This is the mail archive of the
cygwin
mailing list for the Cygwin project.
Re: inetd help
Andrew DeFaria wrote:
Robert McGraw wrote:
Thanks Corinna and the gmane.os.cygwin group. I got my service running
from the above help.
I am not a window type guy and so have a few question on what I did:
What make sshd_server account so special? I looked through the
ssh-host-script where it creates the sshd_server. Is it the SID
S-1-5-32-544, which I know nothing about. Or could any user in the
administrator group do the same.
If I wanted to create my own -u user, rather then the sshd_server
user, what special settings would be required or is that I have a
password set for this user which inetd uses?
I think it's the following section:
editrights -a SeAssignPrimaryTokenPrivilege -u sshd_server &&
editrights -a SeCreateTokenPrivilege -u sshd_server &&
editrights -a SeDenyInteractiveLogonRight -u sshd_server &&
editrights -a SeDenyNetworkLogonRight -u sshd_server &&
editrights -a SeDenyRemoteInteractiveLogonRight -u
sshd_server &&
editrights -a SeIncreaseQuotaPrivilege -u sshd_server &&
editrights -a SeServiceLogonRight -u sshd_server &&
sshd_server_got_all_rights="yes"
which bestows the necessary rights to the sshd_server user.
Actually it's just the calls to "editrights" that are necessary.
'SeCreateTokenPrivilege' is the right taken away from SYSTEM in W2K3, thus
necessitating the need for this new sshd_server to be created. The only
caution I would offer in all of this is that the OP not create multiple users
with this set of permissions, since it opens potential security holes.
--
Larry Hall http://www.rfk.com
RFK Partners, Inc. (508) 893-9779 - RFK Office
216 Dalton Rd. (508) 893-9889 - FAX
Holliston, MA 01746
--
Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple
Problem reports: http://cygwin.com/problems.html
Documentation: http://cygwin.com/docs.html
FAQ: http://cygwin.com/faq/