X-Recipient: archive-cygwin@delorie.com X-SWARE-Spam-Status: No, hits=-2.0 required=5.0 tests=AWL,BAYES_00,SARE_MSGID_LONG40,SPF_PASS X-Spam-Check-By: sourceware.org MIME-Version: 1.0 In-Reply-To: <20100125110328.GJ2402@calimero.vinschen.de> References: <20100108145957.GB23992@calimero.vinschen.de> <4B5CE93D.9050603@eburg.com> <20100125110328.GJ2402@calimero.vinschen.de> Date: Mon, 25 Jan 2010 12:11:43 +0100 Message-ID: <6910a61001250311o6a0f687cp79909c70166fb174@mail.gmail.com> Subject: Re: Why you can't load ws2_32.dll (was Re: Can't use key authentication on x64 Server 2003 R2) From: Reini Urban To: cygwin@cygwin.com Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable X-IsSubscribed: yes Mailing-List: contact cygwin-help@cygwin.com; run by ezmlm Precedence: bulk List-Id: List-Unsubscribe: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: cygwin-owner@cygwin.com Mail-Followup-To: cygwin@cygwin.com Delivered-To: mailing list cygwin@cygwin.com 2010/1/25 Corinna Vinschen: > On Jan 24 16:43, Gordon Messmer wrote: >> On 01/08/2010 06:59 AM, Corinna Vinschen wrote: >> >I can't reproduce this one, but I can reproduce the other problem >> >with pubkey authentication reported =A0in this thread: >> ... >> >> I appreciate the time you took to explain this problem. =A0I've been >> working on it for a while, and still can't get it right. >> >> >If you're running in a domain, then the account running the sshd service >> >must be a member of the domain as well. =A0Instead of creating a local >> >cyg_server account, you must create a domain account called cyg_server >> >with the specific rights required to create a user token, add it to the >> >/etc/passwd file of the machine on which you want to install sshd, and >> >*then* run ssh-host-config on that machine. >> >> I've created a "cyg_server" account on my domain controller and >> added it to the password file using: >> >> mkpasswd -d -u cyg_server >> /etc/passwd >> >> First I tried granting the required permissions manually in the >> domain policy. =A0When that didn't work, I used "editrights" as in >> cygwin-service-installation-helper.sh to set the rights in the local >> policy. =A0As far as I can tell, I get identical results. >> >> Rights during my most recent test were: >> >> $ editrights.exe -l -u cyg_server >> SeAssignPrimaryTokenPrivilege >> SeCreateTokenPrivilege >> SeTcbPrivilege >> SeServiceLogonRight >> SeDenyRemoteInteractiveLogonRight > > The cyg_server user is hopefully in the Administrators group... > > Here's what I did. =A0I created cyg_server as admin account in the domain, > then I created a global policy which adds the cyg_server user to the > following user rights: > > =A0Act as part of the operating system (SeTcbPrivilege) > =A0Create a token object =A0 =A0 =A0 =A0 =A0 =A0 =A0 (SeCreateTokenPrivil= ege) > =A0Replace a process level token =A0 =A0 =A0 (SeAssignPrimaryTokenPrivile= ge) > > At last I made sure the global policy gets propagated to all domain > machines. =A0That's all. =A0From this time on I could use the domain > cyg_sever user on all my domain member machines, assuming I added it to > /etc/passwd before starting ssh-host-config. Can we add this to the FAQ please. How to setup sshd for mixed local/domain accounts? ... --=20 Reini Urban http://phpwiki.org/ http://murbreak.at/ -- Problem reports: http://cygwin.com/problems.html FAQ: http://cygwin.com/faq/ Documentation: http://cygwin.com/docs.html Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple