X-Recipient: archive-cygwin AT delorie DOT com
X-SWARE-Spam-Status: No, hits=-2.0 required=5.0 	tests=AWL,BAYES_00,SARE_MSGID_LONG40,SPF_PASS
X-Spam-Check-By: sourceware.org
MIME-Version: 1.0
In-Reply-To: <20100125110328.GJ2402@calimero.vinschen.de>
References: <aed63dd41001071133x630df0d8p6ad66d9b66d4fc03 AT mail DOT gmail DOT com> 	 <20100108145957 DOT GB23992 AT calimero DOT vinschen DOT de> 	 <4B5CE93D DOT 9050603 AT eburg DOT com> 	 <20100125110328 DOT GJ2402 AT calimero DOT vinschen DOT de>
Date: Mon, 25 Jan 2010 12:11:43 +0100
Message-ID: <6910a61001250311o6a0f687cp79909c70166fb174@mail.gmail.com>
Subject: Re: Why you can't load ws2_32.dll (was Re: Can't use key  	authentication on x64 Server 2003 R2)
From: Reini Urban <rurban AT x-ray DOT at>
To: cygwin AT cygwin DOT com
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
X-IsSubscribed: yes
Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm
Precedence: bulk
List-Id: <cygwin.cygwin.com>
List-Unsubscribe: <mailto:cygwin-unsubscribe-archive-cygwin=delorie DOT com AT cygwin DOT com>
List-Subscribe: <mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive: <http://sourceware.org/ml/cygwin/>
List-Post: <mailto:cygwin AT cygwin DOT com>
List-Help: <mailto:cygwin-help AT cygwin DOT com>, <http://sourceware.org/ml/#faqs>
Sender: cygwin-owner AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
Delivered-To: mailing list cygwin AT cygwin DOT com

2010/1/25 Corinna Vinschen:
> On Jan 24 16:43, Gordon Messmer wrote:
>> On 01/08/2010 06:59 AM, Corinna Vinschen wrote:
>> >I can't reproduce this one, but I can reproduce the other problem
>> >with pubkey authentication reported =A0in this thread:
>> ...
>>
>> I appreciate the time you took to explain this problem. =A0I've been
>> working on it for a while, and still can't get it right.
>>
>> >If you're running in a domain, then the account running the sshd service
>> >must be a member of the domain as well. =A0Instead of creating a local
>> >cyg_server account, you must create a domain account called cyg_server
>> >with the specific rights required to create a user token, add it to the
>> >/etc/passwd file of the machine on which you want to install sshd, and
>> >*then* run ssh-host-config on that machine.
>>
>> I've created a "cyg_server" account on my domain controller and
>> added it to the password file using:
>>
>> mkpasswd -d -u cyg_server >> /etc/passwd
>>
>> First I tried granting the required permissions manually in the
>> domain policy. =A0When that didn't work, I used "editrights" as in
>> cygwin-service-installation-helper.sh to set the rights in the local
>> policy. =A0As far as I can tell, I get identical results.
>>
>> Rights during my most recent test were:
>>
>> $ editrights.exe -l -u cyg_server
>> SeAssignPrimaryTokenPrivilege
>> SeCreateTokenPrivilege
>> SeTcbPrivilege
>> SeServiceLogonRight
>> SeDenyRemoteInteractiveLogonRight
>
> The cyg_server user is hopefully in the Administrators group...
>
> Here's what I did. =A0I created cyg_server as admin account in the domain,
> then I created a global policy which adds the cyg_server user to the
> following user rights:
>
> =A0Act as part of the operating system (SeTcbPrivilege)
> =A0Create a token object =A0 =A0 =A0 =A0 =A0 =A0 =A0 (SeCreateTokenPrivil=
ege)
> =A0Replace a process level token =A0 =A0 =A0 (SeAssignPrimaryTokenPrivile=
ge)
>
> At last I made sure the global policy gets propagated to all domain
> machines. =A0That's all. =A0From this time on I could use the domain
> cyg_sever user on all my domain member machines, assuming I added it to
> /etc/passwd before starting ssh-host-config.

Can we add this to the FAQ please.

How to setup sshd for mixed local/domain accounts?
...
--=20
Reini Urban
http://phpwiki.org/           http://murbreak.at/

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple