1

In our company we are using cygwin on each of our machines to be able to run our projects with GNU make (everyone uses Windows 10)! I also developed a tool, with which all employees are able to synchronize their projects from their (slow) machines to our server (Windows Server 2012 R2), run the make on the (fast) server, and synch the output back.

All that works with a cygwin ssh connection!

Informations:

  • Cygwin (also ssh service) on the server is up and running on C:\tools\cygwin
  • Added Domain user group to /etc/group of cygwin installation (means everyone can login with their windows password!)
  • Added every user to passwd file. Looks like this:

    u89x77:*:1447213:1049089:U-OTP01\u89x77,S-1-5-21-1054053922-559824688-2072063007-398637:/home/u89x77:/bin/bash

  • Mapped following directories in fstab file:

    1. C:/tools/cygwin /
    2. C:/projects /home (because the home folder of every user is: C:\projects\username)
    3. C:/tools/cygwin/bin /usr/bin
    4. C:/tools/cygwin/lib /usr/lib (I cannot remember why I mapped point 3 & 4)
  • Created RSA keys for EVERY user on the user's machine and put it into his/her home folder on the server. Everyone is now able to connect to his folder on the server without giving his/her windows password again (I had to do this because my tool to synch works with 'rsync')

What I want now is, to restrict every user, who connects to the server via ssh, to its home folder /home/'username'

For example: A user's username in our domain is u89x77. He's able to login normally via ssh but is also able to cd for example into C:\Windows or worse into C:\projects\'other username'\'absolute secret project'. And that is not what I want.

The user should be blocked to cd out of C:\projects\u89x77 but of course needs to look inside his folder like cd C:\projects\'u89x77\'u89x77 project'.


I tried a lot of things up to now and also made a lot of research. But unfortuneatly nothing worked...

Adding following into /etc/sshd_config on the server's cygwin, I could not connect anymore (Connected and immediately Closed with Exit status 255) and that would also not lead to what I exactly want. Because it would restrict the users to C:\projects\ and not to exactly their folder...:

ChrootDirectory   /home
Subsystem   sftp  internal-sftp

I also read something about mounting the C:\tools\cygwin directory to each user's home directory, because the connected user will not be able to access the cygwin bin/bash anymore? (in /etc/passwd the last entry /bin/bash...) I tried but still the same error.

I am missing something but there are so many options to set this up I just need someones help now....

PS: It was my first post I hope I did not fail to many guidelines. Sorry for that!

2 Answers 2

0

What I want now is, to restrict every user, who connects to the server via ssh, to its home folder /home/'username'

If I understand your question, you can't do this in Cygwin because Windows lacks chroot. You can do it for sftp connections, though. See my CygSSH package on GitHub for details:

https://github.com/Bill-Stewart/CygSSH

0

Thanks for trying to help! The answer was really simple...

I had to block "Domain Users" in the security section only in Windows. E.g. if every user who connects with his domain user account over ssh to the server, only he has Windows permissions to his folder.

By default, Domain Users have at least read rights to newly created folders.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .