From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 26585 invoked by alias); 15 Sep 2003 17:13:08 -0000 Mailing-List: contact cygwin-help@cygwin.com; run by ezmlm Precedence: bulk List-Subscribe: List-Archive: List-Post: List-Help: , Sender: cygwin-owner@cygwin.com Mail-Followup-To: cygwin@cygwin.com Received: (qmail 26552 invoked from network); 15 Sep 2003 17:13:07 -0000 Received: from unknown (HELO cygbert.vinschen.de) (193.175.24.89) by sources.redhat.com with SMTP; 15 Sep 2003 17:13:07 -0000 Received: by cygbert.vinschen.de (Postfix, from userid 500) id 1954D5839A; Mon, 15 Sep 2003 19:13:06 +0200 (CEST) Date: Mon, 15 Sep 2003 17:13:00 -0000 From: Corinna Vinschen To: cygwin@cygwin.com Subject: Re: Sshd - Can't get access thru Public Key Message-ID: <20030915171305.GJ9981@cygbert.vinschen.de> Reply-To: cygwin@cygwin.com Mail-Followup-To: cygwin@cygwin.com References: <3F61ED47.6090606@speeq.com> <20030913085632.GO9981@cygbert.vinschen.de> <3F65BAF7.8030902@speeq.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <3F65BAF7.8030902@speeq.com> User-Agent: Mutt/1.4.1i X-SW-Source: 2003-09/txt/msg00966.txt.bz2 On Mon, Sep 15, 2003 at 03:13:27PM +0200, Olivier ALLART wrote: > Corinna Vinschen wrote: > >create a special account for this, which is member of the admins > >group and has the additional user privileges "Create a token object", > >"Replace a process level token" and "Logon as a service". Probably > >it makes sense to remove other privileges from that account, e.g. > >the right to logon locally or so. > > my (dumb ?) question is : where do we define such parameters ? > > And if I get the thing correctly, sshd sould still run the same way > (under the sshd user account with local sys privileges) but we should > connect using this newluy created user account to log in .. am I right ? No. *Don't* run sshd under the sshd account. The service must run under some privileged account, member of the administrators group, created with the usual Windows user management tools. Add the "Create a token object" right to the account in the "Local Security Policy" mmc snap-in. Create an /etc/passwd entry for the user. Install the service with cygrunsrv so that it runs under that new privileged account. Corinna -- Corinna Vinschen Please, send mails regarding Cygwin to Cygwin Developer mailto:cygwin@cygwin.com Red Hat, Inc. -- Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple Problem reports: http://cygwin.com/problems.html Documentation: http://cygwin.com/docs.html FAQ: http://cygwin.com/faq/