RepoMirrors
/
openssh
mirror of git://anongit.mindrot.org/openssh.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

On Cygwin run sshd as SYSTEM where possible. 

Seteuid now creates user token using S4U.  We don't create a token
from scratch anymore, so we don't need the "Create a process token"
privilege.  The service can run under SYSTEM again...

...unless Cygwin is running on Windows Vista or Windows 7 in the
WOW64 32 bit emulation layer.  It turns out that WOW64 on these systems
didn't implement MsV1_0 S4U Logon so we still need the fallback
to NtCreateToken for these systems.

Signed-off-by: Corinna Vinschen <vinschen@redhat.com>
This commit is contained in:
Darren Tucker 2019-03-14 08:51:17 +11:00
parent a212107bfd
commit 825ab32f0d
1 changed files with 20 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

29
contrib/cygwin/ssh-host-config
View File

@ -394,14 +394,24 @@ install_service() {
then
csih_get_cygenv "${cygwin_value}"
if ( csih_is_nt2003 || [ "$csih_FORCE_PRIVILEGED_USER" = "yes" ] )
if ( [ "$csih_FORCE_PRIVILEGED_USER" != "yes" ] )
then
csih_inform "On Windows Server 2003, Windows Vista, and above, the"
csih_inform "SYSTEM account cannot setuid to other users -- a capability"
csih_inform "sshd requires. You need to have or to create a privileged"
csih_inform "account. This script will help you do so."
echo
# Enforce using privileged user on 64 bit Vista or W7 under WOW64
is_wow64=$(/usr/bin/uname | /usr/bin/grep -q 'WOW' && echo 1 || echo 0)
if ( csih_is_nt2003 && ! csih_is_windows8 && [ "${is_wow64}" = "1" ] )
then
csih_inform "Running 32 bit Cygwin on 64 bit Windows Vista or Windows 7"
csih_inform "the SYSTEM account is not sufficient to setuid to a local"
csih_inform "user account. You need to have or to create a privileged"
csih_inform "account. This script will help you do so."
echo
csih_FORCE_PRIVILEGED_USER=yes
fi
fi
if ( [ "$csih_FORCE_PRIVILEGED_USER" = "yes" ] )
then
[ "${opt_force}" = "yes" ] && opt_f=-f
[ -n "${user_account}" ] && opt_u="-u ""${user_account}"""
csih_select_privileged_username ${opt_f} ${opt_u} sshd
@ -412,11 +422,12 @@ install_service() {
csih_request "Do you want to proceed anyway?" || exit 1
let ++ret
fi
# Never returns empty if NT or above
run_service_as=$(csih_service_should_run_as)
else
run_service_as="SYSTEM"
fi
# Never returns empty if NT or above
run_service_as=$(csih_service_should_run_as)
if [ "${run_service_as}" = "${csih_PRIVILEGED_USERNAME}" ]
then
password="${csih_PRIVILEGED_PASSWORD}"