From: Jeffrey Walton <noloader@gmail.com>
To: cygwin@cygwin.com
Subject: Re: AllowGroups in SSHD not working for domain accounts
Date: Wed, 01 Aug 2018 18:29:00 -0000 [thread overview]
Message-ID: <CAH8yC8=ZgDajV0mMXw-KSGcKd80JbDgiatAE5X8W59eYgQaV5Q@mail.gmail.com> (raw)
In-Reply-To: <CAKxHmYnTs0O=Hw7ABVcmE1N6TieX04+U4rTM9wtkO3g-0_UXhw@mail.gmail.com>
On Wed, Aug 1, 2018 at 2:21 PM, Michal Zindulka
<michal.zindulka@gmail.com> wrote:
> Hi Cygwin team,
>
> I'm trying to setup SSHD with 'AllowGroups' option, but I've encountered
> following troubles.
>
> When I setup the 'AllowGroups SSHGROUP' option in 'sshd_config' file, then
> a local users who are members of 'SSHGROUP' are able to login without any
> issue. When I do the same for domain user, who is also member of local
> group 'SSHGROUP', the login will fail with following error in the log:
>
> 'User SSHUSER from <IP> not allowed because non of user's groups are listed
> in AllowGroups.
>
> When I try to list all users for my domain user using 'groups' command, it
> show only domain groups where the user belong + primary groups which is set
> in 'passwd' file.
>
> I was able to make it work, using a workaround, by set a local 'SSHGROUP'
> as a primary group in 'passwd' file for my domain user. Then this groups is
> was also displayed using 'groups' command and user was able to login, but
> it's not a suitable solution for me.
>
> I've tried also to assign my domain user to 'SSHGROUP' in 'group' file, but
> didn't help.
Not sure if it is related, but...
On Windows domains you are supposed to follow the UGLY model. The
letters of UGLY stand for:
Users into Global groups
Global into domain Local groups
You assign permissions
SSHGROUP should be a local group with members from the domain and global groups.
Of course, scratch this if the machinery is doing something different.
Jeff
--
Problem reports: http://cygwin.com/problems.html
FAQ: http://cygwin.com/faq/
Documentation: http://cygwin.com/docs.html
Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple
prev parent reply other threads:[~2018-08-01 18:29 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-08-01 18:22 Michal Zindulka
2018-08-01 18:29 ` Jeffrey Walton [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAH8yC8=ZgDajV0mMXw-KSGcKd80JbDgiatAE5X8W59eYgQaV5Q@mail.gmail.com' \
--to=noloader@gmail.com \
--cc=cygwin@cygwin.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).