This is the mail archive of the cygwin@cygwin.com mailing list for the Cygwin project.


Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]
Other format: [Raw text]

Re: setuid() problem when disconnected from PDC under 1.3.12-2


On Fri, Jul 12, 2002 at 08:07:36AM -0400, Jason Tishler wrote:
> On Tue, Jul 09, 2002 at 11:44:33PM -0400, Matt Swift wrote:
> > A recent upgarde of openssh has broken incoming ssh service.  When I
> > debug the sshd, I see the error below in the Event Viewer...
> > [snip]
> > fatal: setuid 1006: Permission denied.
> 
> I am experiencing a possibly related problem with sshd under 1.3.12-2.
> If I ssh to my laptop when disconnected from my PDC, then key exchange
> fails with the above error.

The following is a snippet from a strace (of the attached setuid.cc
running under the LocalSystem account) that shows what is happening in
the above case:

  123  148512 [main] setuid 2672 seteuid32: uid: 19695 myself->gid: 18
  192  148704 [main] setuid 2672 seteuid32: Process token not verified
 1659  150363 [main] setuid 2672 set_process_privilege: 0 = set_process_privilege (SeCreateTokenPrivilege, 1)
 1438  151801 [main] setuid 2672 extract_nt_dom_user: pw_gecos = A011350 (Jason Tishler,U-PALO-ALTO\JATIS,S-1-5-21-136257377-364972176-1563891627-119695)
2305210 2457011 [main] setuid 2672 seterrno_from_win_error: ../../../../src/winsup/cygwin/security.cc:278 windows error 2453
                                        ^^^^
                                        ****
  384 2457395 [main] setuid 2672 geterrno_from_win_error: unknown windows error 2453, setting errno to 13

Note that the Windows error 2453 corresponds to NERR_DCNotFound.

The corresponding code from the Cygwin DLL is:

BOOL
get_logon_server (const char *domain, char *server, WCHAR *wserver)
{
  ...
  /* Try to get the primary domain controller for the domain */
  sys_mbstowcs (wdomain, domain, INTERNET_MAX_HOST_NAME_LENGTH + 1);
  if ((ret = NetGetDCName (NULL, wdomain, (LPBYTE *) &buf)) == STATUS_SUCCESS)
    {
      ...
    }
  __seterrno_from_win_error (ret);
  return FALSE;
}

So, it seems that get_logon_server() will always fail for domain users
when they are disconnected from their PDC.

I haven't figured out how to fix the above yet but at least I have
better characterized the problem.

Jason

Attachment: setuid.cc
Description: Text document

--
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple
Bug reporting:         http://cygwin.com/bugs.html
Documentation:         http://cygwin.com/docs.html
FAQ:                   http://cygwin.com/faq/

Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]