1.1 POST); Mon, 29 May 2017 22:30:15 +0200 MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII; format=flowed Content-Transfer-Encoding: 7bit Date: Tue, 30 May 2017 03:49:00 -0000 From: Houder To: cygwin@cygwin.com Subject: Re: openssh: privilege separation no longer supported on Cygwin? SURPRISE! In-Reply-To: <522816658.20170529225714@yandex.ru> References: <37b863f6-ce5c-ef13-569f-8044fe485075@gmail.com> <20e2702ca3837f5d54c558f8e786c717@xs4all.nl> <522816658.20170529225714@yandex.ru> Message-ID: X-Sender: houder@xs4all.nl User-Agent: XS4ALL Webmail X-IsSubscribed: yes X-SW-Source: 2017-05/txt/msg00488.txt.bz2 On 2017-05-29 21:57, Andrey Repin wrote: > Greetings, Houder! > >> - however, the userid of the grandchild of the sshd listener, is >> STILL >> cyg_server ... NOT sshd! > > Exactly. cyg_server is the user which does impersonation. > You've been told that when you've been setting up your host. http://www.citi.umich.edu/u/provos/ssh/privsep.html https://security.stackexchange.com/questions/115896/can-someone-explain-how-sshd-does-privilege-separation https://cygwin.com/ml/cygwin/2017-05/msg00468.html >> As if the "sshd" account is NEVER, NEVER used during the _whole_ >> process >> (that is, there is NO privilege separation, as far as I can tell). > > As far as it is documented. -- Problem reports: http://cygwin.com/problems.html FAQ: http://cygwin.com/faq/ Documentation: http://cygwin.com/docs.html Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple