[Win10 OpenSSH Server] Keybased login

[Mastakilla]

Het lukt me niet om keybased login aan het werken te krijgen. Met sshd in debug mode (sshd -ddd) zie ik volgende foutmelding:

code:

debug3: Bad permissions. Try removing permissions for user: S-1-5-80-3847866527-469524349-687026318-516638107-1125189541 on file C:/Users/m4st4/.ssh/authorized_keys.
Authentication refused.

met

code:

C:\Users\m4st4\Desktop>PsGetsid64.exe S-1-5-80-3847866527-469524349-687026318-516638107-1125189541

PsGetSid v1.45 - Translates SIDs to names and vice versa
Copyright (C) 1999-2016 Mark Russinovich
Sysinternals - www.sysinternals.com

Account for I7\S-1-5-80-3847866527-469524349-687026318-516638107-1125189541:
Well Known Group: NT SERVICE\sshd

hoewel wmic iets anders toont

code:

C:\Users\m4st4\Desktop>wmic useraccount get name,sid
Name                SID
Administrator       S-1-5-21-315302166-1028895185-691776241-500
DefaultAccount      S-1-5-21-315302166-1028895185-691776241-503
Guest               S-1-5-21-315302166-1028895185-691776241-501
m4st4               S-1-5-21-315302166-1028895185-691776241-1001
ReadOnly            S-1-5-21-315302166-1028895185-691776241-1006
sshd                S-1-5-21-315302166-1028895185-691776241-1007
WDAGUtilityAccount  S-1-5-21-315302166-1028895185-691776241-504

Maar toch, vrij duidelijk dat er iets mis is met de permissies voor user sshd? Echter heb ik al alles geprobeerd om het goed te krijgen... bv:

code:

PS C:\Users\m4st4\.ssh> Repair-AuthorizedKeyPermission C:\Users\m4st4\.ssh\authorized_keys
  [*] C:\Users\m4st4\.ssh\authorized_keys
'NT SERVICE\sshd' now has Read access to 'C:\Users\m4st4\.ssh\authorized_keys'.
      Repaired permissions

Heb ook alle inheritance afgezet en dit geprobeert

code:

C:\Users\m4st4\Desktop>icacls %USERPROFILE%\.ssh\authorized_keys /grant "NT SERVICE\sshd":(R)
processed file: C:\Users\m4st4\.ssh\authorized_keys
Successfully processed 1 files; Failed processing 0 files

C:\Users\m4st4\Desktop>icacls %USERPROFILE%\.ssh\authorized_keys /grant "i7\m4st4":(F)
processed file: C:\Users\m4st4\.ssh\authorized_keys
Successfully processed 1 files; Failed processing 0 files

Dit zijn de huidige (niet-werkende) permissies, maar ik heb intussen denk ik al bijna alle andere mogelijke combinaties geprobeerd... (suggesties zijn wel welkom)

code:

PS C:\Users\m4st4\.ssh> (Get-Acl).Access

FileSystemRights  : FullControl
AccessControlType : Allow
IdentityReference : NT AUTHORITY\SYSTEM
IsInherited       : False
InheritanceFlags  : ContainerInherit, ObjectInherit
PropagationFlags  : None

FileSystemRights  : FullControl
AccessControlType : Allow
IdentityReference : I7\m4st4
IsInherited       : False
InheritanceFlags  : ContainerInherit, ObjectInherit
PropagationFlags  : None

FileSystemRights  : Read, Synchronize
AccessControlType : Allow
IdentityReference : I7\sshd
IsInherited       : False
InheritanceFlags  : ContainerInherit, ObjectInherit
PropagationFlags  : None

PS C:\Users\m4st4\.ssh> (Get-Acl .\authorized_keys).Access

FileSystemRights  : FullControl
AccessControlType : Allow
IdentityReference : NT AUTHORITY\SYSTEM
IsInherited       : False
InheritanceFlags  : None
PropagationFlags  : None

FileSystemRights  : FullControl
AccessControlType : Allow
IdentityReference : I7\m4st4
IsInherited       : False
InheritanceFlags  : None
PropagationFlags  : None

FileSystemRights  : Read, Synchronize
AccessControlType : Allow
IdentityReference : NT SERVICE\sshd
IsInherited       : False
InheritanceFlags  : None
PropagationFlags  : None

[Mastakilla]

Ik heb het eindelijk aan het werken gekregen door een user te gebruiken in de administrators group en het volgende te doen:

1) Remove all users except Administrators and System for C:\ProgramData\ssh\administrators_authorized_keys
2) Perform the following in Powershell
$acl = Get-Acl C:\ProgramData\ssh\administrators_authorized_keys
$acl.SetAccessRuleProtection($true, $false)
$administratorsRule = New-Object system.security.accesscontrol.filesystemaccessrule("Administrators","FullControl","Allow")
$systemRule = New-Object system.security.accesscontrol.filesystemaccessrule("SYSTEM","FullControl","Allow")
$acl.SetAccessRule($administratorsRule)
$acl.SetAccessRule($systemRule)
$acl | Set-Acl