This is the mail archive of the cygwin mailing list for the Cygwin project.


Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]
Other format: [Raw text]

Re: "/bin/bash: permission denied" on WinXP 2003 x64 solved (privilege problem)


On Aug 13 02:51, Brian Kasper wrote:
> I've been having a hard time getting sshd to accept logins on a Windows
> XP 2003 x64 box.  The problems ranged from the error mentioned in the
> subject line ("/bin/bash: permission denied" appearing during logins) to
> silent failures during password authentication, during which the ssh
> connection would simply be closed by the instance of Cygwin sshd running
> on my machine.
> 
> I was seeing errors in the system event log, but unfortunately I'm not
> very experienced with Windows security, so I wasn't understanding what I
> was seeing.

When you set up a server it makes a lot of sense trying to understand
Windows security.  Besides of books, I would suggest to have a look
into the MSDN library.  For instance, a description of the privileges
is given here: http://msdn2.microsoft.com/en-us/library/bb530716.aspx

> As it turns out, all my problems were caused by the fact that the
> sshd_server user being created by the ssh-host-config script was not
> being given all the required privileges.

This is weird.  The ssh-host-config script usually makes sure that
the sshd_server user got all required privileges.  See the script
at line 517ff.

> I'm not sure why, but I found
> an online description of the rights required by sshd_server and used the
> "editrights" utility to grant them.

You really wouldn't have needed an online description.  The script
contains all of them ;)

> In case the information helps anyone else, here is a list of the
> privileges that the sshd_server user appears to need:
> 
> SeIncreaseQuotaPrivilege
> SeTcbPrivilege
> SeAssignPrimaryTokenPrivilege
> SeCreateTokenPrivilege
> SeServiceLogonRight
> SeDenyInteractiveLogonRight
> SeDenyNetworkLogonRight
> SeDenyRemoteInteractiveLogonRight
> 
> To determine which privileges sshd_server has on your system, use this
> command:
> 
> editrights -u sshd_server -l
> 
> And here are the commands necessary to grant the above privileges to
> sshd_server:
> [...]

As I said, see /bin/ssh-host-config, lines 517ff.  The Deny-"rights" are
obviously not necessary.  They are just used to secure the account
against malusage.


Corinna

-- 
Corinna Vinschen                  Please, send mails regarding Cygwin to
Cygwin Project Co-Leader          cygwin AT cygwin DOT com
Red Hat

--
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple
Problem reports:       http://cygwin.com/problems.html
Documentation:         http://cygwin.com/docs.html
FAQ:                   http://cygwin.com/faq/


Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]