This is the mail archive of the
cygwin
mailing list for the Cygwin project.
CSIH patch (Re: Unable to run sshd under a domain sshd_server account [SOLVED])
- From: Corinna Vinschen <corinna-cygwin at cygwin dot com>
- To: cygwin at cygwin dot com
- Date: Mon, 16 Jun 2008 23:13:53 +0200
- Subject: CSIH patch (Re: Unable to run sshd under a domain sshd_server account [SOLVED])
- References: <3B3EFBD49B94AD4DBB7B7097257A8046DD020D@FDSVAST06SXCH01.flooddata.net> <Pine.GSO.4.63.0805121820090.11953@access1.cims.nyu.edu> <20080513073720.GA22193@calimero.vinschen.de> <3B3EFBD49B94AD4DBB7B7097257A8046DD02FC@FDSVAST06SXCH01.flooddata.net> <20080616210105.GI731@calimero.vinschen.de>
- Reply-to: cygwin at cygwin dot com
Oh, btw., Charles, that's one for you.
On Jun 16 23:01, Corinna Vinschen wrote:
> On May 13 11:09, Schutter, Thomas A. wrote:
> > Except that is not what I am seeing. When I run "id" from a console
> > cygwin shell:
> > $ id
> > uid=18718(tschutter) gid=10513(Domain Users)
> > groups=544(Administrators),545(Users),10513(Domain
> > Users),18169(FDSV-GG-PrxBLD),22611(FDSV-GG-PrxPCAdmins)
> >
> > But when I run "id" from a ssh shell:
> > $ id
> > uid=18718(tschutter) gid=10513(Domain Users)
> > groups=545(Users),10513(Domain Users)
> >
> > So when I am using pubkey authentication, the user token is not a member
> > of the "Administrators", "FDSV-GG-PrxBLD", or "FDSV-GG-PrxPCAdmins"
> > groups.
>
> Dunno if you fixed this problem in the meantime? I tested this myself
> and debugged this situation. It turned out (in *my* local scenario),
> the the PDC refused to list the groups the user is member of:
>
> $ id
> uid=11001(corinna) gid=10513(DomUsers) groups=545(Users),10513(DomUsers)
>
> The problem was that the domain sshd_server account has no right to
> access the domain controller from the network. Solution: Open the Local
> Security Policy of the DC and look for the User Right "Deny access to
> this computer from the network". You'll find your sshd_server user in
> there. Remove it from this user right. Try again:
This user right shouldn't be set anymore in the
csih/cygwin-service-installation-helper.sh script. Patch follows:
* Don't disallow network logon for service user account.
--- cygwin-service-installation-helper.sh.ORIG 2008-06-16 23:07:36.017432500 +0200
+++ cygwin-service-installation-helper.sh 2008-06-16 23:07:50.842305100 +0200
@@ -1640,7 +1640,6 @@ csih_account_has_necessary_privileges()
editrights -l -u "${user}" | fgrep SeCreateTokenPrivilege >/dev/null 2>&1 &&
editrights -l -u "${user}" | fgrep SeTcbPrivilege >/dev/null 2>&1 &&
editrights -l -u "${user}" | fgrep SeDenyInteractiveLogonRight >/dev/null 2>&1 &&
- editrights -l -u "${user}" | fgrep SeDenyNetworkLogonRight >/dev/null 2>&1 &&
editrights -l -u "${user}" | fgrep SeDenyRemoteInteractiveLogonRight >/dev/null 2>&1 &&
editrights -l -u "${user}" | fgrep SeIncreaseQuotaPrivilege >/dev/null 2>&1 &&
editrights -l -u "${user}" | fgrep SeServiceLogonRight >/dev/null 2>&1
Corinna
--
Corinna Vinschen Please, send mails regarding Cygwin to
Cygwin Project Co-Leader cygwin AT cygwin DOT com
Red Hat
--
Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple
Problem reports: http://cygwin.com/problems.html
Documentation: http://cygwin.com/docs.html
FAQ: http://cygwin.com/faq/