From: Corinna Vinschen <corinna-cygwin@cygwin.com>
To: cygwin@cygwin.com
Subject: Re: can't access remote shares when using ssh with rsa key - passwd -R / set(e)uid / LogonUser is not working as expected
Date: Wed, 06 Mar 2019 12:35:00 -0000 [thread overview]
Message-ID: <20190306123509.GQ3785@calimero.vinschen.de> (raw)
In-Reply-To: <20190306122816.GP3785@calimero.vinschen.de>
[-- Attachment #1: Type: text/plain, Size: 1581 bytes --]
On Mar 6 13:28, Corinna Vinschen wrote:
> On Mar 6 10:09, Maayan Apelboim wrote:
> > Well, it doesn't work OK unfortunately, but I'm not sure if I missed something in the process, or is it just not working properly.
> > I'm a bit worried to upgrade to 3.0.2 at the moment cause it's a major version and will probably have new bugs that I wouldn't want to find in production.
> >
> > Assuming we will eventually upgrade to latest version -
> > My sshd service is running with domain user cyg_server and we login with domains users via ssh - is it still OK to switch the sshd service's user to local system?
> > Will we still be able to login with domain users via ssh?
>
> Yes, that's the idea. The new method using the official S4U logon
> technique runs under the SYSTEM account. No need to have a special
> cyg_server account with potentially dangerous privileges anymore.
>
> > Will it help with my network shares problem?
>
> No. Just like the old techniques using an LSA authentication module
> or creating a user token from scratch, S4U login does not create
> tokens with valid network credentials. For some weird reason only
> Microsoft knows about, you still need a password login for that.
Btw., that's in no way different when using Microsoft's own SSHD.
They use S4U login as well. That's where I got the idea, in fact.
> The other method, logging in by stored password, as described in
> https://cygwin.com/cygwin-ug-net/ntsec.html#ntsec-nopasswd3 still
> works, though.
Corinna
--
Corinna Vinschen
Cygwin Maintainer
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
next prev parent reply other threads:[~2019-03-06 12:35 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <AM6PR07MB5334CE88B67F5421BA671C43957B0@AM6PR07MB5334.eurprd07.prod.outlook.com>
2019-02-26 13:39 ` Maayan Apelboim
2019-02-26 15:33 ` Andrey Repin
2019-02-26 18:00 ` Houder
2019-02-27 1:17 ` Andrey Repin
2019-03-05 8:19 ` Maayan Apelboim
2019-03-05 19:27 ` Achim Gratz
2019-03-06 10:09 ` Maayan Apelboim
2019-03-06 12:28 ` Corinna Vinschen
2019-03-06 12:35 ` Corinna Vinschen [this message]
2019-03-13 8:32 ` Maayan Apelboim
2019-03-13 9:04 ` Corinna Vinschen
2019-03-14 10:41 ` Maayan Apelboim
2019-03-14 11:11 ` Corinna Vinschen
2019-03-18 13:53 ` Maayan Apelboim
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190306123509.GQ3785@calimero.vinschen.de \
--to=corinna-cygwin@cygwin.com \
--cc=cygwin@cygwin.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).