>>>>> "PC" == professor chen writes:

PC> I want to setup cygwin sshd on an SBS2003 server, to allow users
PC> to log on to their workstations. What I don't want however is for
PC> the users to log on with their SBS domain credentials.

If you allow publickey only, this will happen, since the server needs the
password (or Kerberos/NTLM via GSSAPI) to obtain domain credentials.

PC> I don't even want them to have the rights to amend their ssh keys
PC> by running ssh_keygen after the logon to ssh or even see them,
PC> unless I permit it.

The "or even see them" part doesn't make sense, since in order to log in
with publickey they must have the private keys, from which one can always
derive the public components.

--
Richard Silverman
res@qoxp.net