Permissions question / issue

[Eliot Moss]

On 4/14/2023 3:43 PM, Eliot Moss via Cygwin wrote:
> On 4/14/2023 3:11 PM, Corinna Vinschen via Cygwin wrote:
>> On Apr 13 23:03, Eliot Moss via Cygwin wrote:
>>> Dear cygwin'ers -
>>>
>>> I seem to be caught in a bind with the Cygwin permissions setup.
>>>
>>> ssh insists that ~/.ssh/config have permissions no less permissive than rw------- (600).
>>
>> Huh?  No, it doesn't, usually.  My file has perms rw-r--r-- (644) and
>> that's perfectly fine.  Also, I tried the same setting as you did,
>> i. e.
>>
>> $ getfacl config
>> # file: config
>> # owner: corinna
>> # group: vinschen
>> user::rw-
>> group::---
>> group:SYSTEM:r-x
>> mask::r-x
>> other::---
>>
>> And ssh still works as desired and does not throw any error.
>>
>> You can also add g:SYSTEM:r-x to the directories and it should have
>> no negative side effect.  I just did that with ~/.ssh and ssh still
>> works as expected.
> 
> Of course you're entirely right, Corinna!  Not sure how I got it
> in my head that it needed 600 permissions.  Thank you for clarifying!
> 
> However ... ssh *does* demand that key files be accessible only by
> the user.  Is there a solution - if necessary using Windows tools -
> to make ssh happy while allowing a SYSTEM backup tool to back up
> the file?

More info:

At present I have:

$ getfacl id_rsa2
# file: id_rsa2
# owner: moss
# group: moss
user::rw-
group::---
group:SYSTEM:r--        #effective:---
mask::---
other::---

$ icacls id_rsa2
id_rsa2 NULL SID:(DENY)(Rc,DC)
         ELIOT-SURFACE-3\moss:(R,W,D,WDAC,WO)
         ELIOT-SURFACE-3\moss:(Rc,S,RA)
         NT AUTHORITY\SYSTEM:(R)
         Everyone:(Rc,S,RA)

I don't claim expert level understanding of the Windows access
scheme, but Windows Explorer believes that SYSTEM has read access
to the file, so I suppose this will work.  I guess we're kind of
lying to cygwin a little - but in a way that is useful here.

Best wishes - Eliot