Mail Archives: cygwin/2001/07/09/01:53:27
On Sun, Jul 08, 2001 at 05:17:19PM -0400, Phillip Susi wrote:
> How is it worked out?
>
> If you just use LogonUser(), not only do you have to have the users
> password, but you also have to have the TCB privilege, which is
> silly. Unless you have a service that runs as system and accepts logon
> requests from clients, and gives them back the token?
You're right, we would need a server process to have a real `su'
solution. We already discussed such a server process to support
various features (su, suid-bit, ipc, ...) on the cygwin-developers
list but that will need time. The need for the TCB privilege is a
problem, actually. Fortunately Microsoft dropped the need to have
the TCB privilege when calling LogonUser in XP but that doesn't
really help as long as NT and W2K are still in use.
> I was actually thinking of writing a replacement authentication dll that
> would punt to the standard one unless a special username syntax was
> entered, something like administrator!luser, and if the administrator
> password was correct, it would log on as luser. This would be nice because
> if you installed it on a domain controller, it would handle logon requests
> from all clients in the domain, for local and remote access, not just local.
But authentication DLL's are actually running in TCB context as well.
So the process connecting the authDLL would still need that privilege,
right?
Corinna
--
Corinna Vinschen Please, send mails regarding Cygwin to
Cygwin Developer mailto:cygwin AT cygwin DOT com
Red Hat, Inc.
--
Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple
Bug reporting: http://cygwin.com/bugs.html
Documentation: http://cygwin.com/docs.html
FAQ: http://cygwin.com/faq/
- Raw text -