DMARC-Filter: OpenDMARC Filter v1.4.1 sourceware.org D10153858400
Message-ID: <97042d57-fa36-da97-9c05-493a2c645991@onespin.com>
Date: Wed, 10 Nov 2021 16:28:05 +0100
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101
 Thunderbird/91.3.0
Subject: Re: Problem with ssh(d)
Content-Language: en-US
To: Bill Stewart <bstewart AT iname DOT com>, cygwin AT cygwin DOT com
References: <2dfb0a68-b9e3-f9fb-817b-651fec02adf5 AT onespin DOT com>
 <CANV9t=QRzS_ko6S6+G6oW6hRGxMUzCoXJ0825c7YeckfBqS57Q AT mail DOT gmail DOT com>
From: "Strasser, Dominik (DI SW ICS ICV)" <dominik DOT strasser AT onespin DOT com>
In-Reply-To: <CANV9t=QRzS_ko6S6+G6oW6hRGxMUzCoXJ0825c7YeckfBqS57Q@mail.gmail.com>
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?VjdYdmJPOHZzU0Y3MzRNRnNLam9TeXRHRExFcFFSVUVueXNQMlhqY1cycEI5?=
 =?utf-8?B?aGtYMTRqaUx3eTVTMytmMFZkVWZGWkZIU1FCRTNGemJhckpmNzR6b2w1Qlp2?=
 =?utf-8?B?L3UreDY5b1ZGL3hzRmhzc240WXowMzBHaCs5RWl0T1k0aTlBME5nT0FDdHIr?=
 =?utf-8?B?VHlkaUlLLy8vbjJ6empDWWsweUtlVDllY250SzdYbVV0Tks4QzBRbWtveDhp?=
 =?utf-8?B?NWFrUXhOd1dBRXoyb1ZTTU44TEZ4NEhIWmVWdWEvbHY3enRXWDNwdmhKcW9q?=
 =?utf-8?B?dUQvZ0tPYjNaNGltMFNQTWZzOTcydVVaZlZ0VFVLOENwbjkzS09lbjVqaUxa?=
 =?utf-8?B?NWhHUDliM2Q5RzlkVHRtQU8vOW1YeWxmT0pKdGxOaVlNZmNqTkNBSWx3MGox?=
 =?utf-8?B?TkQzWjVzeXUwYU1COERiN0VaMDVESndUVFp5VkF4eHVMN0llS3VkbVdra3Jv?=
 =?utf-8?B?RkZjZzl1UjFNYXZoUDBacDNuK0d2YlFFZFE0cExQYkdWZ0pTQ2dxclVoTSs5?=
 =?utf-8?B?dytQVUN5dGIzUkRsaDlrbzROMXR2ZHZKOG5pbmQ3Z1lzOVNBR3NDYmU3NFBq?=
 =?utf-8?B?WHE3Y3MydFJxRjdaMDZ4bWNrbVREQlp3Mkd2bTRSNkQxUHA2ejJaQkNodG1u?=
 =?utf-8?B?MFM1TStWYTZ3UWNKM0gyQkxYQmxKUlVFS1IrbmZuWlI2UXNPanRYUmpWRjlq?=
 =?utf-8?B?Rk8zUlZkamlUNHlpZXU4ekpselRxemNRaXpaYzNYdW5ZYnRnK2M2NjZXeTZ2?=
 =?utf-8?B?eVJPRURQaW8ydGhxVEhZRmJHclA0eTRCM2VJVExVQTBQQ0ZoY1dPbVFTZmZF?=
 =?utf-8?B?R2hidkdpV1RLNUR6RUdpZE1TSUxPQXpNbVByMGgzRk1ERFNrYTlNckYwR3Z4?=
 =?utf-8?B?dElsQ1JNbWlLdWhsdTBrOG92UVRMM3dFci9PczEvMGgyNzdhbEhCOHUrL0ho?=
 =?utf-8?B?U0FuVWk5V282aTVtcHpGWlNtWUNIRklhc3I2UWs1Mm1PRFY1MHp3Y3dLbGFs?=
 =?utf-8?B?QzY0WWRXdk1DRitycG9JdGpTeVc5YVMxZXZjYlpRVVNqM2crcWViNVR4ZmpV?=
 =?utf-8?B?NFZ0WEUyR0R2K3IvbFZuMGIzNGVoS3JwQ0ZoUURvQWliL2FuVEtWQUVhd0J5?=
 =?utf-8?B?ZmRQcjRmdmpIM2E1dmRBSkptNnlqU3NLdk00KzNpTTY0RVRLV2k1WXBKbXpP?=
 =?utf-8?B?OEJyTjhXLzhqOGlFVG8zQllrREpqdk95Rk9sUGRkOVR4Zi9NcUZVYitmK2Rq?=
 =?utf-8?B?L21Kb0xWbnhwS2lCeVdBRHgzOFRSNXc0UENZTzhVQ1BZcU5PVHlKWjh3SVd3?=
 =?utf-8?B?WVVodWQycGVjRjJSdUEyMkxzWGlSVnFEYkJRa2tTbTBNSUFycndWaTUwTGtw?=
 =?utf-8?B?YjNnQzNSUE1wb0tybktWUEtia3JJMXVpQ3JHbytoZ3JlanZKamFJeUVUWEt4?=
 =?utf-8?B?N0M5eElxM3FlU1Rvd3Z4dW10R0xKMVVXWCsrYkpiZXdocGcrTHArRUlLMEg4?=
 =?utf-8?B?UHNmQmpXM2RxQkNneSs2Rmhud2tSYUhvdGsvQTZSUVNVQ2VxQU1VY29WRFJY?=
 =?utf-8?B?M3AxNjM5N1MzRng1V3J0YWpqUVg0U290K3h2N3ZyYnlmQTRqc2RIVDJLQ3Fp?=
 =?utf-8?B?cmxZQnZrMXUvek9NdUJBeGZJQlIyelo0UzRYTE1uK2Z4dWlBQ3dqTzd5QXho?=
 =?utf-8?B?aWFHdEViZ3NJbTZDVmRRY3FtUkdURVRTUnhKbEhWRTNtZ2NmS1dWVG02ejk1?=
 =?utf-8?B?Q2prZVdWLzZkLzUyL084Z2dmVDE2RXUvRWdReTBJcWx1SFRDMi9MT0ZqM3A4?=
 =?utf-8?B?ZzM5bUxnYzBnNEJKMFhxUjdueDRZMnZNWkhhaXRLSmprbm9JelpKMVkra01N?=
 =?utf-8?B?UzdOZ08vVlBEMVg3bitBTHhPYnRrSFZyQzlscU5QYW0xSERkUk9yWTVvMStX?=
 =?utf-8?B?Y2JPNnpzMkE4Rm5Ddm9ibEFRNC9DaDgvcWhTZ1I4Kzg2Vm4vU1hjMnJ6c29r?=
 =?utf-8?B?VDVOS1FTM1o2dHJkenF1ZE9aWE8yNlFQakRrR3hDR1lNSkZhS1VnNmkyWmE1?=
 =?utf-8?B?ZmVueU43MDhMMk5pK3FyVWlQTml4amUwVFVqK2dzN283SVhyL3JwWDJpWVND?=
 =?utf-8?B?SE9EaHVoazlPV21DSlZES1R0QUxhcDR2WXJUSWpXelVzM2M1d2hlbHJCODQx?=
 =?utf-8?B?dXRvRGlTZERSa1hQWitzZ2dHZmJhdjVqcUdUTk5iVU9TbWhOS0FDTFpYajIr?=
 =?utf-8?B?dDdjL2UvYW11ZWdzZ3ErU0NHbDVBPT0=?=
X-OriginatorOrg: onespin.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 7e62de0a-cf87-42cf-6cd9-08d9a45eb74c
X-MS-Exchange-CrossTenant-AuthSource: AM9P190MB1618.EURP190.PROD.OUTLOOK.COM
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 10 Nov 2021 15:28:16.2390 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 145679f0-0524-460c-90fd-ac0b0a11e2f6
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: OA9Ky3NpNAxbwnnUcu5Bzy+DVwFmvHl/NFLxCT4FJpQm0gIanjYoKiSQR6GibItfZY8xWlUO6R0B4kwsGSzP6qf9I5idDmupsdCUXK7aS50=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM9P190MB1217
X-Spam-Status: No, score=-1.3 required=5.0 tests=BAYES_00, DKIM_SIGNED,
 DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, HTML_MESSAGE, MSGID_FROM_MTA_HEADER,
 NICE_REPLY_A, RCVD_IN_BARRACUDACENTRAL, RCVD_IN_DNSWL_NONE, RCVD_IN_MSPIKE_H2,
 SPF_HELO_PASS, SPF_PASS, TXREP autolearn=no autolearn_force=no version=3.4.4
X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on
 server2.sourceware.org
X-Content-Filtered-By: Mailman/MimeDel 2.1.29
X-BeenThere: cygwin AT cygwin DOT com
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: General Cygwin discussions and problem reports <cygwin.cygwin.com>
List-Unsubscribe: <https://cygwin.com/mailman/options/cygwin>,
 <mailto:cygwin-request AT cygwin DOT com?subject=unsubscribe>
List-Archive: <https://cygwin.com/pipermail/cygwin/>
List-Post: <mailto:cygwin AT cygwin DOT com>
List-Help: <mailto:cygwin-request AT cygwin DOT com?subject=help>
List-Subscribe: <https://cygwin.com/mailman/listinfo/cygwin>,
 <mailto:cygwin-request AT cygwin DOT com?subject=subscribe>
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset="us-ascii"; Format="flowed"
Errors-To: cygwin-bounces+archive-cygwin=delorie DOT com AT cygwin DOT com
Sender: "Cygwin" <cygwin-bounces+archive-cygwin=delorie DOT com AT cygwin DOT com>

Hi Bill,

On 10.11.2021 16:10, Bill Stewart wrote:
> On Wed, Nov 10, 2021 at 7:52 AM Strasser, Dominik (DI SW ICS ICV) 
> <dominik DOT strasser AT onespin DOT com> wrote:
>
>     We are in an AD environment. AD holds the needed data for ssh(d) to
>     work. I can log into cygwin using ssh. But if I have a key stored
>     .ssh/authorized_keys for passwordless login, the groups my user is in
>     differs from the one w/o an authorized keys. Unfortunately exactly
>     the
>     group(s) for accessing the shared filesystems is missing. We were
>     investigating a lot and the only workaround we found is that the sshd
>     service runs under the user we want to log in. This unfortunately
>     disables any other user to log into the cygwin machine. When
>     debugging
>     ssh with -vvv, there is no visible difference between the login with
>     authorized_keys or without (of course there is a difference wrt. the
>     login method).
>
>
> The OpenSSH server service should be running as local system, not as a 
> specific user.
I know that this is the standard installation. But we absolutely need 
passwordless login. So this was the workaround we found.
The number of groups differs when sshd is run as local system, and when 
authorized_keys exist or not. Groups are OK, when it is run under the 
one user we absolutely need the passwordless login.

Regards

Dominik
>
> Bill

-- 
Dominik Strasser       | Phone:  +49 89 99013-436
OneSpin Solutions GmbH | Fax:    +49 89 99013-100
Nymphenburgerstr. 20a
80335 Muenchen         |dominik DOT strasser AT onespin DOT com

OneSpin Solutions GmbH
A Siemens business

Geschaeftsfuehrung: Thomas Heurung, Frank Thurauf
Sitz: Muenchen; Amtsgericht Muenchen HRB 139 464
UstID#: DE 814 413 215

-- 
Problem reports:      https://cygwin.com/problems.html
FAQ:                  https://cygwin.com/faq/
Documentation:        https://cygwin.com/docs.html
Unsubscribe info:     https://cygwin.com/ml/#unsubscribe-simple