From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 78803 invoked by alias); 6 Mar 2019 20:48:41 -0000 Mailing-List: contact cygwin-help@cygwin.com; run by ezmlm Precedence: bulk List-Id: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: cygwin-owner@cygwin.com Mail-Followup-To: cygwin@cygwin.com Received: (qmail 78297 invoked by uid 89); 6 Mar 2019 20:48:40 -0000 Authentication-Results: sourceware.org; auth=none X-Spam-SWARE-Status: No, score=0.1 required=5.0 tests=BAYES_00,DNS_FROM_AHBL_RHSBL,FREEMAIL_FROM,HTML_MESSAGE,RCVD_IN_DNSWL_LOW,SPF_PASS,TIME_LIMIT_EXCEEDED autolearn=unavailable version=3.3.1 spammy=(unknown), H*c:alternative, password, Full X-HELO: mout.gmx.com Received: from mout.gmx.com (HELO mout.gmx.com) (74.208.4.201) by sourceware.org (qpsmtpd/0.93/v0.84-503-g423c35a) with ESMTP; Wed, 06 Mar 2019 20:48:30 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=mail.com; s=dbd5af2cbaf7; t=1551905309; bh=Wlh8adD9QFnA+v4lehVv31ivu9Eb3FCjF8z9nwKyTzM=; h=X-UI-Sender-Class:References:In-Reply-To:From:Date:Subject:To; b=EeocwLmw9+fU2R+rADRebQjCdSWg8zY5KpLYcvr1w0IUBkKU+uErmm5bG2cOrgwLX 7cyP0HTZ2X2EyY43lo4RPZYZG+PIN3HVcYqq0JVqTbUMJ7Hr7p/w/OylWYGepQGsqg IWhFdSFJnEwin0kaXn4A5NOzgC2Ydxibj1B+paVU= X-UI-Sender-Class: 214d933f-fd2f-45c7-a636-f5d79ae31a79 Received: from mail-lf1-f52.google.com ([209.85.167.52]) by mail.gmx.com (mrgmxus001 [74.208.5.15]) with ESMTPSA (Nemesis) id 0MTT8L-1hTzr91deZ-00SNXn for ; Wed, 06 Mar 2019 21:48:28 +0100 Received: by mail-lf1-f52.google.com with SMTP id y7so9968752lfg.8 for ; Wed, 06 Mar 2019 12:48:27 -0800 (PST) MIME-Version: 1.0 References: <20190306010254.GA4210@zebra> <20190306121154.GN3785@calimero.vinschen.de> <20190306124816.GR3785@calimero.vinschen.de> <20190306141716.GS3785@calimero.vinschen.de> <20190306143424.GU3785@calimero.vinschen.de> <20190306153404.GX3785@calimero.vinschen.de> <20190306201331.GB3785@calimero.vinschen.de> In-Reply-To: <20190306201331.GB3785@calimero.vinschen.de> From: Bill Stewart Date: Wed, 06 Mar 2019 20:48:00 -0000 Message-ID: Subject: Re: sshd problem on WS2008R2 64bit To: cygwin@cygwin.com Content-Type: text/plain; charset="UTF-8" X-IsSubscribed: yes X-SW-Source: 2019-03/txt/msg00119.txt.bz2 On Wed, Mar 6, 2019 at 1:14 PM Corinna Vinschen wrote: > > > > What precisely happens when Cygwin uses MSV1 S4ULogon on versions older > > > > than 6.3 before a user has logged on? > > > > > > MsV1S4ULogon returns with STATUS_NOT_SUPPORTED. Funny status code, > > > given it works if some user already logged in by other means... > > > > OK, so here's another potential workaround that doesn't require running the > > service as a specific user... > > > > Create a scheduled task to run using the following settings: > > > > General -> Run using user account - > choose a local account > > General -> "Run whether user is logged on or not" > > Triggers -> Run at system startup > > Actions -> Start a program -> Program/script: %SystemRoot%\Cystem32\cmd.exe > > Actions -> Start a program -> Add arguments: /c exit > > > > Full password logon is required (seems we can't use "do not store password" > > option). > > > > The local account does not have to be a member of Administrators, but it > > does require user right "Log on as a batch job" (SeBatchLogonRight). > > > > In my prefunctory testing this seems to fix this problem. > > > > Does this work? > > This does indeed work in my local testing on Windows 7, with a local > dummy user just for this scheduled job and sshd running under SYSTEM. > > Now, if that's a feasible workaround for users of these older > systems...? Good -- this works for me also. (My wild guess, which may be wrong, is that the older OS versions don't initialize MSV1 S4ULogon for some reason until somebody logs on.) Whether this workaround is feasible likely depends on the end user. The workaround has its own limitations. Here are at least 2 that I can think of right now: 1. The local user must have "Log on as a batch job" (SeBatchLogonRight) user right. 2. The "Network access: Do not allow storage of passwords and credentials for network authentication" security policy must be set to "Disabled". (If this policy is set to "Enabled", then you can't create scheduled tasks with stored passwords.) It's a weird problem. The best option would be for Microsoft to provide a fix (if we can provide a short example program that reproduces it). Regards, Bill -- Problem reports: http://cygwin.com/problems.html FAQ: http://cygwin.com/faq/ Documentation: http://cygwin.com/docs.html Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple