public inbox for cygwin-talk@cygwin.com
 help / color / mirror / Atom feed
* RE: [spam] Re: Windows rights
       [not found] <2B674CE447106D46A53D0FDDC7DF8B1C3A2D2B@PTXSMSXM01.emea.ime.reuters.com>
@ 2005-06-23 22:59 ` Dave Korn
  0 siblings, 0 replies; 5+ messages in thread
From: Dave Korn @ 2005-06-23 22:59 UTC (permalink / raw)
  To: 'The Cygwin-Talk Minging List.'

----Original Message----
>From: Christophe Delarue
>Sent: 23 June 2005 15:01


> Is there a method to rsh on a windows machine without password and
> access network drives ?

  Heh, I can see where this is going.  "Oh, I hate having to type in my
password in order to log in, and I hate having to log in to be allowed to
write to the network, I'll just remove all the access controls from the
whole thing, then anyone can write to the network drives without needing to
log in ...."

  And this guy works for Reuters.  I can just see next month's newspaper
headlines now.....


  "Hippos invade USA!  CGF declared Emperor of the world!  Passwords 'not
just a mere inconvenience', says hacked user."




    cheers,
      DaveK
-- 
Can't think of a witty .sigline today....

^ permalink raw reply	[flat|nested] 5+ messages in thread

* RE: [spam] Re: Windows rights
  2005-06-24 17:21     ` Dave Korn
@ 2005-06-24 19:11       ` Dave Korn
  0 siblings, 0 replies; 5+ messages in thread
From: Dave Korn @ 2005-06-24 19:11 UTC (permalink / raw)
  To: 'Rubber for rubber plants and freedom for freedom plants'

----Original Message----
>From: Dave Korn
>Sent: 24 June 2005 18:13


s/FAQ entry is correct to/FAQ entry would be correct to/g


    cheers,
      DaveK
-- 
Can't think of a witty .sigline today....

^ permalink raw reply	[flat|nested] 5+ messages in thread

* RE: [spam] Re: Windows rights
  2005-06-24 17:12   ` Corinna Vinschen
@ 2005-06-24 17:21     ` Dave Korn
  2005-06-24 19:11       ` Dave Korn
  0 siblings, 1 reply; 5+ messages in thread
From: Dave Korn @ 2005-06-24 17:21 UTC (permalink / raw)
  To: 'Rubber for freedom plants!'

----Original Message----
>From: Corinna Vinschen
>Sent: 24 June 2005 17:42

> On Jun 24 16:03, Dave Korn wrote:
>>   LocalSystem is an account.  An account is an object in the AD.  There
>> is an access token associated with that account.  An access token is a
>> container in the LSA.  Within that container there are two SIDs.  A SID
>> is another kind of object.  When you pass the correct login details to
>> the LSA, that correspond to those recorded in the account object, it
>> creates the access token container and places two SID objects in it. 
>> One of those SID objects is SYSTEM.
> 
> - LocalSystem has nothing to do with AD.

  Yes, you're right of course, it's a synthetic account in the LSA.
However, this does not bear on the main point of the discussion, which is
about whether the FAQ entry is correct to claim that SYSTEM and LocalSystem
are one and the same thing. 

> - What are the two SIDs you're talking about?  Did you see an access token
>   from the inside?  There are lots of SIDs in it, the user, the owner, the
>   primary group, the group list and, in a restricted token, the list of
>   restricted SIDs.

  I was referring to the user and the primary group.  I omitted the rest
because they are irrelevant to the discussion, which is about whether the
FAQ entry is correct to claim that SYSTEM and LocalSystem are one and the
same thing. 

>>   So LocalSystem is an AD record that contains the details of which SIDs
> 
> - LocalSystem does not exist in AD since it's a *local* account, not a
>   domain account.

  Yes, we've been through this.  However, the discussion is not about where
it lives.  The discussion is about whether the FAQ entry is correct to claim
that SYSTEM and LocalSystem are one and the same thing. 

>> should be placed in the access token, and SYSTEM is one of those SIDs.
> 
> How does that differ from any other user account?  

  It doesn't.  I didn't say it was different from any other user account.
The discussion is about whether the FAQ entry is correct to claim that
SYSTEM and LocalSystem are one and the same thing.

> A user has a SID
> (or uid) and when creating a default logon session then the SAM or AD
> or /etc/passwd + /etc/group determine how the access token (user/group
> list) look like.

  Yes, that's correct.  The discussion is about whether the FAQ entry is
correct to claim that SYSTEM and LocalSystem are one and the same thing.  In
other words, it is about whether a particular account (LocalSystem) is one
and the same thing as a particular user-SID (SYSTEM).  

> We're still talking artificial here.

  Well, one is a SID, and the other is an account.  Given that they are two
different kinds of object, I think there is nothing artificial about saying
that they are "not identical".  It's a bit like saying "A steering wheel is
identical to a car".  It's not; it's just one small part of it.

    cheers,
      DaveK
-- 
Can't think of a witty .sigline today....

^ permalink raw reply	[flat|nested] 5+ messages in thread

* Re: [spam] Re: Windows rights
  2005-06-24 15:04 ` Dave Korn
@ 2005-06-24 17:12   ` Corinna Vinschen
  2005-06-24 17:21     ` Dave Korn
  0 siblings, 1 reply; 5+ messages in thread
From: Corinna Vinschen @ 2005-06-24 17:12 UTC (permalink / raw)
  To: 'Freedom for rubber plants'

On Jun 24 16:03, Dave Korn wrote:
>   LocalSystem is an account.  An account is an object in the AD.  There is
> an access token associated with that account.  An access token is a
> container in the LSA.  Within that container there are two SIDs.  A SID is
> another kind of object.  When you pass the correct login details to the LSA,
> that correspond to those recorded in the account object, it creates the
> access token container and places two SID objects in it.  One of those SID
> objects is SYSTEM.

- LocalSystem has nothing to do with AD.

- What are the two SIDs you're talking about?  Did you see an access token
  from the inside?  There are lots of SIDs in it, the user, the owner, the
  primary group, the group list and, in a restricted token, the list of
  restricted SIDs.

>   So LocalSystem is an AD record that contains the details of which SIDs

- LocalSystem does not exist in AD since it's a *local* account, not a
  domain account.

> should be placed in the access token, and SYSTEM is one of those SIDs.

How does that differ from any other user account?  A user has a SID
(or uid) and when creating a default logon session then the SAM or AD
or /etc/passwd + /etc/group determine how the access token (user/group
list) look like.

We're still talking artificial here.


Corinna

^ permalink raw reply	[flat|nested] 5+ messages in thread

* RE: [spam] Re: Windows rights
       [not found] <20050623175338.GX2814@calimero.vinschen.de>
@ 2005-06-24 15:04 ` Dave Korn
  2005-06-24 17:12   ` Corinna Vinschen
  0 siblings, 1 reply; 5+ messages in thread
From: Dave Korn @ 2005-06-24 15:04 UTC (permalink / raw)
  To: 'FREEDOM IS SLAVERY     IGNORANCE IS STRENGTH    DOS IS UNIX'

----Original Message----
>From: Corinna Vinschen
>Sent: 23 June 2005 18:54

[Bock-bock-b'gaaaaaaawwwk!]

> And what exactly is the difference between an account root and the user
> with uid 0?  That's an artificial distinction which doesn't make sense,
> especially since the primary group has no strong meaning in Windows.
> 
> So what does LocalSystem represent *exactly* in your opinion?  Is it a
> specific access token?
> 
> Sounds like TITTTL to me...


  LocalSystem is an account.  An account is an object in the AD.  There is
an access token associated with that account.  An access token is a
container in the LSA.  Within that container there are two SIDs.  A SID is
another kind of object.  When you pass the correct login details to the LSA,
that correspond to those recorded in the account object, it creates the
access token container and places two SID objects in it.  One of those SID
objects is SYSTEM.

  So LocalSystem is an AD record that contains the details of which SIDs
should be placed in the access token, and SYSTEM is one of those SIDs.
LocalSystem and SYSTEM are objects of different classes that exist within
different kinds of containers in different subsystems of the OS, and to say
that "LocalSystem is the same thing as SYSTEM" is as incorrect as saying
that "LocalSystem is the same thing as Administrators", which I hope is at
least more obviously incorrect....

    cheers,
      DaveK
-- 
Can't think of a witty .sigline today....

^ permalink raw reply	[flat|nested] 5+ messages in thread

end of thread, other threads:[~2005-06-24 17:21 UTC | newest]

Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
     [not found] <2B674CE447106D46A53D0FDDC7DF8B1C3A2D2B@PTXSMSXM01.emea.ime.reuters.com>
2005-06-23 22:59 ` [spam] Re: Windows rights Dave Korn
     [not found] <20050623175338.GX2814@calimero.vinschen.de>
2005-06-24 15:04 ` Dave Korn
2005-06-24 17:12   ` Corinna Vinschen
2005-06-24 17:21     ` Dave Korn
2005-06-24 19:11       ` Dave Korn

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).