X-Recipient: archive-cygwin AT delorie DOT com
DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:date:from:to:subject:message-id:reply-to
	:references:mime-version:content-type:in-reply-to; q=dns; s=
	default; b=KwCwh4wLRuoI3KAU2hN4qiNt+xkfSmvCBEOV9pDH3Hio/0nQRfYmE
	KyE6xZhNH1kiiQz6IIIIiYKJcWlztdLHgZP/YUQu8HzCoRtEJgnkA/631WHFMDvC
	2VcDBp1mVEwOkXV7bqQuiXa4DNpMA1+f4snpo4WnEESSQkySl9eROo=
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:date:from:to:subject:message-id:reply-to
	:references:mime-version:content-type:in-reply-to; s=default;
	 bh=DQYtdr5Xnt9kHs2zBxMhJr+gUWs=; b=ODNQW5e3oRsVvE25X+X9pOMzGgob
	ytwr0mCPdPLE8zGJ+EsWEYTN9H3YUNoWQBOacdCytMyjkFgUwb+ypFewB2Y6qoFb
	vO83DcjItNDGYA3s9Mv73bU/dGCd58FgvABUkDR3/MeePgW1OzfhcMuRHR3JpIC1
	N4SpENVbHgcMlzQ=
Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm
List-Id: <cygwin.cygwin.com>
List-Subscribe: <mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive: <http://sourceware.org/ml/cygwin/>
List-Post: <mailto:cygwin AT cygwin DOT com>
List-Help: <mailto:cygwin-help AT cygwin DOT com>, <http://sourceware.org/ml/#faqs>
Sender: cygwin-owner AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
Delivered-To: mailing list cygwin AT cygwin DOT com
Authentication-Results: sourceware.org; auth=none
X-Virus-Found: No
X-Spam-SWARE-Status: No, score=-101.6 required=5.0 tests=AWL,BAYES_00,GOOD_FROM_CORINNA_CYGWIN,KAM_LAZY_DOMAIN_SECURITY,RCVD_IN_DNSWL_LOW,SPF_HELO_PASS autolearn=ham version=3.3.2 spammy=Problems, stemming, Those, contrast
X-HELO: drew.franken.de
Date: Sun, 12 Feb 2017 12:09:46 +0100
From: Corinna Vinschen <corinna-cygwin AT cygwin DOT com>
To: cygwin AT cygwin DOT com
Subject: Re: Problems with ssh-host-config on Windows 10
Message-ID: <20170212110946.GD11666@calimero.vinschen.de>
Reply-To: cygwin AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
References: <CAOTD34YFY-79CN8vfrJxLQHk=2SQOa_AQyzsqOG7Wxy0=F9LWw AT mail DOT gmail DOT com> <20170202130806 DOT GC4310 AT calimero DOT vinschen DOT de> <CAOTD34ZEgZQ-iOPwtQEByyFs++FcqC9CXmbOgbeYWWfBeQdnWA AT mail DOT gmail DOT com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha256;	protocol="application/pgp-signature"; boundary="uZ3hkaAS1mZxFaxD"
Content-Disposition: inline
In-Reply-To: <CAOTD34ZEgZQ-iOPwtQEByyFs++FcqC9CXmbOgbeYWWfBeQdnWA@mail.gmail.com>
User-Agent: Mutt/1.7.1 (2016-10-04)

--uZ3hkaAS1mZxFaxD
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Feb  6 10:51, Erik Bray wrote:
> On Thu, Feb 2, 2017 at 2:08 PM, Corinna Vinschen
> <corinna-cygwin AT cygwin DOT com> wrote:
> > On Feb  2 12:19, Erik Bray wrote:
> >> The problem seems to be stemming from some assumptions in:
> >> /usr/share/csih/cygwin-service-installation-helper.sh
> >>
> >> It creates the "privileged user" (in my case with the default name
> >> cyg_server) with `net user`, including the SAM comment entry:
> >>
> >> /comment:'<cygwin home=3D"/var/empty" shell=3D"/bin/false"/>'
> >>
> >> Shortly after it calls:
> >>
> >> passwd -e "${csih_PRIVILEGED_USERNAME}"
> >>
> >> and this fails with:
> >>
> >> Warning: Setting password expiry for user 'desktop-mk2koav+cyg_server'=
 failed!
> >>
> >> This happens because this is a fresh Cygwin install with all the
> >> default settings in /etc/nsswitch.conf.  In particular, no passwd
> >> entry is found for the cyg_server user unless I explicitly add "local"
> >> to db_enum.  Furthermore, the SAM comment entry is not read correctly
> >> without db_home: desc and db_shell: desc.  In summary, I had to edit
> >> /etc/nsswitch.conf to:
> >>
> >> passwd db
> >> db_enum: local
> >> db_home: desc
> >> db_shell: desc
> >
> > The assumption in ssh-host-config is that your nsswitch.conf settings
> > are already correct.  It's kind of tricky to set up accounts and stuff
> > in a not yet configured environment.
>=20
> I think that's reasonable, but the question is what is "correct"?  Any
> valid settings for nsswitch.conf could be "correct" for different use
> cases, whereas the cygwin-service-installation-helper.sh script seems
> to have some very specific requirements that don't match the default
> configuration, or even many non-default configurations (especially
> w.r.t. db_home and db_shell).

The script depends on what's returned by tools like getent, mkpasswd and
mkgroup.  Those in turn depend on the nsswitch.conf settings.  If
there's a bug in there, I'd be grateful for a fix.  Maybe at one point
it should call mkpasswd instead of getent, the former not depending on
db_enum, in contrast to the latter?

Or maybe the default for db_enum is the actual problem?  Maybe it should
be set to cache + builtin + local accounts?


Corinna

--=20
Corinna Vinschen                  Please, send mails regarding Cygwin to
Cygwin Maintainer                 cygwin AT cygwin DOT com
Red Hat

--uZ3hkaAS1mZxFaxD
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQIcBAEBCAAGBQJYoEJ6AAoJEPU2Bp2uRE+g7UMP/2RMv9Q0gX9p79Ljf7FiwE+b
LO21McZufdgAr3ZZzOm3I+p2OPzgB7CXgVQvoX0rpoPT93u21rdNj0Z+aVgnUxz1
F5S3qA5U9UVvhtoC8fu9GG73l0A76K67P4qHJ1urY1WZ46tPz7mH4JBzjWR9Ip7C
g2KrBSwS8lA4yTjGtL7xKD87KzFdLHgxn4M6Um0L8mjnr1BQO6KbwZjvIEcBG4zF
1Po5bIE7mC8c7CnKq7IUtIoIAj4H+eUSio087pxCO7FYFERh9AjwKr0GEem7UC1h
zEEjOwBNQnRdkqFnNRKSGSHodjcevyVfbXQWCJ5T69wKggRJ/WaDTzDQx+VD/vYr
zaDAYSbFOx32xBxxnfOCfe/+zt6EPZhz7z54frVzcIuXCkeEzahGRt1yidb2hs28
b+JWxHIOlST66rIXHGaQg8dk0WxBrljjzhm7vg13N2Y1Cky3mHQsLl89v93YKQAs
aXRTobPS/Ee2iFuRpvtXiy3ATQ+veH7OCm+SXBqDUfV7bZdzz8/+Cb3kX6xg8UbW
EAnGqKOJ56i2y5OhJXZEj5vHF3gZ+3YHN4mvM2o9cIYr2YHkkhB6+R60WNueUs23
IKdQjyBL1QIOSkq2RA2Ul3sZzKE9SFYUOEcaTOJOV0Y0Xsyh0H5tthbZerLm+dQv
+dQGAGGqXBuQEPemCLv6
=kRxj
-----END PGP SIGNATURE-----

--uZ3hkaAS1mZxFaxD--