Re: SSH V.5.1 with Cygwin1.dll 1.7.0(0 .189/5/3) 2008-12-09: Very large logon times ...

[Carsten dot Porzler at spb dot de]

Hello, Corinna,

cygwin-owner@cygwin.com schrieb am 16.12.2008 11:08:05:

> Hello?  Did you read all of my previous mail?
> 
> 
> Please, don't http://cygwin.com/acronyms/#TOFU
> ==============================================
> 

Yes, I read and understand it now!

> 
> On Dec 16 09:39, Carsten.Porzler wrote:
> > Hello, Corinna,
> > 
> > 1. It only takes 3 secs on your machine, but do you logon with an 
Active 
> > Directory user?
> 
> Yes, against a 2K8 domain server.  Additionally, it doesn't make any
> difference whether the user is logged on locally or not.
> 

It could be interesting, if you let it run against a Win2003 server.

> > 2. The problem occours on cygwin environments after the 2008-06-18 
> > version! I recognized the behaviour on all of our machines I tested 
on. 
> > Until cygwin 2008-06-18 it works fine, on versions after it, the 
problem 
> > occurs.
> 
> After 2008-06-18 (mainly on 2008-07-09) I changed the code which
> verifies user tokens and the code which creates the user token
> information (groups and privileges) when using NtCreateToken or
> cyglsa.dll.  This code changes were a result of testing password and
> public key authentication against the 2K8 AD controller extensively.
> The old code was wrong in a way which could screw up password
> authentication entirely and could result in crippled group and
> privilege lists when using public key auth.
> 
> I'm quite confident that the new code is much more correct than the
> old code.
> 

Nice, if the code is more correct than before. But we have the problem 
with the large logon times, yet. I took the cygwin version from 
2009-01-03!

> > 3. Unfortunately I can't debug the problem, because I am not a 
software 
> > developer. I can analyze the behaviour of software very exactly, but 
> > debugging is not my area. I am not experienced enought and it is too 
time 
> > consuming. I am a system administrator.
> 
> And you don't have a developer in-house who could help?
> 
> I can't reproduce the problem, neither logging in on a domain member
> machine, nor on the domain controller.  If you want to find out where
> the time is wasted, we would need some figures.  If you can set yourself
> up to build the Cygwin DLL and then add some debugging statements at
> some places I tell you, we could probably figure out what takes so long
> in your environment.
> 

I just compiled the cygwin sources from the latest snapshot for testing. 
It seems to be working...

So, please tell me the debugging statements I have to insert into the 
source code to figure out where the logon process takes the time.

> > 4. Actually I have watched the pipe access on a system running cygwin 
of 
> > 2008-09-12. There are exact the pipe accesses I reported before 
> > (\\<domaincontroller>\PIPE\samr, \\<domaincontroller>\PIPE\lsarpc). 
Many 
> > of the accesses has done until the logon process finished.
> 
> So it's probably related to the sec_auth.cc changes I explaind above.
> 
> > If I see all the reported effects, I have to conclude that something 
basic 
> > change after the cygwin version of 2008-06-18!
> > 
> > I do not believe that the reason for the problems are based on our 
Windows 
> > enviroment, because all regular Windows logons and the cygwin logons 
> > recent to version of 2008-06-18 (inclusive) work fine!
> 
> What a surprise.  It only occurs in your environment right now, though.
> 
> Again, Please don't http://cygwin.com/acronyms/#TOFU
> 
> 
> Corinna
> 
> -- 
> Corinna Vinschen                  Please, send mails regarding Cygwin to
> Cygwin Project Co-Leader          cygwin AT cygwin DOT com
> Red Hat
> 
> --
> Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple
> Problem reports:       http://cygwin.com/problems.html
> Documentation:         http://cygwin.com/docs.html
> FAQ:                   http://cygwin.com/faq/
> 

Thanks a lot in advance and best regards

Carsten Porzler


--
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple
Problem reports:       http://cygwin.com/problems.html
Documentation:         http://cygwin.com/docs.html
FAQ:                   http://cygwin.com/faq/