为什么 ssh-host-config 在 Windows 8.1 上的 Cygwin 中创建两个用户？

Question

在尝试解决在 Windows 8.1 上使用 Cygwin + SSH 的一些问题时，我想知道为什么ssh-host-config脚本会从头开始创建两个配置 OpenSSH 的新帐户？（这有必要吗？）

这两个帐户是：cyg_server和sshd，使用默认选择+提权和服务安装时。我了解第一个仅用于启动Cygwin SSHd服务，但我不了解第二个的功能。我搜索了 Cygwin 档案，唯一的开发人员解释是“因为它被设计成这样做”。还建议不要将这些用于实际登录。

这是我的安装：

-----------------------------------------------------------
ssh-keygen: generating new host keys: RSA1 RSA DSA ECDSA ED25519
*** Info: Creating default /etc/ssh_config file
*** Info: Creating default /etc/sshd_config file
*** Info: Privilege separation is set to yes by default since OpenSSH 3.3.
*** Info: However, this requires a non-privileged account called 'sshd'.
*** Info: For more info on privilege separation read /usr/share/doc/openssh/README.privsep.
*** Query: Should privilege separation be used? (yes/no) yes
*** Info: Note that creating a new user requires that the current account have
*** Info: Administrator privileges.  Should this script attempt to create a
*** Query: new local account 'sshd'? (yes/no) yes
*** Info: Updating /etc/sshd_config file

*** Query: Do you want to install sshd as a service?
*** Query: (Say "no" if it is already installed as a service) (yes/no) yes
*** Query: Enter the value of CYGWIN for the daemon: []
*** Info: On Windows Server 2003, Windows Vista, and above, the
*** Info: SYSTEM account cannot setuid to other users -- a capability
*** Info: sshd requires.  You need to have or to create a privileged
*** Info: account.  This script will help you do so.

*** Info: You appear to be running Windows XP 64bit, Windows 2003 Server,
*** Info: or later.  On these systems, it's not possible to use the LocalSystem
*** Info: account for services that can change the user id without an
*** Info: explicit password (such as passwordless logins [e.g. public key
*** Info: authentication] via sshd).

*** Info: If you want to enable that functionality, it's required to create
*** Info: a new account with special privileges (unless a similar account
*** Info: already exists). This account is then used to run these special
*** Info: servers.

*** Info: Note that creating a new user requires that the current account
*** Info: have Administrator privileges itself.

*** Info: No privileged account could be found.

*** Info: This script plans to use 'cyg_server'.
*** Info: 'cyg_server' will only be used by registered services.
*** Query: Do you want to use a different name? (yes/no) no
*** Query: Create new privileged user account 'cyg_server'? (yes/no) yes
*** Info: Please enter a password for new user cyg_server.  Please be sure
*** Info: that this password matches the password rules given on your system.
*** Info: Entering no password will exit the configuration.
*** Query: Please enter the password:
*** Query: Reenter:

*** Info: User 'cyg_server' has been created with password 'XXXXXXXXXX'.
*** Info: If you change the password, please remember also to change the
*** Info: password for the installed services which use (or will soon use)
*** Info: the 'cyg_server' account.

*** Info: Also keep in mind that the user 'cyg_server' needs read permissions
*** Info: on all users' relevant files for the services running as 'cyg_server'.
*** Info: In particular, for the sshd server all users' .ssh/authorized_keys
*** Info: files must have appropriate permissions to allow public key
*** Info: authentication. (Re-)running ssh-user-config for each user will set
*** Info: these permissions correctly. [Similar restrictions apply, for
*** Info: instance, for .rhosts files if the rshd server is running, etc].


*** Info: The sshd service has been installed under the 'cyg_server'
*** Info: account.  To start the service now, call `net start sshd' or
*** Info: `cygrunsrv -S sshd'.  Otherwise, it will start automatically
*** Info: after the next reboot.

*** Info: Host configuration finished. Have fun!
-----------------------------------------------------------

此外，'cyg_server' 是一个可见帐户，可用于 Windows 登录，但 'sshd' 似乎是隐藏的。所以我的结论是我必须添加另一个第三个帐户才能正确使用 SSH，这看起来很疯狂！

---

EDIT-1：不仅如此，sshd帐户还设置了自安装后 40 天的密码过期日期，并设置了密码（根据WMIC）。（在 ssh 设置期间，我从未被要求为此帐户输入密码。）

做wmic useraccount get AccountType,...,Status：：

AccountType  Disabled  Lockout  Name           PasswordChangeable  PasswordExpires  PasswordRequired  Status    
512          FALSE     FALSE    cyg_server     TRUE                FALSE            TRUE              OK        
512          TRUE      FALSE    sshd           TRUE                TRUE             TRUE              Degraded  

和net user sshd：

User name                    sshd
Full Name                    sshd privsep
Comment                      
User's comment               
Country/region code          000 (System Default)
Account active               No
Account expires              Never
Password last set            2014-03-01 23:20:19
Password expires             2014-04-12 23:20:19
Password changeable          2014-03-01 23:20:19
Password required            Yes
User may change password     Yes
Workstations allowed         All
Logon script                 
User profile                 
Home directory               C:\cygwin64\var\empty
Last logon                   Never
Logon hours allowed          All
Local Group Memberships      *Users                
Global Group memberships     *None                 
The command completed successfully.

---

因此，这引发了关于此的另外两个问题：

1. 密码设置是什么，为什么用户没有被告知这一点？
2. 为什么这个密码有有效期？

---

EDIT-2：无法进入 Cygwin 开发人员列表，我不得不自己做进一步的调查。到目前为止，我还没有回答问题 1，但是用于设置的 ssh-host-config 脚本还有其他几个问题。最重要的是，您始终可以删除 sshd 和 cyg_server 帐户，并使用其设置作为参考设置一个适当的管理员帐户。

问题 2：Windows 8.1 的默认密码过期时间设置为 42 天。必须使用普通的 Windows 工具（UI、WMIC、网络用户等）更改或禁用它

Answer 1

2019 年更新：此答案和问题已过时。请参阅 Bill_Stewart 的回答。

从man 5 sshd_config

 UsePrivilegeSeparation
     Specifies whether sshd separates privileges by creating an
     unprivileged child process to deal with incoming network traffic.
     After successful authentication, another process will be created
     that has the privilege of the authenticated user.  The goal of
     privilege separation is to prevent privilege escalation by con-
     taining any corruption within the unprivileged processes.  The
     default is "yes".

所以 sshd 需要两种类型的帐户：

1. 一个有能力的人setuid。
2. 一个非特权帐户。

安装脚本解释说，通常的 SYSTEM 帐户没有setuid权限，因此需要额外的特权帐户。