openssh unix dev - Feb 2010 - case sensitivity, "Match User" and "AllowUsers"

Hello,

I sent this last week before signing up for the list, but haven't seen it in
the archives, so I'm guessing it got discarded either as spam or HTML (sorry
about that).  In any case, the following was sent to comp.security.ssh early
last week and I have gotten no response there.  Can anyone here shed some light?

Thanks,
Eric

------------------------------------------

Hello, 

I'm running an SSH daemon on Cygwin on Windows Server 2003. ?SSH version is
5.1. ?cygrunsrv version is 1.34.
I have the following in my sshd_config file. 

Match User user 
? ? ForceCommand start.sh 

What some users have discovered is that they can log in with arbitrarily mixed
case user names. ?For instance, logging in as "usEr" is exactly the
same as logging in with "USer" as well as the other fourteen possible
combinations for a four-letter username. ?Further, only the all-lowercase
version invokes "start.sh." I thought I might be able to solve this
with the following.

AllowUsers user 

I thought this would force sshd to only let one case combination through.
?However, all case combinations can still log in and "start.sh" is not
getting executed. ?In other words, there is a discrepancy between "Match
User" and "AllowUsers" in this regard.  Does anyone have any idea
how to get around this? ?I don't want to add 2^(length of user name)
"Match User" entries to the sshd_config file for every user, which is
the only remedy at the moment.

Thanks

[+Corinna Vinschen]

It looks like Windows is matching users case-insensitively. OpenSSH
always performs case-sensitive matching (following Unix). If this is
the case, then perhaps we should tolower() all usernames on Windows?

-d

On Mon, 1 Feb 2010, Hu, Eric wrote:
> Hello,
>
> I sent this last week before signing up for the list, but haven't seen
> it in the archives, so I'm guessing it got discarded either as spam
> or HTML (sorry about that). In any case, the following was sent to
> comp.security.ssh early last week and I have gotten no response there.
> Can anyone here shed some light?
> 
> ------------------------------------------
> 
> Hello, 
>
> I'm running an SSH daemon on Cygwin on Windows Server 2003. SSH
> version is 5.1. cygrunsrv version is 1.34. I have the following in my
> sshd_config file.
>
> Match User user 
>     ForceCommand start.sh 
>
> What some users have discovered is that they can log in with
> arbitrarily mixed case user names. For instance, logging in as
"usEr"
> is exactly the same as logging in with "USer" as well as the
other
> fourteen possible combinations for a four-letter username. Further,
> only the all-lowercase version invokes "start.sh." I thought I
might
> be able to solve this with the following.
>
> AllowUsers user
>
> I thought this would force sshd to only let one case combination
> through. However, all case combinations can still log in and
> "start.sh" is not getting executed. In other words, there is a
> discrepancy between "Match User" and "AllowUsers" in
this regard.
> Does anyone have any idea how to get around this? I don't want to add
> 2^(length of user name) "Match User" entries to the sshd_config
file
> for every user, which is the only remedy at the moment.