Mailing-List:	contact cygwin-help AT cygwin DOT com; run by ezmlm
List-Subscribe:	<mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive:	<http://sourceware.org/ml/cygwin/>
List-Post:	<mailto:cygwin AT cygwin DOT com>
List-Help:	<mailto:cygwin-help AT cygwin DOT com>, <http://sourceware.org/ml/#faqs>
Sender:	cygwin-owner AT cygwin DOT com
Mail-Followup-To:	cygwin AT cygwin DOT com
Delivered-To:	mailing list cygwin AT cygwin DOT com
Date:	Thu, 16 Sep 2004 23:02:47 +0400
From:	Konstantin Andreev <pkl AT datatech DOT ru>
Organization:	TOR Company
Message-ID:	<168201745184.20040916230247@tortrade.ru>
To:	cygwin AT cygwin DOT com
Subject:	OpenSSH public key authentication: suspicios in domain environment.
Mime-Version:	1.0
X-IsSubscribed:	yes

Suppose, I have Windows XP workstation (TEX), member of domain DOM
(Microsoft Windows Networking), and Cygwin/SSH daemon are running
on this workstation (TEX).

Suppose, on TEX, I set up record in /etc/passwd for domain user DOMUSR.

If I logon on TEX as DOMUSR with password authentication, this logon
is indistinguishable from regular local logon to TEX:

   - record in Security Log appeares
   - command shell is assigned with identical Access Token, and
     privileges.
   - command shell is running under DOMUSR account.

But, if I try to logon on TEX as DOMUSR with public key authentication,
logon succeeds, but strange things appears:

   - *NO* record appears in Security Log about logon event.
   - command shell has strange Access Token, in particular, it does
     not contain these SIDS:
         - Logon SID  (S-1-5-5-0-...)
         - S-1-5-4  NT AUTHORITY\INTERACTIVE
         - S-1-2-0  \LOCAL
   - command shell holds all privileges enabled (like SYSTEM process),
     whereas some of the privileges should be disabled.
   - some utilities consider command shell process as running under
     "NT AUTHORITY\SYSTEM" account, in particular, "whoami.exe" from
     "Windows Server 2003 Resource Kit Tools".

Could anybody comment this ?

-- -
TOR Trade Company, IT Department,
Konstantin Andreev.



--
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple
Problem reports:       http://cygwin.com/problems.html
Documentation:         http://cygwin.com/docs.html
FAQ:                   http://cygwin.com/faq/

- Raw text -