X-Recipient: archive-cygwin AT delorie DOT com
DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:mime-version:references:in-reply-to:from:date
	:message-id:subject:to:content-type; q=dns; s=default; b=loeIcOr
	VzOihX15mOXpj+xZtnloZJv58vRP9OUYRHIiOaW1k+jehS3R0hD5Jbxzar+b0ucG
	1gubum2Xfe839N0A/W8RambvwMkF+j5aTyAIuvH+jR0/USg4bx7BeNOQxxB2e6CN
	xSyy20pn+c/ggSWlxxjoNAxdtXXFZIgZa9GU=
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:mime-version:references:in-reply-to:from:date
	:message-id:subject:to:content-type; s=default; bh=3jpAd8vKV1I9R
	EtW6mXIut4d2EE=; b=jmU0FJXoQQPAFAWSgdEpk5tBqRPhHSqGHyCJzyZlsKQ0p
	atiFJt23aVwrUb2t14ovWjMTu31lUGaYAjF6s99Lop6pmNup3R0MV7j3GY97uGYx
	Qcz/+eFBYAgQzBpdz39J8iF2sum3lG9Q0XcmjAoTFCq3LWtYxMTsrSiytKG99E=
Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm
List-Id: <cygwin.cygwin.com>
List-Subscribe: <mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive: <http://sourceware.org/ml/cygwin/>
List-Post: <mailto:cygwin AT cygwin DOT com>
List-Help: <mailto:cygwin-help AT cygwin DOT com>, <http://sourceware.org/ml/#faqs>
Sender: cygwin-owner AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
Delivered-To: mailing list cygwin AT cygwin DOT com
Authentication-Results: sourceware.org; auth=none
X-Spam-SWARE-Status: No, score=-2.6 required=5.0 tests=BAYES_00,FREEMAIL_FROM,RCVD_IN_DNSWL_LOW,SPF_PASS autolearn=ham version=3.3.2 spammy=account!, management, you!
X-HELO: mout.gmx.com
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=mail.com;	s=dbd5af2cbaf7; t=1548695944;	bh=A0NI2VYHeey55iNOilx2OK9lSZa/Zz+CWlutido0/v4=;	h=X-UI-Sender-Class:References:In-Reply-To:From:Date:Subject:To;	b=ALS1MDn5UgbrBXELDxuR/Mjo+XXffSaw97pXTjZyiFCRK8kKL/5ei313KG5umKY0R	 UaaKI0hgzhAM/a4SDMIk6fUE3NZhz+sgQx+5coe12yFUxacZAd97N6UUFFCrELgOqd	 hUgQRh49Dvu6JBEgAVcP89BLyEjsBUnJgvJlchSA=
X-UI-Sender-Class: 214d933f-fd2f-45c7-a636-f5d79ae31a79
MIME-Version: 1.0
References: <1690850474 DOT 834980 DOT 1548391349102 DOT ref AT mail DOT yahoo DOT com> <1690850474 DOT 834980 DOT 1548391349102 AT mail DOT yahoo DOT com> <d6f98cbc-bd2f-1c13-98bb-7ef42c000115 AT baur-itcs DOT de> <CANV9t=RKVWPfiqNMbnSgevTBvm8S1G-oFWK3BEisdgaSGz2OzA AT mail DOT gmail DOT com> <20190125174833 DOT GA1710 AT zebra> <CANV9t=Q2ZRqVD99a+qdVTet1hn_aM6RY5B2Cm1oc0E4Lf9x2ig AT mail DOT gmail DOT com> <20190128095947 DOT GN3912 AT calimero DOT vinschen DOT de> <CANV9t=Tk=k5ohYw5TcvYy7TrWUBOTA4JXqE=75H+6n_-o53ZSQ AT mail DOT gmail DOT com> <20190128165227 DOT GQ3912 AT calimero DOT vinschen DOT de>
In-Reply-To: <20190128165227.GQ3912@calimero.vinschen.de>
From: Bill Stewart <bstewart AT iname DOT com>
Date: Mon, 28 Jan 2019 10:18:49 -0700
Message-ID: <CANV9t=QMcDWWKY=Qqe-1jdbE1SNJ+uwGuV02uoqAYwMj85Ts8w@mail.gmail.com>
Subject: Re: sshd permits logon using disabled user?
To: cygwin AT cygwin DOT com, Bill Stewart <bstewart AT iname DOT com>
Content-Type: text/plain; charset="UTF-8"
X-IsSubscribed: yes

On Mon, Jan 28, 2019 at 9:52 AM Corinna Vinschen
<corinna-cygwin AT cygwin DOT com> wrote:
>
> On Jan 28 08:02, Bill Stewart wrote:
> > On Mon, Jan 28, 2019 at 2:59 AM Corinna Vinschen
> > <corinna-cygwin AT cygwin DOT com> wrote:
> >
> > > Can you please test again with the latest snapshot from
> > > https://cygwin.com/snapshots/?  The new S4U authentication method
> > > used in this snapshot automatically applies the Windows account rules so
> > > in my testing the patch I applied originally is not required anymore.
> > > Consequentially I disabled it to rely fully on the Windows function's
> > > behaviour.  Can you test this, too, please, just to be sure?
> >
> > Thank you Corinna; I will test.
> >
> > Will the S4U authentication work on standalone (non domain-joined)
> > machines also?
>
> It uses MsV1_0 S4U on standalone workstations, Kerberos S4U on domain
> meber machines with fallback to MsV1_0 under some circumstances.

Hi Corinna,

This is great that the service can run using the SYSTEM account! It
greatly simplifies management.

I tested and it worked as expected.

Thank you!

Bill

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple