From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 30836 invoked by alias); 19 Jul 2008 20:47:21 -0000 Received: (qmail 30827 invoked by uid 22791); 19 Jul 2008 20:47:21 -0000 X-Spam-Check-By: sourceware.org Received: from out3.smtp.messagingengine.com (HELO out3.smtp.messagingengine.com) (66.111.4.27) by sourceware.org (qpsmtpd/0.31) with ESMTP; Sat, 19 Jul 2008 20:46:57 +0000 Received: from compute1.internal (compute1.internal [10.202.2.41]) by out1.messagingengine.com (Postfix) with ESMTP id AA8D913AC9A for ; Sat, 19 Jul 2008 16:46:55 -0400 (EDT) Received: from heartbeat2.messagingengine.com ([10.202.2.161]) by compute1.internal (MEProxy); Sat, 19 Jul 2008 16:46:55 -0400 Received: from [192.168.1.3] (user-0c6suln.cable.mindspring.com [24.110.122.183]) by mail.messagingengine.com (Postfix) with ESMTPSA id 277EF2D7E6; Sat, 19 Jul 2008 16:46:55 -0400 (EDT) Message-ID: <488252B5.8000501@cwilson.fastmail.fm> Date: Sat, 19 Jul 2008 20:47:00 -0000 From: Charles Wilson User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.8.1.14) Gecko/20080421 Thunderbird/2.0.0.14 Mnenhy/0.7.5.666 MIME-Version: 1.0 To: cygwin@cygwin.com Subject: Re: CSIH patch (Re: Unable to run sshd under a domain sshd_server account [SOLVED]) References: <3B3EFBD49B94AD4DBB7B7097257A8046DD020D@FDSVAST06SXCH01.flooddata.net> <20080513073720.GA22193@calimero.vinschen.de> <3B3EFBD49B94AD4DBB7B7097257A8046DD02FC@FDSVAST06SXCH01.flooddata.net> <20080616210105.GI731@calimero.vinschen.de> <20080616211352.GK731@calimero.vinschen.de> <48821B9F.6070907@cwilson.fastmail.fm> <20080719171235.GO5675@calimero.vinschen.de> In-Reply-To: <20080719171235.GO5675@calimero.vinschen.de> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Mailing-List: contact cygwin-help@cygwin.com; run by ezmlm Precedence: bulk List-Id: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: cygwin-owner@cygwin.com Mail-Followup-To: cygwin@cygwin.com X-SW-Source: 2008-07/txt/msg00419.txt.bz2 Corinna Vinschen wrote: > However, I sent a second patch in > http://cygwin.com/ml/cygwin/2008-06/msg00453.html > The Interactive Logon Right is also necessary for this account. I don't know why I missed that. I'll roll 0.1.6 soon. > What also doesn't work well is this: In a domain I might want a > cyg_server domain account, rather than a local account on each > machine. The reason is that the rights of the domain account can > be nicely controlled via group policy. That won't work for local > accounts on the domain member machines. Therefore, if a cyg_server > account exists in /etc/passwd, I think it should be used. I'm afraid I have no access to a domain account on which I can test this sort of thing (I mean, I /do/ have a domain account at work, but I can't experiment with adding new domain accounts, nor manipulate their privileges. This is the primary function that obtains a list of all "candidate" privileged accounts (unless the user has already set csih_PRIVILEGED_USERNAME) csih_privileged_accounts() { csih_stacktrace "${@}" $_csih_trace local username local accounts local first_account if ( csih_is_nt2003 || [ csih_is_nt -a "x$csih_FORCE_PRIVILEGED_USER" = "xyes" ] ) then if [ -z "${_csih_all_preexisting_privileged_accounts}" ] then for username in cyg_server cron_server sshd_server do if net user "${username}" 1> /dev/null 2>&1 then [ -z "${first_account}" ] && first_account="${username}" accounts="${accounts}'${username}' " fi done if [ -n "${accounts}" ] then _csih_all_preexisting_privileged_accounts="${accounts}" _csih_preferred_preexisting_privileged_account="${first_account}" fi fi fi } # === End of csih_privileged_accounts() === # I imagine you are suggesting that the following loop: for username in cyg_server cron_server sshd_server do if net user "${username}" 1> /dev/null 2>&1 then [ -z "${first_account}" ] && first_account="${username}" accounts="${accounts}'${username}' " fi done Should be modified somehow, perhaps (UNTESTED): for username in cyg_server cron_server sshd_server do if egrep "^${username}:" /etc/passwd 1>/dev/null 2>&1 || net user "${username}" 1> /dev/null 2>&1 then [ -z "${first_account}" ] && first_account="${username}" accounts="${accounts}'${username}' " fi done However, note that at present there is no provision in csih to "decorate" user names with domain information (e.g. username="MyDomain\cyg_server". It /might/ work, if you manually set csih_PRIVILEGED_USERNAME that way, but I haven't tested it -- and have no way to do so. It would be serendipitous at best if that worked. But I'm not sure you really /need/ that -- if the privileged domain user is in the active domain of the computer on which you want to use that privileged account (e.g. to run sshd)...which I imagine is the use case under consideration here...I don't think you really /need/ to explicitly specify the domain. -- Chuck -- Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple Problem reports: http://cygwin.com/problems.html Documentation: http://cygwin.com/docs.html FAQ: http://cygwin.com/faq/