Oh, btw., Charles, that's one for you.
On Jun 16 23:01, Corinna Vinschen wrote:
> On May 13 11:09, Schutter, Thomas A. wrote:
> > Except that is not what I am seeing. When I run "id" from a console
> > cygwin shell:
> > $ id
> > uid=18718(tschutter) gid=10513(Domain Users)
> > groups=544(Administrators),545(Users),10513(Domain
> > Users),18169(FDSV-GG-PrxBLD),22611(FDSV-GG-PrxPCAdmins)
> >
> > But when I run "id" from a ssh shell:
> > $ id
> > uid=18718(tschutter) gid=10513(Domain Users)
> > groups=545(Users),10513(Domain Users)
> >
> > So when I am using pubkey authentication, the user token is not a member
> > of the "Administrators", "FDSV-GG-PrxBLD", or "FDSV-GG-PrxPCAdmins"
> > groups.
>
> Dunno if you fixed this problem in the meantime? I tested this myself
> and debugged this situation. It turned out (in *my* local scenario),
> the the PDC refused to list the groups the user is member of:
>
> $ id
> uid=11001(corinna) gid=10513(DomUsers) groups=545(Users),10513(DomUsers)
>
> The problem was that the domain sshd_server account has no right to
> access the domain controller from the network. Solution: Open the Local
> Security Policy of the DC and look for the User Right "Deny access to
> this computer from the network". You'll find your sshd_server user in
> there. Remove it from this user right. Try again:
This user right shouldn't be set anymore in the
csih/cygwin-service-installation-helper.sh script. Patch follows:
* Don't disallow network logon for service user account.
--- cygwin-service-installation-helper.sh.ORIG 2008-06-16 23:07:36.017432500
+0200
+++ cygwin-service-installation-helper.sh 2008-06-16 23:07:50.842305100
+0200
@@ -1640,7 +1640,6 @@ csih_account_has_necessary_privileges()
editrights -l -u "${user}" | fgrep SeCreateTokenPrivilege
>/dev/null 2>&1 &&
editrights -l -u "${user}" | fgrep SeTcbPrivilege
>/dev/null 2>&1 &&
editrights -l -u "${user}" | fgrep SeDenyInteractiveLogonRight
>/dev/null 2>&1 &&
- editrights -l -u "${user}" | fgrep SeDenyNetworkLogonRight
>/dev/null 2>&1 &&
editrights -l -u "${user}" | fgrep SeDenyRemoteInteractiveLogonRight
>/dev/null 2>&1 &&
editrights -l -u "${user}" | fgrep SeIncreaseQuotaPrivilege
>/dev/null 2>&1 &&
editrights -l -u "${user}" | fgrep SeServiceLogonRight
>/dev/null 2>&1
Corinna
--
Corinna Vinschen Please, send mails regarding Cygwin to
Cygwin Project Co-Leader cygwin AT cygwin DOT com
Red Hat
--
Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple
Problem reports: http://cygwin.com/problems.html
Documentation: http://cygwin.com/docs.html
FAQ: http://cygwin.com/faq/
