X-Recipient:	archive-cygwin AT delorie DOT com
DomainKey-Signature:	a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:mime-version:references:in-reply-to:from:date
	:message-id:subject:to:content-type; q=dns; s=default; b=DyI7dpi
	JVbbBH7QZeZA4At7QE7jiEHqWm3ylFHN+OVGFfufF/Vakkw4zH+bFX/bsh+3cuF6
	Cdksws8wS7SikcD0LxrUXsPnJwaHGKNoytWA3ajvIqdZtXRuAgWbfg0kdwOPED2U
	212/o3H52vazdOxLeV0XRcyA+K4dOIaoMUhk=
DKIM-Signature:	v=1; a=rsa-sha1; c=relaxed; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:mime-version:references:in-reply-to:from:date
	:message-id:subject:to:content-type; s=default; bh=EE+sxmfcVZfGo
	b7mnUbExRQ2JOY=; b=tb+d7oiyXFfv/oBYOrVMQFN0T6KY545HA4T+GKYX2WkbB
	aPNHUVObRe3cqfVxJJ1Uuw7r5T0cNEMl+g+GL/YJbfvXeyK4aui/yP9q/TgE9hzA
	KTByjCJCGml+LRMIHf0pep89raY1qk3H0gQ5Xtayd3ndcHQZ2owavDO4TBzeaM=
Mailing-List:	contact cygwin-help AT cygwin DOT com; run by ezmlm
List-Id:	<cygwin.cygwin.com>
List-Subscribe:	<mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive:	<http://sourceware.org/ml/cygwin/>
List-Post:	<mailto:cygwin AT cygwin DOT com>
List-Help:	<mailto:cygwin-help AT cygwin DOT com>, <http://sourceware.org/ml/#faqs>
Sender:	cygwin-owner AT cygwin DOT com
Mail-Followup-To:	cygwin AT cygwin DOT com
Delivered-To:	mailing list cygwin AT cygwin DOT com
Authentication-Results:	sourceware.org; auth=none
X-Spam-SWARE-Status:	No, score=0.1 required=5.0 tests=BAYES_00,DNS_FROM_AHBL_RHSBL,FREEMAIL_FROM,HTML_MESSAGE,RCVD_IN_DNSWL_LOW,SPF_PASS,TIME_LIMIT_EXCEEDED autolearn=unavailable version=3.3.1 spammy=(unknown), H*c:alternative, password, Full
X-HELO:	mout.gmx.com
DKIM-Signature:	v=1; a=rsa-sha256; c=relaxed/simple; d=mail.com; s=dbd5af2cbaf7; t=1551905309; bh=Wlh8adD9QFnA+v4lehVv31ivu9Eb3FCjF8z9nwKyTzM=; h=X-UI-Sender-Class:References:In-Reply-To:From:Date:Subject:To; b=EeocwLmw9+fU2R+rADRebQjCdSWg8zY5KpLYcvr1w0IUBkKU+uErmm5bG2cOrgwLX 7cyP0HTZ2X2EyY43lo4RPZYZG+PIN3HVcYqq0JVqTbUMJ7Hr7p/w/OylWYGepQGsqg IWhFdSFJnEwin0kaXn4A5NOzgC2Ydxibj1B+paVU=
X-UI-Sender-Class:	214d933f-fd2f-45c7-a636-f5d79ae31a79
MIME-Version:	1.0
References:	<20190306010254 DOT GA4210 AT zebra> <20190306121154 DOT GN3785 AT calimero DOT vinschen DOT de> <20190306124816 DOT GR3785 AT calimero DOT vinschen DOT de> <20190306141716 DOT GS3785 AT calimero DOT vinschen DOT de> <20190306143424 DOT GU3785 AT calimero DOT vinschen DOT de> <CANV9t=SHLCT_xN_T35qTgJmoEBu98gGPaKjHMt559MZ+AwyToQ AT mail DOT gmail DOT com> <20190306153404 DOT GX3785 AT calimero DOT vinschen DOT de> <CANV9t=QiOH4cB47XzKZsReH7RLdaB0CxgY-o3jYgZ46DbV3OdA AT mail DOT gmail DOT com> <20190306201331 DOT GB3785 AT calimero DOT vinschen DOT de>
In-Reply-To:	<20190306201331.GB3785@calimero.vinschen.de>
From:	Bill Stewart <bstewart AT iname DOT com>
Date:	Wed, 6 Mar 2019 13:47:58 -0700
Message-ID:	<CANV9t=RtsR8+KZ68QirxfiU9w_sGk9QnQejEyJVeBcrdiuOq0w@mail.gmail.com>
Subject:	Re: sshd problem on WS2008R2 64bit
To:	cygwin AT cygwin DOT com
X-IsSubscribed:	yes

On Wed, Mar 6, 2019 at 1:14 PM Corinna Vinschen wrote:

> > > > What precisely happens when Cygwin uses MSV1 S4ULogon on versions
older
> > > > than 6.3 before a user has logged on?
> > >
> > > MsV1S4ULogon returns with STATUS_NOT_SUPPORTED.  Funny status code,
> > > given it works if some user already logged in by other means...
> >
> > OK, so here's another potential workaround that doesn't require running
the
> > service as a specific user...
> >
> > Create a scheduled task to run using the following settings:
> >
> > General -> Run using user account - > choose a local account
> > General -> "Run whether user is logged on or not"
> > Triggers -> Run at system startup
> > Actions -> Start a program -> Program/script:
%SystemRoot%\Cystem32\cmd.exe
> > Actions -> Start a program -> Add arguments: /c exit
> >
> > Full password logon is required (seems we can't use "do not store
password"
> > option).
> >
> > The local account does not have to be a member of Administrators, but it
> > does require user right "Log on as a batch job" (SeBatchLogonRight).
> >
> > In my prefunctory testing this seems to fix this problem.
> >
> > Does this work?
>
> This does indeed work in my local testing on Windows 7, with a local
> dummy user just for this scheduled job and sshd running under SYSTEM.
>
> Now, if that's a feasible workaround for users of these older
> systems...?

Good -- this works for me also. (My wild guess, which may be wrong, is that
the older OS versions don't initialize MSV1 S4ULogon for some reason until
somebody logs on.)

Whether this workaround is feasible likely depends on the end user. The
workaround has its own limitations. Here are at least 2 that I can think of
right now:

1. The local user must have "Log on as a batch job" (SeBatchLogonRight)
user right.

2. The "Network access: Do not allow storage of passwords and credentials
for network authentication" security policy must be set to "Disabled". (If
this policy is set to "Enabled", then you can't create scheduled tasks with
stored passwords.)

It's a weird problem. The best option would be for Microsoft to provide a
fix (if we can provide a short example program that reproduces it).

Regards,

Bill

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

- Raw text -