delorie.com/archives/browse.cgi | search |
X-Recipient: | archive-cygwin AT delorie DOT com |
X-SWARE-Spam-Status: | No, hits=-1.9 required=5.0 tests=AWL,BAYES_00,SARE_MSGID_LONG40,SPF_PASS |
X-Spam-Check-By: | sourceware.org |
MIME-Version: | 1.0 |
In-Reply-To: | <20090623100826.GG5039@calimero.vinschen.de> |
References: | <6910a60906220848l6470a9cl44094f8bd93555ea AT mail DOT gmail DOT com> <20090623100826 DOT GG5039 AT calimero DOT vinschen DOT de> |
Date: | Wed, 24 Jun 2009 10:45:25 +0200 |
Message-ID: | <6910a60906240145i5a95cba9s948b181158a960e9@mail.gmail.com> |
Subject: | Re: [1.7] sshd dc problem |
From: | Reini Urban <rurban AT x-ray DOT at> |
To: | cygwin AT cygwin DOT com |
X-IsSubscribed: | yes |
Mailing-List: | contact cygwin-help AT cygwin DOT com; run by ezmlm |
List-Id: | <cygwin.cygwin.com> |
List-Unsubscribe: | <mailto:cygwin-unsubscribe-archive-cygwin=delorie DOT com AT cygwin DOT com> |
List-Subscribe: | <mailto:cygwin-subscribe AT cygwin DOT com> |
List-Archive: | <http://sourceware.org/ml/cygwin/> |
List-Post: | <mailto:cygwin AT cygwin DOT com> |
List-Help: | <mailto:cygwin-help AT cygwin DOT com>, <http://sourceware.org/ml/#faqs> |
Sender: | cygwin-owner AT cygwin DOT com |
Mail-Followup-To: | cygwin AT cygwin DOT com |
Delivered-To: | mailing list cygwin AT cygwin DOT com |
2009/6/23 Corinna Vinschen: > On Jun 22 17:48, Reini Urban wrote: >> Starting the laptop at home, without PDC connection works. I can properl= y login. >> But ssh to this box fails with -1 =3D initgroups (URBANR, 10513) >> error 1355: DcGetDcName(PDC_REQUIRED) call failed >> error 2221: UserGetLocalGroups failed >> >> I should be able to login with pubkey to my box with sshd when windows >> lets me in also. > > That's easier said than done. > > Apparently your laptop is configured to allow using cached credentials > which are used by the machine if it can't connect to a DC. =A0The token > information (groups/privileges) is also cached somewhere in a > non-documented storage. =A0Whatever Windows is using, it's not accessible > for Cygwin. =A0At least I don't know how to do it. Is it possible to detect that one is logged in with a cached credential at least? Then the failing initgroups DcGetDcName(PDC_REQUIRED) can be made non-fatal. Or maybe there's a PDC_OPTIONAL > If Cygwin can't connect one of the DCs, then I don't get the group > information for the given domain account. =A0If I have no group > information, I can only generate a broken user token. =A0The problem > here is that initgroups() is called before setuid(). =A0If setuid() > would always be called first, we already would have a token and could > fetch the groups from there, but that's idle wishing. > > So, for the time being, the workaround to get a user token is thus: > > 1. I'll patch Cygwin to ignore the fact that the group information > =A0 couldn't be fetched from the server. Great! > 2. Either you're happy with a restricted token, Restricted token is okay for me. > or you use the new logon > =A0 method 3 as described in > =A0 http://cygwin.com/1.7/cygwin-ug-net/ntsec.html#ntsec-setuid-overview > =A0 This results in getting a token right from Windows based on the > =A0 cached credentials. I'll try password auth then, thanks --=20 Reini Urban http://phpwiki.org/ http://murbreak.at/ -- Problem reports: http://cygwin.com/problems.html FAQ: http://cygwin.com/faq/ Documentation: http://cygwin.com/docs.html Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple
webmaster | delorie software privacy |
Copyright © 2019 by DJ Delorie | Updated Jul 2019 |