X-Recipient: archive-cygwin AT delorie DOT com
X-SWARE-Spam-Status: No, hits=-1.9 required=5.0 	tests=AWL,BAYES_00,SARE_MSGID_LONG40,SPF_PASS
X-Spam-Check-By: sourceware.org
MIME-Version: 1.0
In-Reply-To: <20090623100826.GG5039@calimero.vinschen.de>
References: <6910a60906220848l6470a9cl44094f8bd93555ea AT mail DOT gmail DOT com> 	 <20090623100826 DOT GG5039 AT calimero DOT vinschen DOT de>
Date: Wed, 24 Jun 2009 10:45:25 +0200
Message-ID: <6910a60906240145i5a95cba9s948b181158a960e9@mail.gmail.com>
Subject: Re: [1.7] sshd dc problem
From: Reini Urban <rurban AT x-ray DOT at>
To: cygwin AT cygwin DOT com
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
X-IsSubscribed: yes
Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm
Precedence: bulk
List-Id: <cygwin.cygwin.com>
List-Unsubscribe: <mailto:cygwin-unsubscribe-archive-cygwin=delorie DOT com AT cygwin DOT com>
List-Subscribe: <mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive: <http://sourceware.org/ml/cygwin/>
List-Post: <mailto:cygwin AT cygwin DOT com>
List-Help: <mailto:cygwin-help AT cygwin DOT com>, <http://sourceware.org/ml/#faqs>
Sender: cygwin-owner AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
Delivered-To: mailing list cygwin AT cygwin DOT com

2009/6/23 Corinna Vinschen:
> On Jun 22 17:48, Reini Urban wrote:
>> Starting the laptop at home, without PDC connection works. I can properl=
y login.
>> But ssh to this box fails with -1 =3D initgroups (URBANR, 10513)

>> error 1355: DcGetDcName(PDC_REQUIRED) call failed
>> error 2221: UserGetLocalGroups failed
>>
>> I should be able to login with pubkey to my box with sshd when windows
>> lets me in also.
>
> That's easier said than done.
>
> Apparently your laptop is configured to allow using cached credentials
> which are used by the machine if it can't connect to a DC. =A0The token
> information (groups/privileges) is also cached somewhere in a
> non-documented storage. =A0Whatever Windows is using, it's not accessible
> for Cygwin. =A0At least I don't know how to do it.

Is it possible to detect that one is logged in with a cached
credential at least?
Then the failing initgroups DcGetDcName(PDC_REQUIRED) can be made non-fatal.
Or maybe there's a PDC_OPTIONAL

> If Cygwin can't connect one of the DCs, then I don't get the group
> information for the given domain account. =A0If I have no group
> information, I can only generate a broken user token. =A0The problem
> here is that initgroups() is called before setuid(). =A0If setuid()
> would always be called first, we already would have a token and could
> fetch the groups from there, but that's idle wishing.
>
> So, for the time being, the workaround to get a user token is thus:
>
> 1. I'll patch Cygwin to ignore the fact that the group information
> =A0 couldn't be fetched from the server.

Great!

> 2. Either you're happy with a restricted token,

Restricted token is okay for me.

>  or you use the new logon
> =A0 method 3 as described in
> =A0 http://cygwin.com/1.7/cygwin-ug-net/ntsec.html#ntsec-setuid-overview
> =A0 This results in getting a token right from Windows based on the
> =A0 cached credentials.

I'll try password auth then, thanks
--=20
Reini Urban
http://phpwiki.org/              http://murbreak.at/

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple