michael's openssh for windows
Vince Hoffman
Vince.Hoffman@uk.circle.com
Wed Aug 13 11:29:00 GMT 2003
Sorry to say that chrooting ssh/sftp doesnt seem too small a task, I had a
look at http://chrootssh.sourceforge.net/docs/chrootedsftp.html
but wasnt too sure how relevent this was to cygwin and decided i would live
without it till i had time to play more.
I'd be interested if you get it going though. ;)
Vince
> -----Original Message-----
> From: Igor Pechtchanski [mailto:pechtcha@cs.nyu.edu]
> Sent: 13 August 2003 04:27
> To: Mark Priest
> Cc: jwaterbrook; cygwin@cygwin.com
> Subject: Re: michael's openssh for windows
>
>
> Mark,
>
> The chroot approach, if he could get it working (which I
> couldn't in the
> 20 or so minutes I've allocated for it) would prevent seeing
> directories
> outside of the selected root. Using scp (without chroot)
> will not prevent
> anyone from accessing a file in a known location (e.g.,
> /cygdrive/c/WINNT/system32/cmd.exe).
>
> I'm not sure there is a way to turn off the /cygdrive mode of
> drive access
> altogether. It might be useful to be able to do that (there's always
> mounts if drive access is really needed). This, however,
> doesn't concern
> me enough to work on implementing it just now. Others are
> welcome to try,
> of course.
> Igor
>
> On Tue, 12 Aug 2003, Mark Priest wrote:
>
> > Would it help if you used scp instead of sftp? The nature
> of sftp alows you
> > to browse directories while scp does not.
> >
> > -Mark
> >
> > ----- Original Message -----
> > From: "jwaterbrook" <jwaterbrook@keyww.com>
> > To: <cygwin@cygwin.com>
> > Sent: Tuesday, August 12, 2003 7:36 PM
> > Subject: Re: michael's openssh for windows
> >
> > > "Ssh passes no parameters to the login shell by default"
> > > This is exactly what was confusing me. Thank you for clarifying.
> > > I redirected $* to a file and logged in different ways,
> sftp gave me
> > > output as you said, so this part of it works now.
> > >
> > > I looked at chroot, but I can't seem to get it to take.
> > > Where/how can I include this in my sftponly script?
> > > I don't think DENY ACL's is an option in this
> distribuition. Any info
> > > on it would also be helpful
> > >
> > > Thanks,
> > > Johnny
> > >
> > >
> > > Igor Pechtchanski wrote:
> > >
> > > > Johnny,
> > > >
> > > > Ssh passes no parameters to the login shell by default
> (as your output
> > > > clearly shows). You have to check for the parameters
> passed by other
> > > > programs, like sftp (make sure you don't print things
> to stdout, as
> > > > they'll be interpreted as program messages -- better
> redirect the output
> > > > to some log file). FYI, I was able to restrict ssh
> access to sftp
> > > > only by
> > > > using the following script as the login shell:
> > > >
> > > > =================== CUT HERE ===================
> > > > #!/bin/sh
> > > > echo Parameters: "$@" >> /tmp/sshlogin.log
> > > > if [ "$*" != "-c /usr/sbin/sftp-server" ]; then
> > > > echo "Sorry, sftp only!"
> > > > exit 1
> > > > fi
> > > > exec /bin/bash "$@"
> > > > =================== CUT HERE ===================
> > > >
> > > > Checking /tmp/sshlogin.log after trying to use other
> programs with ssh
> > > > (e.g., cvs) should give you an idea of what exact
> parameters they pass,
> > > > and accomodate them in your script if need be.
> > > >
> > > > BTW, one important thing to know is that the above
> script *will not*
> > > > prevent anyone from accessing
> /cygdrive/c/WINNT/system32, for example.
> > > > If you want that kind of access restrictions, look at
> the "chroot"
> > > > utility
> > > > ("man chroot") or use DENY ACLs.
> > > > Igor
> > > >
> > > > On Tue, 12 Aug 2003, jwaterbrook wrote:
> > > >
> > > > > I decided to give that a shot, however, as I
> expected, that gave no
> > > > > output either.
> > > > > ---OUTPUT---
> > > > > Last login: Tue Aug 12 10:50:24 2003 from xxxx.yyyy.com
> > > > > Parameters:
> > > > > $
> > > > > ---END OUTPUT---
> > > > >
> > > > > Somehow, nothing is getting passed. Like I said
> before, it could be
> > > > the
> > > > > distribution. If anyone has any free time, download
> it and see what
> > > > I'm
> > > > > talking about.
> > > > > It's such a wonderful quick solution, It would be
> nice to get this
> > > > so it
> > > > > can act as a "substitute" for a normal ftp server
> (and even better for
> > > > > some cases only using a single port).
> > > > >
> > > > > Adieu,
> > > > > Johnny
> > > > >
> > > > > Igor Pechtchanski wrote:
> > > > >
> > > > > > You might try to change that script to
> > > > > >
> > > > > > #!/bin/sh
> > > > > > echo "Parameters: $@"
> > > > > > exec /bin/sh "$@"
> > > > > >
> > > > > > Hope this helps,
> > > > > > Igor
> > > > > > On Tue, 12 Aug 2003, jwaterbrook wrote:
> > > > > >
> > > > > > > A comment about the script method:
> > > > > > >
> > > > > > > for some reason, this didn't seem to return any result.
> > > > > > > I added /usr/bin/sftponly to the passwd file
> instead of /bin/sh or
> > > > > > > /bin/switch
> > > > > > > and created a /usr/bin/sftponly file with this inside:
> > > > > > > #!/bin/sh
> > > > > > >
> > > > > > > echo "$*"
> > > > > > >
> > > > > > > /bin/sh
> > > > > > >
> > > > > > > however, this did not create any output. So I
> have a feeling,
> > > > nothing
> > > > > > > is being passed in this build.
> > > > > > >
> > > > > > > I may be going at this the wrong way, so if
> anyone would like to
> > > > correct
> > > > > > > me, please do so.
> > > > > > >
> > > > > > > Thanks,
> > > > > > > Johnny
> > > > > > >
> > > > > > >
> > > > > > > Igor Pechtchanski wrote:
> > > > > > >
> > > > > > > > The thread starting at
> > > > > > > > <http://cygwin.com/ml/cygwin/2003-07/msg01379.html>
> > > > > > > > might be of help.
> > > > > > > > Igor
> > > > > > > >
> > > > > > > > On Mon, 11 Aug 2003, jwaterbrook wrote:
> > > > > > > >
> > > > > > > > > I haven't seemed to get very far with this,
> > > > > > > > > I was hoping someone might be able to point a
> blind man in
> > > > the right
> > > > > > > > > direction
> > > > > > > > >
> > > > > > > > > Waterbrook, Johnny wrote:
> > > > > > > > >
> > > > > > > > > > I'd prefer not to start a new thread, but I've been
> > > > searching for the
> > > > > > > > > > past few hours with no luck.
> > > > > > > > > >
> > > > > > > > > > I needed a fast way to set up sftp on a
> winXP box, so I
> > > > did a little
> > > > > > > > > > google search and found
> lexa.mckenna.edu/sshwindows/ had a
> > > > clean and
> > > > > > > > > > easy way of doing this.
> > > > > > > > > > I changed the regestry setting "/home" to a
> different
> > > > drive, and the
> > > > > > > > > > passwd file's entry form :/home/USERNAME:
> to :/home: so
> > > > when my "auts
> > > > > > > > > > ex-uncle" wants to login to my sftp server,
> they can't
> > > > browse my windows
> > > > > > > > > > directory structure.
> > > > > > > > > >
> > > > > > > > > > However, when my "aunts ex-uncle" realizes
> he can also ssh
> > > > into the box,
> > > > > > > > > > I don't want him running "windows" commands
> such as cmd,
> > > > nbtstat, dir
> > > > > > > > > > etc. I just want to "limit" him to what is
> available in
> > > > /bin I guess.
> > > > > > > > > >
> > > > > > > > > > Am I going about this wrong? Is there a
> cygwin/openssh
> > > > implemenation
> > > > > > > > > > that "stands alone" from windows so I could
> set up a sftp
> > > > server much
> > > > > > > > > > like a normal ftp server?
> > > > > > > > > >
> > > > > > > > > > Thanks in advance,
> > > > > > > > > > Johnny
>
> --
> http://cs.nyu.edu/~pechtcha/
> |\ _,,,---,,_ pechtcha@cs.nyu.edu
> ZZZzz /,`.-'`' -. ;-;;,_ igor@watson.ibm.com
> |,4- ) )-,_. ,\ ( `'-' Igor Pechtchanski, Ph.D.
> '---''(_/--' `-'\_) fL a.k.a JaguaR-R-R-r-r-r-.-.-. Meow!
>
> "I have since come to realize that being between your mentor
> and his route
> to the bathroom is a major career booster." -- Patrick Naughton
>
>
> --
> Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple
> Problem reports: http://cygwin.com/problems.html
> Documentation: http://cygwin.com/docs.html
> FAQ: http://cygwin.com/faq/
>
--
Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple
Problem reports: http://cygwin.com/problems.html
Documentation: http://cygwin.com/docs.html
FAQ: http://cygwin.com/faq/
More information about the Cygwin
mailing list