Re: LDAP integration and sshd

2014-06-27 Thread Achim Gratz
Corinna Vinschen writes: > The Admin group is a BUILTIN group, so it's always +Administrators > under the default prefixing rule, as outlined in my preliminary > documentation. Yeah, I was just trying the other variants out of desperation. > And it works fine for me with the latest from CVS (== l

Re: LDAP integration and sshd

2014-06-27 Thread Corinna Vinschen
On Jun 26 19:03, Achim Gratz wrote: > Corinna Vinschen writes: > >> Hmm. Doesn't appear to be working in any combination I tried, I'm always > >> getting an "invalid user" when I'm trying to do that. Is it possible that > >> the AD lookup doesn't work when using privilege separation? > > > > No i

Re: LDAP integration and sshd

2014-06-26 Thread Achim Gratz
Corinna Vinschen writes: >> Hmm. Doesn't appear to be working in any combination I tried, I'm always >> getting an "invalid user" when I'm trying to do that. Is it possible that >> the AD lookup doesn't work when using privilege separation? > > No idea. Did you try? You didn't use '@' as separa

Re: LDAP integration and sshd

2014-06-26 Thread Corinna Vinschen
On Jun 26 09:37, Achim Gratz wrote: > Corinna Vinschen cygwin.com> writes: > > In theory, no. AllowGroups is admin-settable in the config file while > > the "sshd" user request is built into the code. Just use the names as > > you get them: > > > > AllowGroups bla MACHINE+blub DOMAIN+blubber

Re: LDAP integration and sshd

2014-06-26 Thread Achim Gratz
Corinna Vinschen cygwin.com> writes: > In theory, no. AllowGroups is admin-settable in the config file while > the "sshd" user request is built into the code. Just use the names as > you get them: > > AllowGroups bla MACHINE+blub DOMAIN+blubber ... Hmm. Doesn't appear to be working in any c

Re: LDAP integration and sshd

2014-06-26 Thread Corinna Vinschen
On Jun 26 07:35, Achim Gratz wrote: > Corinna Vinschen cygwin.com> writes: > > - Build your own OpenSSH package with the following patch applied: > > > > http://lists.mindrot.org/pipermail/openssh-unix-dev/2014-May/032591.html > > > > It converts the static request for an account called "ssh

Re: LDAP integration and sshd

2014-06-26 Thread Achim Gratz
Corinna Vinschen cygwin.com> writes: > - Build your own OpenSSH package with the following patch applied: > > http://lists.mindrot.org/pipermail/openssh-unix-dev/2014-May/032591.html > > It converts the static request for an account called "sshd" into > a function call which checks for the

Re: LDAP integration and sshd

2014-06-25 Thread Achim Gratz
Achim Gratz nexgo.de> writes: > I did that (just for my account) and then the sshd service wouldn't > start. I'll have a look at that tomorrow. The sshd complained that it didn't like the ownership or permissions on /var/empty. Both looked OK however, so I ended up deleting the services and use

Re: LDAP integration and sshd

2014-06-25 Thread Achim Gratz
Corinna Vinschen writes: > Just run cygserver and every user can do it, otherwise enter the > password for the user with `passwd -R ' as admin. I did that (just for my account) and then the sshd service wouldn't start. I'll have a look at that tomorrow. Regards, Achim. -- +<[Q+ Matrix-12 WAVE#

Re: LDAP integration and sshd

2014-06-25 Thread Corinna Vinschen
On Jun 25 20:06, Achim Gratz wrote: > Corinna Vinschen writes: > > You read my preliminary doc, I hope? I attached it again, for > > completeness. But, here's what happens: > > I guess I read it at one time, but not specifically today. :-) > > > If you're in a domain, and the sshd user account

Re: LDAP integration and sshd

2014-06-25 Thread Achim Gratz
Corinna Vinschen writes: > You read my preliminary doc, I hope? I attached it again, for > completeness. But, here's what happens: I guess I read it at one time, but not specifically today. :-) > If you're in a domain, and the sshd user account is local, the local > sshd account will be prefixe

Re: LDAP integration and sshd

2014-06-25 Thread Corinna Vinschen
On Jun 25 12:34, Achim Gratz wrote: > I've just managed to set up a working sshd on a Cygwin snapshot with LDAP > integration. The setup scripts required quite a few modifications to deal > properly with the way local accounts and groups are now named. I've had to > reinstate files for passwd to