X-Recipient:	archive-cygwin AT delorie DOT com
DomainKey-Signature:	a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:date:from:to:subject:message-id:reply-to
	:references:mime-version:content-type:in-reply-to; q=dns; s=
	default; b=SDHomipu7vOEqS3gt3Vp63T2ljCPY7Vs3kZQ48LndXjcDRW530LrY
	w3Es3Q235/rmkHBqgvEPuFYRoCQVo5ZIMHPC3uDqxYex6AKnnzcb3dSfXhgWmzqS
	fhGVNPnPr02G486ZgY9jjNJGt0IjAbMxtvWt/BRZkzRVrsGF/FU1sY=
DKIM-Signature:	v=1; a=rsa-sha1; c=relaxed; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:date:from:to:subject:message-id:reply-to
	:references:mime-version:content-type:in-reply-to; s=default;
	bh=HahGPaY+Y0u99v7kAUYLPd7nM+A=; b=Ab05nT2IW8HwXHZeEW2RBs9vyj5x
	pQyiWwn3CjaO71i+iOfkT35WFUbEj/IJ4U4muj8WXSzZIOMBs/jvXfANn0PoCAqf
	NJv4K0FE4mAJgFzM23WbUPjnd2Pt+FkWAv6LaEVSttlNhRmyly0qYGqpOwNa6Cwe
	QbqlyseZXKC34q8=
Mailing-List:	contact cygwin-help AT cygwin DOT com; run by ezmlm
List-Id:	<cygwin.cygwin.com>
List-Subscribe:	<mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive:	<http://sourceware.org/ml/cygwin/>
List-Post:	<mailto:cygwin AT cygwin DOT com>
List-Help:	<mailto:cygwin-help AT cygwin DOT com>, <http://sourceware.org/ml/#faqs>
Sender:	cygwin-owner AT cygwin DOT com
Mail-Followup-To:	cygwin AT cygwin DOT com
Delivered-To:	mailing list cygwin AT cygwin DOT com
Authentication-Results:	sourceware.org; auth=none
X-Spam-SWARE-Status:	No, score=-100.9 required=5.0 tests=BAYES_00,GOOD_FROM_CORINNA_CYGWIN,KAM_LAZY_DOMAIN_SECURITY,RCVD_IN_DNSWL_NONE autolearn=ham version=3.3.2 spammy=
X-HELO:	mout.kundenserver.de
Date:	Wed, 13 Feb 2019 13:25:09 +0100
From:	Corinna Vinschen <corinna-cygwin AT cygwin DOT com>
To:	cygwin AT cygwin DOT com
Subject:	Re: sshd: computer name's case must match?
Message-ID:	<20190213122509.GL3718@calimero.vinschen.de>
Reply-To:	cygwin AT cygwin DOT com
Mail-Followup-To:	cygwin AT cygwin DOT com
References:	<CANV9t=QxA_FW-3OCZuYFJpxrekbO8Yc-WsnxGLiyc0Bqz=fPUw AT mail DOT gmail DOT com> <20190213103200 DOT GK3718 AT calimero DOT vinschen DOT de>
MIME-Version:	1.0
In-Reply-To:	<20190213103200.GK3718@calimero.vinschen.de>
User-Agent:	Mutt/1.10.1 (2018-07-13)

--kjpMrWxdCilgNbo1
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Feb 13 11:32, Corinna Vinschen wrote:
> On Feb 12 16:07, Bill Stewart wrote:
> > Good day,
> >=20
> > I am testing sshd using the cygwin1.dll 3.x version (run as SYSTEM -
> > S4U logon - works great!).
> >=20
> > One thing I've noticed is that if I use ssh log onto a remote
> > domain-joined machine (e.g., connect with COMPUTER+localname), the
> > 'COMPUTER' prefix must be uppercase - if I specify
> > 'computer+LocalName', the user is unknown.
> >=20
> > This doesn't seem to be the case if I change the username's case -
> > 'COMPUTER+localname' also works.
> >=20
> > Is this by design or by accident?
>=20
> sshd checks usernames case-sensitive against their name stored in the
> user DB.  The problem that you can use differently cased usernames
> here is that the Windows function for checking the name is case-
> insensitive, so it takes the username any way it comes in and
> sshd eventually checks against the wrongly cased name.
>=20
> I fixed that partially in Cygwin by making sure that the account name
> stored in the internal passwd/group info is stored case-correct:
> https://cygwin.com/git/?p=3Dnewlib-cygwin.git;a=3Dcommitdiff;h=3D9a3cc77b=
2afc
>=20
> So if you have a domain DOMAIN and a user xyz
>=20
> $ getent passwd DoMaIn+XyZ
>=20
> Prior to the above patch  it returned
>=20
>   DOMAIN+XyZ:...
>=20
> Now it will return
>=20
>   DOMAIN+xyz:...
>=20
> The problem is this:  If the account is from another domain than the
> local machine or the machine domain, the call to LookupAccountSid to fix
> the account name won't fix the account name.
>=20
> Apparently the account name is cached on the local machine in exactly
> the same spelling as has been used when asking for the account the first
> time.  I still have to find a way to workaround that.

That should be fixed now as well.  I uploaded new developer snaps to
https://cygwin.com/snapshots/  and will generate YA test release later
today.


Corinna

--=20
Corinna Vinschen
Cygwin Maintainer

--kjpMrWxdCilgNbo1
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEoVYPmneWZnwT6kwF9TYGna5ET6AFAlxkDKUACgkQ9TYGna5E
T6BK+w//bZumh25W6dY4BQe8YAUNhIkLztVDYlLgt+NqS45o96xvTIC4DFg4aGTW
zgdAfKXVqH90AezLPctesFbFB8pdRbjcNAEuXG/ZJzZqK/7geNtEgHLRPLCd4hMk
hBlsV8wy8PS599YUzqvwCIo8QkgUGjax+NAZOWpDQhcMeM2krms0J7gRi6AYurG3
U9XjL6cqF7tw1sDNlC0kvf0tZP9EI3yYyb7k46nVkcGvcTXCiS8UEMP90R9LL4Rc
S7lHvJg0BO3UjEuj1okda28cb/fMU14rb89TZH4JVeQwZD3CicTRn9BaCaEegzTv
QJOMhKiDb+dUQh9fInGf4UtgHZL6pmkJAyXH2O38eQf8cUFqrvzJH2nEj/jPwlyr
nPdSghMeAjyXIHR8zFZP8zh423i3r0Mq9U4zcRnjjkDykvHLnzv51FDnGx7wh9A9
fK50Z5RnspAlamGGbayMY2Y4qZtta29oq6u71mhklxphIyFYoQ61NztJxdjB+vvS
LfENYL3pFmTPnmbV/DZdb3lMOacw1zytY2k2dqptKmZX/VM/X5QIbbo5M76i0Eof
2uE02ACtjP2tYyvlzWsC3tBKAWJxb7eBZnD+VFLh3KwBdnRYu0kFqoJwg5So/Muq
5R7vDC+XnoNUoBbe4t2mJrdIb448bF60bWyEWH9FbNI4heS+DdM=
=8sfl
-----END PGP SIGNATURE-----

--kjpMrWxdCilgNbo1--

- Raw text -