DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:date:from:to:subject:message-id:reply-to
	:references:mime-version:content-type:in-reply-to; q=dns; s=
	default; b=SDHomipu7vOEqS3gt3Vp63T2ljCPY7Vs3kZQ48LndXjcDRW530LrY
	w3Es3Q235/rmkHBqgvEPuFYRoCQVo5ZIMHPC3uDqxYex6AKnnzcb3dSfXhgWmzqS
	fhGVNPnPr02G486ZgY9jjNJGt0IjAbMxtvWt/BRZkzRVrsGF/FU1sY=
Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm
Sender: cygwin-owner AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
Date: Wed, 13 Feb 2019 13:25:09 +0100
From: Corinna Vinschen <corinna-cygwin AT cygwin DOT com>
To: cygwin AT cygwin DOT com
Subject: Re: sshd: computer name's case must match?
Message-ID: <20190213122509.GL3718@calimero.vinschen.de>
Reply-To: cygwin AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
References: <CANV9t=QxA_FW-3OCZuYFJpxrekbO8Yc-WsnxGLiyc0Bqz=fPUw AT mail DOT gmail DOT com> <20190213103200 DOT GK3718 AT calimero DOT vinschen DOT de>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha256;	protocol="application/pgp-signature"; boundary="kjpMrWxdCilgNbo1"
Content-Disposition: inline
In-Reply-To: <20190213103200.GK3718@calimero.vinschen.de>
User-Agent: Mutt/1.10.1 (2018-07-13)

--kjpMrWxdCilgNbo1
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Feb 13 11:32, Corinna Vinschen wrote:
> On Feb 12 16:07, Bill Stewart wrote:
> > Good day,
> >=20
> > I am testing sshd using the cygwin1.dll 3.x version (run as SYSTEM -
> > S4U logon - works great!).
> >=20
> > One thing I've noticed is that if I use ssh log onto a remote
> > domain-joined machine (e.g., connect with COMPUTER+localname), the
> > 'COMPUTER' prefix must be uppercase - if I specify
> > 'computer+LocalName', the user is unknown.
> >=20
> > This doesn't seem to be the case if I change the username's case -
> > 'COMPUTER+localname' also works.
> >=20
> > Is this by design or by accident?
>=20
> sshd checks usernames case-sensitive against their name stored in the
> user DB.  The problem that you can use differently cased usernames
> here is that the Windows function for checking the name is case-
> insensitive, so it takes the username any way it comes in and
> sshd eventually checks against the wrongly cased name.
>=20
> I fixed that partially in Cygwin by making sure that the account name
> stored in the internal passwd/group info is stored case-correct:
> https://cygwin.com/git/?p=3Dnewlib-cygwin.git;a=3Dcommitdiff;h=3D9a3cc77b=
2afc
>=20
> So if you have a domain DOMAIN and a user xyz
>=20
> $ getent passwd DoMaIn+XyZ
>=20
> Prior to the above patch  it returned
>=20
>   DOMAIN+XyZ:...
>=20
> Now it will return
>=20
>   DOMAIN+xyz:...
>=20
> The problem is this:  If the account is from another domain than the
> local machine or the machine domain, the call to LookupAccountSid to fix
> the account name won't fix the account name.
>=20
> Apparently the account name is cached on the local machine in exactly
> the same spelling as has been used when asking for the account the first
> time.  I still have to find a way to workaround that.

That should be fixed now as well.  I uploaded new developer snaps to
https://cygwin.com/snapshots/  and will generate YA test release later
today.


Corinna

--=20
Corinna Vinschen
Cygwin Maintainer

--kjpMrWxdCilgNbo1
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEoVYPmneWZnwT6kwF9TYGna5ET6AFAlxkDKUACgkQ9TYGna5E
T6BK+w//bZumh25W6dY4BQe8YAUNhIkLztVDYlLgt+NqS45o96xvTIC4DFg4aGTW
zgdAfKXVqH90AezLPctesFbFB8pdRbjcNAEuXG/ZJzZqK/7geNtEgHLRPLCd4hMk
hBlsV8wy8PS599YUzqvwCIo8QkgUGjax+NAZOWpDQhcMeM2krms0J7gRi6AYurG3
U9XjL6cqF7tw1sDNlC0kvf0tZP9EI3yYyb7k46nVkcGvcTXCiS8UEMP90R9LL4Rc
S7lHvJg0BO3UjEuj1okda28cb/fMU14rb89TZH4JVeQwZD3CicTRn9BaCaEegzTv
QJOMhKiDb+dUQh9fInGf4UtgHZL6pmkJAyXH2O38eQf8cUFqrvzJH2nEj/jPwlyr
nPdSghMeAjyXIHR8zFZP8zh423i3r0Mq9U4zcRnjjkDykvHLnzv51FDnGx7wh9A9
fK50Z5RnspAlamGGbayMY2Y4qZtta29oq6u71mhklxphIyFYoQ61NztJxdjB+vvS
LfENYL3pFmTPnmbV/DZdb3lMOacw1zytY2k2dqptKmZX/VM/X5QIbbo5M76i0Eof
2uE02ACtjP2tYyvlzWsC3tBKAWJxb7eBZnD+VFLh3KwBdnRYu0kFqoJwg5So/Muq
5R7vDC+XnoNUoBbe4t2mJrdIb448bF60bWyEWH9FbNI4heS+DdM=
=8sfl
-----END PGP SIGNATURE-----

--kjpMrWxdCilgNbo1--