This is the mail archive of the cygwin mailing list for the Cygwin project.

Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]
Other format: [Raw text]

Re: strange cygwin sshd user generated (user name includes machine name)

Peter Moore wrote:

I have a powershell script for installing cygwin and setting up sshd which I am using as UserData when firing up a Windows 2012 R2 instance in AWS EC2.

The same command succeeds when run manually, but fails when called from automation. Iâm trying to understand what it is that is different, so I can fix it in automation.

I have both a domain account (Bliss) and a local account on my winclient(Athenae): Bliss\linda & linda

Using Domain account on client -> Domain server
ssh Bliss
server logs say:
... sshd[49322]: pam_winbind(sshd:account): user 'Bliss\linda' granted access
ssh linda@Bliss, server logs say:
sshd[51179]: pam_winbind(sshd:account): user 'linda' granted access

Using local account on client ->Domain:
ssh Bliss
server says:
Oct  9 20:51:21 Ishtar sshd[51787]: pam_winbind(sshd:account): user 'linda' granted access
if I want to login to the domain account, I need to specify it as the user:
ssh 'Bliss\linda'@Bliss
server says:
sshd[51982]: pam_winbind(sshd:account): user 'Bliss\linda' granted access

so in the above case, I am seeing a similar "symptom" -- where it uses
'domain\user' when I'm logged in my domain account and just 'user' if I specify 'user@Domain'.

Both login to the *same* account on the PDC -- because on the PDC
local users are domain users -- because the SID of the local machine
is the same as the domain SID.

I.e. on the domain server, I can display the domain or the local machine SID:

net getlocalsid   #note, it equates local machine name as a domain name in this case
SID for domain ISHTAR is: S-1-5-21-33333-77777-33333

When I ask for the domain sid: it displays both:

net getdomainsid
SID for local machine ISHTAR is: S-1-5-21-33333-77777-33333
SID for domain BLISS is: S-1-5-21-33333-77777-33333

So first, obvious question is "are domains involved",
but 2nd question ... are the machine 'SIDS' the same in both cases?

I.e. when you run 'live' vs. run under automation, maybe the 'automation'
looks like a different machine name and uses a different 'sid'? That'd be my best guess...I only replied because I have seen the same
symptom depending on usage of the domain vs. local account.

Good luck!

Problem reports:
Unsubscribe info:

Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]