Re: Fwd: Way to test cyglsa?

[Evan Rowley <rowley dot evan at gmail dot com>]

The user cyg_server was generated by the ssh-host-config script and
while the server itself is on a domain, all the users involved with
cygwin / ssh / sshd are local users.

I've noticed that along with the local cyg_server account, there is
also a local sshd account. It appears to be disabled. Is that normal?

What can I do to be sure that seteuid can be called by cyg_server? The
user is in the Administrators group and to my knowledge, that should
be a qualifier to run seteuid.

I went ahead and reconfigured /etc/passwd, the sshd service via
ssh-host-config, and the LSA passwords for the users. I'm still
experiencing the same problem but now with a new and odd variation.
Attempting to connect via ssh yeilds the same result as before but
additionally causes the sshd service to stop. No errros are being
reported in the event logs and the /var/log/sshd.log file looks the
same as before. Output is below:

debug1: sshd version OpenSSH_6.2, OpenSSL 1.0.1e 11 Feb 2013
debug1: read PEM private key done: type RSA
debug1: private host key: #0 type 1 RSA
debug1: read PEM private key done: type DSA
debug1: private host key: #1 type 2 DSA
debug1: read PEM private key done: type ECDSA
debug1: private host key: #2 type 3 ECDSA
/var/empty must be owned by root and not group or world-writable.
debug1: sshd version OpenSSH_6.2, OpenSSL 1.0.1e 11 Feb 2013
debug1: read PEM private key done: type RSA
debug1: private host key: #0 type 1 RSA
debug1: read PEM private key done: type DSA
debug1: private host key: #1 type 2 DSA
debug1: read PEM private key done: type ECDSA
debug1: private host key: #2 type 3 ECDSA
debug1: rexec_argv[0]='/usr/sbin/sshd'
debug1: rexec_argv[1]='-D'
debug1: rexec_argv[2]='-d'
debug1: Bind to port 22 on 0.0.0.0.
Server listening on 0.0.0.0 port 22.
debug1: fd 4 clearing O_NONBLOCK
debug1: Server will not fork when running in debugging mode.
debug1: rexec start in 4 out 4 newsock 4 pipe -1 sock 7
debug1: inetd sockets after dupping: 3, 3
Connection from 127.0.0.1 port 3966
debug1: Client protocol version 2.0; client software version OpenSSH_6.2
debug1: match: OpenSSH_6.2 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.2
debug1: list_hostkey_types: ssh-rsa,ssh-dss,ecdsa-sha2-nistp256 [preauth]
debug1: SSH2_MSG_KEXINIT sent [preauth]
debug1: SSH2_MSG_KEXINIT received [preauth]
debug1: kex: client->server aes128-ctr XXXXXXXXXXXXXX none [preauth]
debug1: kex: server->client aes128-ctr XXXXXXXXXXXXXX none [preauth]
debug1: expecting SSH2_MSG_KEX_ECDH_INIT [preauth]
debug1: SSH2_MSG_NEWKEYS sent [preauth]
debug1: expecting SSH2_MSG_NEWKEYS [preauth]
debug1: SSH2_MSG_NEWKEYS received [preauth]
debug1: KEX done [preauth]
debug1: userauth-request for user sftp_user service ssh-connection
method none [preauth]
debug1: attempt 0 failures 0 [preauth]
Address 127.0.0.1 maps to XXXXXXXXXXXXXX, but this does not map back
to the address - POSSIBLE BREAK-IN ATTEMPT!
debug1: userauth-request for user sftp_user service ssh-connection
method publickey [preauth]
debug1: attempt 1 failures 0 [preauth]
debug1: test whether pkalg/pkblob are acceptable [preauth]
debug1: temporarily_use_uid: 1019/513 (e=1006/513)
seteuid 1019: Operation not permitted
debug1: do_cleanup
debug1: Killing privsep child 1344
debug1: sshd version OpenSSH_6.2, OpenSSL 1.0.1e 11 Feb 2013
debug1: read PEM private key done: type RSA
debug1: private host key: #0 type 1 RSA
debug1: read PEM private key done: type DSA
debug1: private host key: #1 type 2 DSA
debug1: read PEM private key done: type ECDSA
debug1: private host key: #2 type 3 ECDSA
debug1: rexec_argv[0]='/usr/sbin/sshd'
debug1: rexec_argv[1]='-D'
debug1: rexec_argv[2]='-d'
debug1: Bind to port 22 on 0.0.0.0.
Server listening on 0.0.0.0 port 22.
debug1: fd 4 clearing O_NONBLOCK
debug1: Server will not fork when running in debugging mode.
debug1: rexec start in 4 out 4 newsock 4 pipe -1 sock 7
debug1: inetd sockets after dupping: 3, 3
Connection from 127.0.0.1 port 4030
debug1: Client protocol version 2.0; client software version OpenSSH_6.2
debug1: match: OpenSSH_6.2 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.2
debug1: list_hostkey_types: ssh-rsa,ssh-dss,ecdsa-sha2-nistp256 [preauth]
debug1: SSH2_MSG_KEXINIT sent [preauth]
debug1: SSH2_MSG_KEXINIT received [preauth]
debug1: kex: client->server aes128-ctr XXXXXXXXXXXXXX none [preauth]
debug1: kex: server->client aes128-ctr XXXXXXXXXXXXXX none [preauth]
debug1: expecting SSH2_MSG_KEX_ECDH_INIT [preauth]
debug1: SSH2_MSG_NEWKEYS sent [preauth]
debug1: expecting SSH2_MSG_NEWKEYS [preauth]
debug1: SSH2_MSG_NEWKEYS received [preauth]
debug1: KEX done [preauth]
debug1: userauth-request for user sftp_user service ssh-connection
method none [preauth]
debug1: attempt 0 failures 0 [preauth]
Address 127.0.0.1 maps to XXXXXXXXXXXXXX, but this does not map back
to the address - POSSIBLE BREAK-IN ATTEMPT!
debug1: userauth-request for user sftp_user service ssh-connection
method publickey [preauth]
debug1: attempt 1 failures 0 [preauth]
debug1: test whether pkalg/pkblob are acceptable [preauth]
debug1: temporarily_use_uid: 1019/513 (e=1006/513)
seteuid 1019: Operation not permitted
debug1: do_cleanup
debug1: Killing privsep child 4340

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple