Web lists-archives.com

Re: openssh: privilege separation no longer supported on Cygwin?




On 2017-05-29 10:39, Marco Atzeri wrote:
On 29/05/2017 07:23, Houder wrote:

[snip]
... because, that is, I think, what I am seeing:

 - the userid of child sshd is still 'cyg_server' ...
 - and I get an elevated shell when I login ...

Not what I expected ...

Gr. Henri


Hi Houder,
please read the last Announcement

https://sourceware.org/ml/cygwin-announce/2017-03/msg00028.html

[snip]
It seems you misunderstood the communication:
- the possibility to NOT use "privilege separation" is deprecated
- "privilege separation" will became mandatory

Hi Marco,

Sorry for the misunderstanding. Yes, to my knowledge, PS, privilege
separation, is now mandatory (using a new mechanism under Linux [1]).

[1] sandboxing?

Because of PS, I expect to see an UNprivileged sshd process talking
to the user process (where the ssh command has been executed).

But above all, I expect an UNelevated shell when I login in ...

However, what I get after login (after providing my credentials) is
an ELEVATED shell (yes, Administrators is part of the group set).

Now I wonder if this happens because I do NOT observe PS.

Look below, please ... After executing the ssh command, ssh asks for
my credentials ... in stead of providing my credentials, I execute
the ps command in a second terminal. To my surprise, the grandchild
of the listener is executed using "cyg_server" and not "sshd" ...

Currently, I am looking at:

    https://cygwin.com/cygwin-ug-net/ntsec.html#ntsec-setuid-overview

Regards,
Henri

-----
 - pre-authentication:

Shell 1:
64-@@ ssh -p 222 -l Henri 192.168.178.15
Enter passphrase for key '/home/Henri/.ssh/id_rsa': <==== passphrase not yet entered

Shell 2: (observer)
64-@@# ps -af
     UID     PID    PPID  TTY        STIME COMMAND
   Henri    2308    4356 pty0     11:01:41 /usr/bin/ssh
   Henri    5092     176 pty1     11:01:58 /usr/bin/ps
   Henri    4356    3744 pty0     10:57:56 /usr/bin/bash
   Henri    3744       1 ?        10:57:50 /usr/bin/mintty-273
   Henri     176    4604 pty1     10:58:21 /usr/bin/bash
cyg_serv 4992 2476 ? 11:01:03 /usr/sbin/sshd privileged listener
cyg_serv    2476       1 ?        11:01:03 /usr/bin/cygrunsrv
   Henri    4604       1 ?        10:58:21 /usr/bin/mintty-273
cyg_serv 1496 3032 ? 11:01:42 /usr/sbin/sshd should be using sshd as userid cyg_serv 3032 4992 ? 11:01:42 /usr/sbin/sshd privileged monitor (child of listener)

 - post-authentication:

Shell 1:
64-@@ ssh -p 222 -l Henri 192.168.178.15
Enter passphrase for key '/home/Henri/.ssh/id_rsa': <==== passphrase has been entered
Last login: Mon May 29 10:07:00 2017 from 192.168.178.15
64-@@#  <===== ///// PROBLEM: this shell is ELEVATED /////

Shell 2: (observer)
64-@@# ps -af
     UID     PID    PPID  TTY        STIME COMMAND
Henri 2496 3032 pty3 11:02:31 /usr/bin/bash remote shell (but it is an elevated shell! ?????)
   Henri    2308    4356 pty0     11:01:41 /usr/bin/ssh
   Henri    4356    3744 pty0     10:57:56 /usr/bin/bash
   Henri    3744       1 ?        10:57:50 /usr/bin/mintty-273
   Henri     176    4604 pty1     10:58:21 /usr/bin/bash
cyg_serv 4992 2476 ? 11:01:03 /usr/sbin/sshd privileged listener
   Henri    4996     176 pty1     11:06:05 /usr/bin/ps
cyg_serv    2476       1 ?        11:01:03 /usr/bin/cygrunsrv
   Henri    4604       1 ?        10:58:21 /usr/bin/mintty-273
cyg_serv 3032 4992 ? 11:01:42 /usr/sbin/sshd privileged monitor (child of listener)

=====

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple