X-Recipient: archive-cygwin AT delorie DOT com
X-Spam-Check-By: sourceware.org
Date: Tue, 23 Jun 2009 12:08:26 +0200
From: Corinna Vinschen <corinna-cygwin AT cygwin DOT com>
To: cygwin AT cygwin DOT com
Subject: Re: [1.7] sshd dc problem
Message-ID: <20090623100826.GG5039@calimero.vinschen.de>
Reply-To: cygwin AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
References: <6910a60906220848l6470a9cl44094f8bd93555ea AT mail DOT gmail DOT com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <6910a60906220848l6470a9cl44094f8bd93555ea@mail.gmail.com>
User-Agent: Mutt/1.5.19 (2009-02-20)
Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm
Precedence: bulk
List-Id: <cygwin.cygwin.com>
List-Unsubscribe: <mailto:cygwin-unsubscribe-archive-cygwin=delorie DOT com AT cygwin DOT com>
List-Subscribe: <mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive: <http://sourceware.org/ml/cygwin/>
List-Post: <mailto:cygwin AT cygwin DOT com>
List-Help: <mailto:cygwin-help AT cygwin DOT com>, <http://sourceware.org/ml/#faqs>
Sender: cygwin-owner AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
Delivered-To: mailing list cygwin AT cygwin DOT com

On Jun 22 17:48, Reini Urban wrote:
> Starting the laptop at home, without PDC connection works. I can properly login.
> But ssh to this box fails with -1 = initgroups (URBANR, 10513)
> This is without cyglsa
> 
> $ /usr/sbin/sshd -d -D
>    25  592959 [main] sshd 5208 fhandler_tty_slave::write: (680): tty
> output_mutex: acquired
> debug1: temporarily_use_uid: 17966/10513 (e=18/544)
>    24  592983 [main] sshd 5208 fhandler_tty_slave::write: (723): tty
> output_mutex released
> 2243125 2836108 [main] sshd 5208 seterrno_from_win_error:
> /ext/build/netrel/src/cygwin-1.7.0-50/winsup/cygwin/sec_auth.cc:195
> windows error 1355
> 45131 2881239 [main] sshd 5208 geterrno_from_win_error: unknown
> windows error 1355, setting errno to 13
>    25 2881264 [main] sshd 5208 __set_errno: void
> seterrno_from_win_error(const char*, int, DWORD):319 val 13
>  1785 2883049 [main] sshd 5208 seterrno_from_win_error:
> /ext/build/netrel/src/cygwin-1.7.0-50/winsup/cygwin/sec_auth.cc:256
> windows error 2221
>    34 2883083 [main] sshd 5208 geterrno_from_win_error: unknown
> windows error 2221, setting errno to 13
>    23 2883106 [main] sshd 5208 __set_errno: void
> seterrno_from_win_error(const char*, int, DWORD):319 val 13
>    46 2883152 [main] sshd 5208 initgroups32: -1 = initgroups (URBANR, 10513)
> 
> $ id URBANR
> uid=17966(URBANR) gid=10513(apache) groups=10513(apache)
> 
> error 1355: DcGetDcName(PDC_REQUIRED) call failed
> error 2221: UserGetLocalGroups failed
> 
> I should be able to login with pubkey to my box with sshd when windows
> lets me in also.

That's easier said than done.

Apparently your laptop is configured to allow using cached credentials
which are used by the machine if it can't connect to a DC.  The token
information (groups/privileges) is also cached somewhere in a
non-documented storage.  Whatever Windows is using, it's not accessible
for Cygwin.  At least I don't know how to do it.

If Cygwin can't connect one of the DCs, then I don't get the group
information for the given domain account.  If I have no group
information, I can only generate a broken user token.  The problem
here is that initgroups() is called before setuid().  If setuid()
would always be called first, we already would have a token and could
fetch the groups from there, but that's idle wishing.

So, for the time being, the workaround to get a user token is thus:

1. I'll patch Cygwin to ignore the fact that the group information
   couldn't be fetched from the server.

2. Either you're happy with a restricted token, or you use the new logon
   method 3 as described in
   http://cygwin.com/1.7/cygwin-ug-net/ntsec.html#ntsec-setuid-overview
   This results in getting a token right from Windows based on the
   cached credentials.


Corinna

-- 
Corinna Vinschen                  Please, send mails regarding Cygwin to
Cygwin Project Co-Leader          cygwin AT cygwin DOT com
Red Hat

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple