X-Recipient:	archive-cygwin AT delorie DOT com
DomainKey-Signature:	a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:from:to:subject:references:date:in-reply-to
	:message-id:mime-version:content-type; q=dns; s=default; b=AWEw9
	xjpWW+j7CDVWXBAQtxsIxKh4Q+4fYE5HxhQf9HmIOERWR5lLlqtEYwuGpPpxNB32
	ZINNzs6moVpltn62k1KtJlyhr6Xmlf/qabvA6amtBx0mWtQlVOp9TWwGkbiPupKZ
	PeWzsgAYJThDfs9QihaBGr9xxsSAYS7B77hH+s=
DKIM-Signature:	v=1; a=rsa-sha1; c=relaxed; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:from:to:subject:references:date:in-reply-to
	:message-id:mime-version:content-type; s=default; bh=OabhgZ3PJGT
	EZvHQxqxWQ7Zt8Uk=; b=g8GgzfqtxDqKBUXEWYVhsimpx8Np3d8GMCEvKfYP5FQ
	CCwCjKCXU6pM8H3A2cpvGpYhb1QEvK64/ELqMn1IMDDJA+JQyQpB9mghl5ztLJ8g
	lL7TUl7Jkjs7MlYguykQvnzrBb38gU11VMhC0d6tMSsffWveazhV02xIfnD0kqFE
	=
Mailing-List:	contact cygwin-help AT cygwin DOT com; run by ezmlm
List-Id:	<cygwin.cygwin.com>
List-Subscribe:	<mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive:	<http://sourceware.org/ml/cygwin/>
List-Post:	<mailto:cygwin AT cygwin DOT com>
List-Help:	<mailto:cygwin-help AT cygwin DOT com>, <http://sourceware.org/ml/#faqs>
Sender:	cygwin-owner AT cygwin DOT com
Mail-Followup-To:	cygwin AT cygwin DOT com
Delivered-To:	mailing list cygwin AT cygwin DOT com
Authentication-Results:	sourceware.org; auth=none
X-Virus-Found:	No
X-Spam-SWARE-Status:	No, score=-5.5 required=5.0 tests=AWL,BAYES_00,RCVD_IN_DNSWL_NONE,RCVD_IN_JMF_BR,SPF_PASS autolearn=no version=3.3.2
X-HELO:	mail-in-07.arcor-online.net
X-DKIM:	Sendmail DKIM Filter v2.8.2 mail-in-02.arcor-online.net CA32830309
From:	Achim Gratz <Stromeko AT nexgo DOT de>
To:	cygwin AT cygwin DOT com
Subject:	Re: LDAP integration and sshd
References:	<loom DOT 20140625T141552-513 AT post DOT gmane DOT org> <20140625130727 DOT GQ1803 AT calimero DOT vinschen DOT de> <loom DOT 20140626T093103-970 AT post DOT gmane DOT org> <20140626083253 DOT GA25654 AT calimero DOT vinschen DOT de> <loom DOT 20140626T112515-399 AT post DOT gmane DOT org> <20140626105045 DOT GU1803 AT calimero DOT vinschen DOT de>
Date:	Thu, 26 Jun 2014 19:03:07 +0200
In-Reply-To:	<20140626105045.GU1803@calimero.vinschen.de> (Corinna Vinschen's message of "Thu, 26 Jun 2014 12:50:45 +0200")
Message-ID:	<87pphva9is.fsf@Rainer.invalid>
User-Agent:	Gnus/5.13 (Gnus v5.13) Emacs/24.3.91 (gnu/linux)
MIME-Version:	1.0

Corinna Vinschen writes:
>> Hmm.  Doesn't appear to be working in any combination I tried, I'm always
>> getting an "invalid user" when I'm trying to do that.  Is it possible that
>> the AD lookup doesn't work when using privilege separation?
>
> No idea.  Did you try?  You didn't use '@' as separator, by any chance?

No, I didn't change any settings from the default (apart from the lone
sshd entry in /etc/passwd to make the local account visible to the
sshd).  The sshd runs under the sshd local account.

So, I've tried to let certain users in only if they match a name pattern
(the pattern match is verified to work and shows up in the log) and are
in group +Administrators as resloves with getent, as soon as I specify
anything other than "*" in the AllowGroup config, these users are not
allowed to log in.  I've tried "Administrators", "+Administrators" and
even "primaryDOM+Administrators".  The same happens for another list of
users and a non-administrative group from the primary domain that
basically all users are a member of; no changes in behaviour when I
chose a domain group that I know has only a handful of users including
the test account.


Regards,
Achim.
-- 
+<[Q+ Matrix-12 WAVE#46+305 Neuron microQkb Andromeda XTk Blofeld]>+

Wavetables for the Terratec KOMPLEXER:
http://Synth.Stromeko.net/Downloads.html#KomplexerWaves

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

- Raw text -