This is the mail archive of the
mailing list for the Cygwin project.
RE: Possible Security Hole in SSHD w/ CYGWIN?
- From: "David Willis" <david_willis at comcast dot net>
- To: <cygwin at cygwin dot com>
- Date: Tue, 16 Feb 2016 20:55:25 -0800
- Subject: RE: Possible Security Hole in SSHD w/ CYGWIN?
- Authentication-results: sourceware.org; auth=none
- References: <019c01d163bc$fe2fc500$fa8f4f00$ at comcast dot net> <CANnLRdhVrFcveO_jKb3_x=44WMJNO33DPnsJZ12Wus3U7Wo_fQ at mail dot gmail dot com> <019e01d163c2$d678c7e0$836a57a0$ at comcast dot net> <023901d165e4$925507d0$b6ff1770$ at comcast dot net> <87d1s1c8ld dot fsf at Rainer dot invalid> <CACoZoo3R4CDcgTMMex9QZ=Wh9a8CDvyUHpqj5+Br5xYFvGHvuQ at mail dot gmail dot com> <87a8n38t3r dot fsf at Rainer dot invalid> <CACoZoo3831x0PVOQ9j6zh+Q4EE4-LFNV7KQsgeyooPJmvM7qVA at mail dot gmail dot com> <20160215121101 dot GC7085 at calimero dot vinschen dot de>
- Reply-to: <cygwin at cygwin dot com>
First let me say that I'm not too well-versed in coding and the ins and outs
of how processes utilize credentials when they are spawned. However, the
jist of it seems to be that if there are no credentials saved with passwd -R
to replace the current user token with that of the user that is SSH'd in,
then there is no way to change that token at all (or get rid of it) meaning
the token used when accessing a share will stay as the token of the caller -
namely cyg_server? Please correct me if I'm way off-base but that seems to
be my interpretation of this.
If that is the case, it seems this is an unintended side effect of the way
CYGWIN and sshd work together, and with the current state of Windows there
isn't really a way around it. And that's OK (I can work around it if that's
the case), I just wanted to get to the bottom of why this was happening and
let people know the situation because I wasn't sure if anyone was aware of
Thank you very much Erik and everyone else for the help with this. This is
my first time posting on these mailing lists and I appreciate people taking
the time to reproduce the issue and help work it out.
From: email@example.com [mailto:firstname.lastname@example.org] On Behalf Of
Sent: Monday, February 15, 2016 4:11 AM
Subject: Re: Possible Security Hole in SSHD w/ CYGWIN?
On Feb 14 13:36, Erik Soderquist wrote:
> I think the key point is that if no network password is stored using
> the "passwd -R" option, then there should be absolutely no network
> access at all in the current code/design, not a fall through to the
> cyg_server account's network access, regardless of how much or little
> network access that account has.
The problem is this:
I'm not aware of any explicit OS call which allows the process calling
CreateProcessAsUser to drop network credentials of the *caller* in the child
process running under another user token.
In fact, I'm not even aware of any call which allows to drop network
credentials even for the calling process, and that would be the wrong thing
to do anyway.
This is a clear cut case of "I need help" and "Patches gratefully accepted".
Corinna Vinschen Please, send mails regarding Cygwin to
Cygwin Maintainer cygwin AT cygwin DOT com
Problem reports: http://cygwin.com/problems.html
Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple