This is the mail archive of the cygwin mailing list for the Cygwin project.


Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]
Other format: [Raw text]

Re: [1.7] sshd dc problem


2009/6/23 Corinna Vinschen:
> On Jun 22 17:48, Reini Urban wrote:
>> Starting the laptop at home, without PDC connection works. I can properly login.
>> But ssh to this box fails with -1 = initgroups (URBANR, 10513)

>> error 1355: DcGetDcName(PDC_REQUIRED) call failed
>> error 2221: UserGetLocalGroups failed
>>
>> I should be able to login with pubkey to my box with sshd when windows
>> lets me in also.
>
> That's easier said than done.
>
> Apparently your laptop is configured to allow using cached credentials
> which are used by the machine if it can't connect to a DC. ?The token
> information (groups/privileges) is also cached somewhere in a
> non-documented storage. ?Whatever Windows is using, it's not accessible
> for Cygwin. ?At least I don't know how to do it.

Is it possible to detect that one is logged in with a cached
credential at least?
Then the failing initgroups DcGetDcName(PDC_REQUIRED) can be made non-fatal.
Or maybe there's a PDC_OPTIONAL

> If Cygwin can't connect one of the DCs, then I don't get the group
> information for the given domain account. ?If I have no group
> information, I can only generate a broken user token. ?The problem
> here is that initgroups() is called before setuid(). ?If setuid()
> would always be called first, we already would have a token and could
> fetch the groups from there, but that's idle wishing.
>
> So, for the time being, the workaround to get a user token is thus:
>
> 1. I'll patch Cygwin to ignore the fact that the group information
> ? couldn't be fetched from the server.

Great!

> 2. Either you're happy with a restricted token,

Restricted token is okay for me.

>  or you use the new logon
> ? method 3 as described in
> ? http://cygwin.com/1.7/cygwin-ug-net/ntsec.html#ntsec-setuid-overview
> ? This results in getting a token right from Windows based on the
> ? cached credentials.

I'll try password auth then, thanks
-- 
Reini Urban
http://phpwiki.org/              http://murbreak.at/

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple


Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]