Ssh
為什麼 ssh-host-config 在 Windows 8.1 上的 Cygwin 中創建兩個使用者？
在嘗試解決在 Windows 8.1 上使用 Cygwin + SSH 的一些問題時，我想知道為什麼該
ssh-host-config腳本會創建兩個從頭開始配置 OpenSSH 的新帳戶？（這有必要嗎？）兩個賬號分別是：
cyg_server和sshd，當使用預設選擇+權限提升和服務安裝時。我知道第一個僅用於啟動 Cygwin SSHd 服務，但我不了解第二個的功能。我搜尋了 Cygwin 檔案，唯一的開發人員解釋是“因為它是為此而設計的”。還建議不要將這些用於實際登錄。這是我的安裝：
----------------------------------------------------------- ssh-keygen: generating new host keys: RSA1 RSA DSA ECDSA ED25519 *** Info: Creating default /etc/ssh_config file *** Info: Creating default /etc/sshd_config file *** Info: Privilege separation is set to yes by default since OpenSSH 3.3. *** Info: However, this requires a non-privileged account called 'sshd'. *** Info: For more info on privilege separation read /usr/share/doc/openssh/README.privsep. *** Query: Should privilege separation be used? (yes/no) yes *** Info: Note that creating a new user requires that the current account have *** Info: Administrator privileges. Should this script attempt to create a *** Query: new local account 'sshd'? (yes/no) yes *** Info: Updating /etc/sshd_config file *** Query: Do you want to install sshd as a service? *** Query: (Say "no" if it is already installed as a service) (yes/no) yes *** Query: Enter the value of CYGWIN for the daemon: [] *** Info: On Windows Server 2003, Windows Vista, and above, the *** Info: SYSTEM account cannot setuid to other users -- a capability *** Info: sshd requires. You need to have or to create a privileged *** Info: account. This script will help you do so. *** Info: You appear to be running Windows XP 64bit, Windows 2003 Server, *** Info: or later. On these systems, it's not possible to use the LocalSystem *** Info: account for services that can change the user id without an *** Info: explicit password (such as passwordless logins [e.g. public key *** Info: authentication] via sshd). *** Info: If you want to enable that functionality, it's required to create *** Info: a new account with special privileges (unless a similar account *** Info: already exists). This account is then used to run these special *** Info: servers. *** Info: Note that creating a new user requires that the current account *** Info: have Administrator privileges itself. *** Info: No privileged account could be found. *** Info: This script plans to use 'cyg_server'. *** Info: 'cyg_server' will only be used by registered services. *** Query: Do you want to use a different name? (yes/no) no *** Query: Create new privileged user account 'cyg_server'? (yes/no) yes *** Info: Please enter a password for new user cyg_server. Please be sure *** Info: that this password matches the password rules given on your system. *** Info: Entering no password will exit the configuration. *** Query: Please enter the password: *** Query: Reenter: *** Info: User 'cyg_server' has been created with password 'XXXXXXXXXX'. *** Info: If you change the password, please remember also to change the *** Info: password for the installed services which use (or will soon use) *** Info: the 'cyg_server' account. *** Info: Also keep in mind that the user 'cyg_server' needs read permissions *** Info: on all users' relevant files for the services running as 'cyg_server'. *** Info: In particular, for the sshd server all users' .ssh/authorized_keys *** Info: files must have appropriate permissions to allow public key *** Info: authentication. (Re-)running ssh-user-config for each user will set *** Info: these permissions correctly. [Similar restrictions apply, for *** Info: instance, for .rhosts files if the rshd server is running, etc]. *** Info: The sshd service has been installed under the 'cyg_server' *** Info: account. To start the service now, call `net start sshd' or *** Info: `cygrunsrv -S sshd'. Otherwise, it will start automatically *** Info: after the next reboot. *** Info: Host configuration finished. Have fun! -----------------------------------------------------------此外，‘cyg_server’ 是一個可見帳戶，可用於 Windows 登錄，但 ‘sshd’ 似乎是隱藏的。所以我得出的結論是，我必須再添加第三個帳戶才能正確使用 SSH，這看起來相當瘋狂！
EDIT-1：不僅如此，sshd帳戶還設置了從安裝後 40 天設置的密碼到期日期，並且有密碼（根據WMIC）。（在 ssh 設置期間，我從未被要求輸入此帳戶的密碼。）
做
wmic useraccount get AccountType,...,Status：：AccountType Disabled Lockout Name PasswordChangeable PasswordExpires PasswordRequired Status 512 FALSE FALSE cyg_server TRUE FALSE TRUE OK 512 TRUE FALSE sshd TRUE TRUE TRUE Degraded和
net user sshd：User name sshd Full Name sshd privsep Comment User's comment Country/region code 000 (System Default) Account active No Account expires Never Password last set 2014-03-01 23:20:19 Password expires 2014-04-12 23:20:19 Password changeable 2014-03-01 23:20:19 Password required Yes User may change password Yes Workstations allowed All Logon script User profile Home directory C:\cygwin64\var\empty Last logon Never Logon hours allowed All Local Group Memberships *Users Global Group memberships *None The command completed successfully.因此，這又提出了兩個問題：
- 密碼設置是什麼？為什麼沒有通知使用者？
- 為什麼這個密碼有有效期？
EDIT-2：無法進入 Cygwin 開發人員列表，我不得不自己做進一步的調查。到目前為止，我還沒有問題 1 的答案，但是用於設置的 ssh-host-config 腳本還有其他幾個問題。底線是，您始終可以刪除 sshd 和 cyg_server 帳戶，並使用它們的設置作為參考設置一個適當的管理員帳戶。
問題 2：Windows 8.1 的預設密碼有效期設置為 42 天。必須使用普通的 Windows 工具（UI、WMIC、網路使用者等）更改或禁用它
2019 年更新：此答案和問題已過時。請參閱 Bill_Stewart 的回答。
從
man 5 sshd_configUsePrivilegeSeparation Specifies whether sshd separates privileges by creating an unprivileged child process to deal with incoming network traffic. After successful authentication, another process will be created that has the privilege of the authenticated user. The goal of privilege separation is to prevent privilege escalation by con- taining any corruption within the unprivileged processes. The default is "yes".所以 sshd 需要兩種類型的賬戶：
- 一個有能力的
setuid。- 一個非特權帳戶。
安裝腳本解釋了通常的 SYSTEM 帳戶沒有
setuid特權，因此需要額外的特權帳戶。