This is the mail archive of the cygwin mailing list for the Cygwin project.


Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]
Other format: [Raw text]

Re: ssh login no longer allowed by local accounts other than main administrator account after taking machine off domain


On 8/2/2013 3:13 PM, Yuki Ishibashi wrote:
Hi all,

Recently I've been tasked with taking a Win7 machine that was running
Cygwin and sshd off of my company's old Active Directory domain...

Before taking the machine off the domain I created local accounts that
were able to be ssh'd into (our other servers were able to SSH into
the Win7 machine using ssh keys and the newly created local accounts),
but once I took the machine off the domain only the newly created
'OpsAdmin' local administrator account is allowed to SSH in
successfully .

For the rest of the local accounts connection is accepted, and
password security is accepted, Authentication succeeded, ssh sends
'Last login', then says:
/bin/bash: Operation not permitted
and closes the connection .

'bash' will report this when it runs into a permission problem while
running a script.  What this suggests to me is that your .bash_profile
and/or other login scripts aren't owned by the "new" owners that you
created as local accounts.

<snip>

I've tried to re-run ssh-host-config and said 'yes' to all of the
options (yes to priviledge separation), it mentions the sshd service
is already installed, and completely successfully. "net start sshd"
then works correctly, with the behavior I described above.

In the Windows Services side, CYGWIN sshd service seems to only start
correctly if I login as the main local administrator account.

This is certainly troubling.  Presumably you were always starting 'sshd'
previously with a 'cyg-server' account that was created on the domain.
Starting it as a local administrator would not give you all the permissions
you need to switch user contexts for pubkey authentication, even if you
were only working with local users (which you have clearly stated you
were not).  I'd highly recommend that you review the permissions and
ownership settings that 'ssh-host-config' performs and make sure that
all the files and directories it sets up have only those permissions
and owners.  Anything else puts you in the "you better know what you're
doing" category.

many of the files in the C:\cygwin\ folder on the Windows Explorer
side of things have Everyone Read & execute permissions (plus main
administrator account)  full permissions, and the 'None' group able to
read and execute, Administrators group able to Read write & execute.
On the / Cygwin console-side, I see a lot of ownership by the previous
admin username and Domain Users group, some files with
'Administrators' owner, 'Domain Users' Group, and a few others with
the local administrator owner, 'Administrators' group.

OK, so it sounds like you haven't changed the permissions and ownership
of at least the home directories that you're trying to access now with
the local accounts.  You need to do that otherwise 'bash' won't be able
to run the login scripts and, um,... permission will be denied. ;-)

<snip>

A couple of other notes:

  1. You're running Cygwin package version 1.7.16.  The current version
     is 1.7.22, so you're 6 versions out of date.

  2. Your cygcheck output suggests that the standalone OpenSSH package,
     which uses Cygwin, is installed.  It's best to remove it.

--
Larry

_____________________________________________________________________

A: Yes.
> Q: Are you sure?
>> A: Because it reverses the logical flow of conversation.
>>> Q: Why is top posting annoying in email?

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple


Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]