From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 75681 invoked by alias); 8 Mar 2018 15:24:52 -0000 Mailing-List: contact cygwin-help@cygwin.com; run by ezmlm Precedence: bulk List-Id: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: cygwin-owner@cygwin.com Mail-Followup-To: cygwin@cygwin.com Received: (qmail 60642 invoked by uid 89); 8 Mar 2018 15:24:39 -0000 Authentication-Results: sourceware.org; auth=none X-Virus-Found: No X-Spam-SWARE-Status: No, score=-1.8 required=5.0 tests=AWL,BAYES_00,KAM_LAZY_DOMAIN_SECURITY,RCVD_IN_DNSWL_LOW autolearn=no version=3.3.2 spammy=Services, act, his, services X-HELO: smtp-out-so.shaw.ca Received: from smtp-out-so.shaw.ca (HELO smtp-out-so.shaw.ca) (64.59.136.137) by sourceware.org (qpsmtpd/0.93/v0.84-503-g423c35a) with ESMTP; Thu, 08 Mar 2018 15:24:37 +0000 Received: from [192.168.1.100] ([24.64.240.204]) by shaw.ca with ESMTP id txP3eLATwYxCTtxP4eLMHF; Thu, 08 Mar 2018 08:24:22 -0700 X-Authority-Analysis: v=2.3 cv=cav8UELM c=1 sm=1 tr=0 a=MVEHjbUiAHxQW0jfcDq5EA==:117 a=MVEHjbUiAHxQW0jfcDq5EA==:17 a=IkcTkHD0fZMA:10 a=w_pzkKWiAAAA:8 a=5XokXtswbGC1uQ9QsCcA:9 a=QEXdDO2ut3YA:10 a=OO2XiV6ZNdAA:10 a=sRI3_1zDfAgwuvI8zelB:22 Reply-To: Brian.Inglis@SystematicSw.ab.ca Subject: Re: sshd: PID 2308: fatal: seteuid 1090146: Permission denied --> Login to domain server windows 2k12r2 not possible To: cygwin@cygwin.com References: <5AA122070200001D000536EA@gwia2.boku.ac.at> From: Brian Inglis Message-ID: Date: Thu, 08 Mar 2018 15:50:00 -0000 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Thunderbird/52.6.0 MIME-Version: 1.0 In-Reply-To: <5AA122070200001D000536EA@gwia2.boku.ac.at> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit X-CMAE-Envelope: MS4wfEfyRSfzh+7d+Qcr/PY9GLo1mtvCSGKnEAc92Nt6ygdRA9iHzg/0vw2PhdKqa2tOBype2R0/ULRfgB03+4YSJm6EUeaJMR5B9u6vet4eOrVBCYH9QSjm 3FMFvxo0t8KBtNE8OqNdCOxNZYi/Cp85C2TiiiQTzrXtrXaxUxeC4uJtkSD6yB5x9qwWcLSKGCCaIA== X-IsSubscribed: yes X-SW-Source: 2018-03/txt/msg00119.txt.bz2 On 2018-03-08 04:44, Bernhard Finster wrote: > login via ssh to cygwin on a domain server 2012r2 standardis not possible (see error in mail subject). The login is either with password, nor with publickey possible. > The package was created with cygwinsetup.exe v 2.877 (32bit) and works fine on every standalone servers. I have createt a setup batch file with the content below: > > c:\start\cygwin\setup.exe -q --local-install --root c:\cygwin -l c:\Start\cygwin > cd C:\cygwin\bin > bash --login -c "ssh-host-config -y -c "tty ntsec" -u "cyg_server" -w "password" --privileged" > bash --login -c "mkdir .ssh" > bash --login -c "cp /cygdrive/c/Start/authorized_keys .ssh/authorized_keys" > bash --login -c "chmod 700 .ssh" > bash --login -c "cygrunsrv -S sshd" > bash --login -c "syslog-ng-config -y" > bash --login -c "cygrunsrv -S syslog-ng" > > The setup is always startet with the user "Administrator@domain" after joining the domain. > In my test-domain I have enabled the following user right assignement for the domain admin cyg_server: > > * Act as part of the operating system > * Create a token object > * Log on as a batch job > * Log on as a service > * Repace a process level token > * Deny log on locally > * Deny logon through Remotedesktop Services > > Attachements: > > * ssh_config, sshd_config, original copy from the server > * ssh-ddd.txt is the output of the command "/usr/sbin/sshd -d -d -d" > * ssh-vvv.txt is the output of a login attempt to the server (usual Administrator@hostname), I have defined in .ssh/config (host * user Administrator) > * messages.txt is the output of a login attemt to the server from his syslog-ng log > * cygcheck > > Sorry for my bad english, I hope it will get better. > Please help if you have any idea for me to get out of this desaster. You might want to try upgrading setup, upgrading installed packages, and manually running the ...-config scripts elevated, to see if that fixes the problem. seteuid handling: https://cygwin.com/cygwin-ug-net/ntsec.html#ntsec-setuid-overview -- Take care. Thanks, Brian Inglis, Calgary, Alberta, Canada -- Problem reports: http://cygwin.com/problems.html FAQ: http://cygwin.com/faq/ Documentation: http://cygwin.com/docs.html Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple