Mailing-List:	contact cygwin-help AT cygwin DOT com; run by ezmlm
List-Subscribe:	<mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive:	<http://sources.redhat.com/ml/cygwin/>
List-Post:	<mailto:cygwin AT cygwin DOT com>
List-Help:	<mailto:cygwin-help AT cygwin DOT com>, <http://sources.redhat.com/ml/#faqs>
Sender:	cygwin-owner AT cygwin DOT com
Mail-Followup-To:	cygwin AT cygwin DOT com
Delivered-To:	mailing list cygwin AT cygwin DOT com
Date:	Thu, 27 Jun 2002 11:36:14 -0400 (EDT)
From:	Chris Metcalf <metcalf AT incert DOT com>
To:	cygwin AT cygwin DOT com
Subject:	Cygwin OpenSSH 3.4 privilege separation issues
Message-ID:	<Pine.LNX.4.44.0206271129150.2622-100000@rd.incert.com>
MIME-Version:	1.0

I upgraded from running OpenSSH 3.3 with privilege separation to running
OpenSSH 3.4 and it no longer starts up correctly as a service;  
/var/log/sshd.log holds "Bad owner or mode for /var/empty".  I've done a
"chown 0 /var/empty; chmod 700 /var/empty" which should match the checking
code in sshd.c, but for some reason it doesn't appear to.  (A small
cut-and-paste of the /var/empty checking code from sshd.c into a separate
program doesn't issue the warning.) So this is a puzzle.

Of course, "uid 0" is Everyone, and what we really want here is a check
that /var/empty is owned by SYSTEM (uid 18).  This is really a bigger 
issue; we shouldn't be relying on uid 0 to be special under Cygwin.

Meanwhile I've flipped UsePrivilegeSeparation back off for now, but we 
should get these issues fixed so we can use privilege separation.

                Chris Metcalf -- InCert Software -- 1 (617) 621 8080
                metcalf AT incert DOT com -- http://www.incert.com/~metcalf


--
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple
Bug reporting:         http://cygwin.com/bugs.html
Documentation:         http://cygwin.com/docs.html
FAQ:                   http://cygwin.com/faq/

- Raw text -