2009/6/23 Corinna Vinschen: > On Jun 22 17:48, Reini Urban wrote: >> Starting the laptop at home, without PDC connection works. I can properly >> login. >> But ssh to this box fails with -1 = initgroups (URBANR, 10513)
>> error 1355: DcGetDcName(PDC_REQUIRED) call failed >> error 2221: UserGetLocalGroups failed >> >> I should be able to login with pubkey to my box with sshd when windows >> lets me in also. > > That's easier said than done. > > Apparently your laptop is configured to allow using cached credentials > which are used by the machine if it can't connect to a DC. The token > information (groups/privileges) is also cached somewhere in a > non-documented storage. Whatever Windows is using, it's not accessible > for Cygwin. At least I don't know how to do it. Is it possible to detect that one is logged in with a cached credential at least? Then the failing initgroups DcGetDcName(PDC_REQUIRED) can be made non-fatal. Or maybe there's a PDC_OPTIONAL > If Cygwin can't connect one of the DCs, then I don't get the group > information for the given domain account. If I have no group > information, I can only generate a broken user token. The problem > here is that initgroups() is called before setuid(). If setuid() > would always be called first, we already would have a token and could > fetch the groups from there, but that's idle wishing. > > So, for the time being, the workaround to get a user token is thus: > > 1. I'll patch Cygwin to ignore the fact that the group information > couldn't be fetched from the server. Great! > 2. Either you're happy with a restricted token, Restricted token is okay for me. > or you use the new logon > method 3 as described in > http://cygwin.com/1.7/cygwin-ug-net/ntsec.html#ntsec-setuid-overview > This results in getting a token right from Windows based on the > cached credentials. I'll try password auth then, thanks -- Reini Urban http://phpwiki.org/ http://murbreak.at/ -- Problem reports: http://cygwin.com/problems.html FAQ: http://cygwin.com/faq/ Documentation: http://cygwin.com/docs.html Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple
