If password auth or `passwd -R' auth is used you'll have the "4(INTERACTIVE)"
group in your `id' output. If S4ULogon is used you'll have the "2(NETWORK)"
group in your `id' output. This is one way to identify which logon method has
been used.
>>>>I always get 4(INTERACTIVE) - with password or with RSA (also on
servers I didn't run passwd -R). Never got 2(NETWORK).
You don't need mkpasswd anymore. Use `getent passwd' instead.
But... given you're using mkpasswd at all, I wonder if you still have
/etc/passwd and/or /etc/group files. If so, move them out of the way and
restart your CYgwin processes. They are not required and may even result in
problems if they have been tweaked.
If you still have these files, removing them is the first thing to try.
>>>>Yes, I still have passwd and group files. No special tweaks. They
were set with mkpasswd -d & mkgroup -d and never been touched, but I'll check
how to use getent and will update.
Other groups than NETWORK or INTERACTIVE don't matter, as explained above. The
only reasons I can think of that LogonUser doesn't work is that your username,
domainname, or password are incorrect, or your account is disabled. I never
saw the call fail for any other reason.
For debugging, you would have to call the sshd service under strace.
That would give a hint. For that you should change the sshd service call in
the registry so that `/usr/sbin/sshd -D' is replaced with `/usr/bin/strace -o
/tmp/sshd.trace /usr/sbin/sshd -d'. Note the lowercase -d, which runs sshd in
debug mode. After the first logon, sshd will terminate itself automatically.
Afterwards you should send the /tmp/sshd.trace file here for inspection. You
can obfuscate sensitive info, but the gist of the file should stay intact.
>>>> I was able to set sshd to run with debug (-d), but when adding the
trace the service fails to start.
Noticed another problem started only on the servers I ran passwd -R - the
Cygwin terminal fails to start. The window opens and closes immediately. It
didn't happen immediately after running the command. It started a few days
later.
Servers have been rebooted during this time and I think it started after the
reboot.
Think I might need to reinstall or upgrade and try your suggestions again.
Thanks for the tips. I will update when I have more info.
