I am new to Cygwin, ssh, and messing with file permissions and have a problem. On computer WORKER1, I am attempting to ssh into computer WORKER2 and then running a .sh file on WORKER1 from there. From what I can tell from the below output, ls -l shows that there should be permission to do everything (I know that those are bad permissions to have, but I was going mad trying to figure out why I was getting this permission error).

root@Worker1 ~
$ ssh WORKER2
Last login: Tue Jan 31 10:51:54 2012 from worker1

root@Worker2 ~
$ cd //WORKER1/Users/Public/pMatlab/MatlabMPI/Examples/MatMPI

root@Worker2 //WORKER1/Users/Public/pMatlab/MatlabMPI/Examples/MatMPI
$ sh Dos_Commands.WORKER2.1.sh
sh: Dos_Commands.WORKER2.1.sh: Permission denied

root@Worker2 //WORKER1/Users/Public/pMatlab/MatlabMPI/Examples/MatMPI
$ ls -l
total 28
-rwxrwxrwx+ 1 Administrators None   2 Jan 31 11:01 Dos_Commands.WORKER1.0
-rwxrwxrwx+ 1 Administrators None 127 Jan 31 11:01 Dos_Commands.WORKER2.1
-rwxrwxrwx+ 1 Administrators None 250 Jan 31 11:01 Dos_Commands.bat
-rwxrwxrwx+ 1 Administrators None 636 Jan 31 11:01 MPI_COMM_WORLD.mat
-rwxrwxrwx+ 1 Administrators None  97 Jan 31 11:01 MatMPIdefs1.m
-rwxrwxrwx+ 1 Administrators None 199 Jan 31 11:01 p0_p0_t10000_buffer.ma
-rwxrwxrwx+ 1 Administrators None 199 Jan 31 11:01 p0_p1_t10000_buffer.ma
-rwxrwxrwx+ 1 Administrators None   0 Jan 31 11:01 p0_p1_t10000_lock.mat

Both computers are running Windows 7 64 bit, and I am running the latest version of Cygwin and OpenSSH on each. The sshd running on WORKER2 is also the one from Cygwin. When installing sshd, the only way I was able to get it to properly function was to answer 'no' to privilege separation and 'yes' to installing as a service when running ssh-host-config. I'm using public key RSA authentication. I've tried mounting //WORKER1/Users/Public/pMatlab/ as a network drive and accessing it that way, but that did not help either. Any ideas of what might be going wrong? Thanks!

EDIT: I forgot to mention that my network sharing settings in Windows are set to allow everything from what I can see. Furthermore, my Public folder and folders within it all seem to be set to read-only (in the right click->Properties menu), though the files within it are not. Attempting to change this in the Properties menu does nothing - when I turn read-only off it is just back on again when I reopen the Properties menu. I tried changing this by running attrib -r C:\Users\Public in cmd.exe but that did not do anything either.

Finally, I do not get a permission denied error when running the .sh file locally, when I try to access it from the Windows GUI on computer WORKER2, or when I ssh from WORKER2 to itself and then try to access it. The permission error only appears when I ssh from WORKER1 to WORKER2 and then try to access the file on WORKER1 from there.

Final edit: Issue solved. It turned out that the folder was encrypted! No idea why. That's how it came out of the zip file for some reason.


Welcome to the wonderful new Unix world of 1989!

Those nice TRUSIX people have — just this year — defined an extension to the ls command to indicate visually when the rwxrwxrwx permissions information is not actually the whole of the story. That extension is a + character following the permission flags. As you can see, your ls output has + characters all over the place. That means that your files have these new-fangled discretionary access control list thingies that the TRUSIX people are so excited about. As such, your access to the files is not necessarily what you can deduce from the nine permissions flags alone.

To compensate for these limitations of old-style Unix tools in the face of the new-style ACLs, the TRUSIX people have also come up with a couple of new commands, getacl and setacl. The former is used for looking at those ACLs. I hear murmurings that people might prefer getfacl and setfacl as names. And there's a rumour going around that Microsoft's and IBM's OS/2 version 3 that's on the drawing board might eventually end up with commands named cacls and xcacls for looking at ACLs that will be even better than getfacl on their "New Technology" operating system, because they'll not present them through a 3-bit Unix lens but rather how they really are in all of their standard-and-specific-rights drctpoxfew both-account-and-machine-name glory.

This idea is bound to catch on like wildfire, in the Unix world that everyone will surely end up a part of in the 1990s. It's very likely that in 20 years time nine bits of permissions will seem old-hat and passé, ACLs will be the norm, and even the fuddy-duddies that still look at nine permissions flags will know about them. ☺

Further reading

  • 1
    Hahaha, that was fun to read and informative. Thanks! – Jon Paprocki Feb 1 '12 at 15:37
  • Great answer. In the intervening years, the good people at Microsoft have also given us icacls -- and more recently Get-Acl in PowerShell (combining the best parts of VMS and Unix shells with native Windows APIs). – Anthony Geoghegan Mar 20 '17 at 11:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.