DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:mime-version:date:message-id:subject:from:to
	:content-type; q=dns; s=default; b=C7G2fCP5Iw9C53l/2GbHPQcITb34Z
	XTA693oPRPB74VMOuYO3dkjGx9pvDZC2K/bmKuQ/IdZ0vKTaD8uXNtMHJ9SmTVBg
	JwiccwAiNgpB4bGBHg844v+Ul/kZ2hemCfyj4Kkan9m2Gp6gVwz355OZdb3nP84u
	6uv//+0chxbCNI=
Mailing-List: contact cygwin-help@cygwin.com; run by ezmlm
Sender: cygwin-owner@cygwin.com
Mail-Followup-To: cygwin@cygwin.com
MIME-Version: 1.0
Date: Wed, 11 Mar 2015 20:57:01 +0000
Message-ID: <CALTCyaSFWfcCvTbv5XVR4N6sEpuMrvy91EtGD1R0ACuArjAvdg@mail.gmail.com>
Subject: Local accounts can't login via ssh, but domain accounts can
From: Rodney Beede <cygwin@rodneybeede.com>
To: cygwin@cygwin.com
Content-Type: text/plain; charset=UTF-8

I am having an issue where domain accounts can login to my Cygwin
OpenSSH server, but local user accounts cannot.

I have tested on two separate computers with the following setup:
     Windows 7 64-bit (both Ultimate and Enterprise editions) w/SP1

     Cygwin -  setup-x86_64.exe setup-version 2.870 (64-bit)

     Cygwin version:   CYGWIN_NT-6.1 1.7.35(0.287/5/3) 2015-03-04 12:09

     OpenSSH_6.7p1, OpenSSL 1.0.1k 8 Jan 2015

I ran the following (as cygwin shell with Run as admin)
     ssh-host-config

         yes to StrictModes

         yes to privilege separation

         yes to local account sshd

         yes to install as service

         left blank value of CYGWIN

         no to different name

         yes to new privileged user account 'machine_name\cyg_server'

         Provided a password

         net start sshd

Verified I can login with a domain username and password no problem.

I create a local user account (not admin) and attempt to login.

Access denied.

"To many authentication failures for invalid user rodtest from
192.168.145.1 port 50338 ssh2"  (also seen in Windows event viewer).

I try changing the local user to be in the Administrators group.

Same error.

I use mkpasswd -l > /etc/passwd
I use mkgroup -l > /etc/group

Same issue.  Domain users can still login, but local user accounts cannot.

I also tried "fixing" the /etc/passwd and /etc/group ownership and
permissions so cyg_server owns them.   No change.

The local user can login to Windows via RDP.

So to recap I can login with *domain* accounts via ssh, but I cannot
login with *local* user accounts.   cyg_server is a local user account
not a domain account.

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple