ssh to 2003 server exist immediately
Andrew DeFaria
Andrew@DeFaria.com
Sun May 14 03:25:00 GMT 2006
Larry Hall (Cygwin) wrote:
> Andrew DeFaria wrote:
>> Larry Hall (Cygwin) wrote:
>>> Andrew DeFaria wrote:
>>>> Larry Hall (Cygwin) wrote:
>>>>> Andrew DeFaria wrote:
>>>>>> I'm trying to set up ssh access to a Windows 2003 server. I am
>>>>>> having a problem in that when I ssh to this server it immediately
>>>>>> exits and I find the following in /var/log/sshd.log:
>>>>>>
>>>>>> 5 [main] sshd 12912 C:\Cygwin\usr\sbin\sshd.exe: *** fatal
>>>>>> error - could not load ws2_32, Win32 error 0
>>>>>>
>>>>>> Forgive me I did do some research about setting up ssh on a 2003
>>>>>> server and I believe I've very close to having it set up
>>>>>> correctly but I'm still missing something. I created a local
>>>>>> sshd_server user and added things like "Act as part of the
>>>>>> operating system", "Replace process level token", etc. I did not
>>>>>> see a setting for "Increase quota". Note that I am using a local
>>>>>> sshd_server users (i.e. <machine>\sshd_server) as the logon for
>>>>>> the sshd service. I don't believe I'm using privilege separation.
>>>>>>
>>>>>> I had to use mmc and a Group Policy editor for the domain to add
>>>>>> this local user into the rights at the domain level before this
>>>>>> would work. Still when I try to ssh in I get a password prompt
>>>>>> but after that the above gets written into the sshd.log and the
>>>>>> prompt returns.
>>>>>>
>>>>>> Note that I also use this local sshd_server user for inetd so
>>>>>> that rsh can and does work. Insecure I know and I'd like to
>>>>>> switch this client over to using all ssh but I gotta get it
>>>>>> working for them.
>>>>>>
>>>>>> Thanks in advance.
>>>>> Why not use ssh-host-config to set up sshd? It will create
>>>>> sshd_server for you in the proper way.
>>>> I did! sshd_server would not have been my choice of a username had
>>>> I done this by hand (the user daemon comes to mind). However that
>>>> was not working. This is a domain environment so the sshd_server
>>>> user could be <domain>\sshd_server or <local machine>\sshd_server.
>>>> I don't think I have enough privilege to add a domain user so I
>>>> made it a local user.
>>>>
>>>> Plus I believe that domain policies did not allow me to modify the
>>>> user rights of this local user. (From memory) I believe I went into
>>>> mmc and added the Group Policy Editor snapin then attempted to add
>>>> the local sshd_server to the users that have say "Act as part of
>>>> the operating system" rights but the add button was grayed out.
>>>> Last night while trying again I noticed I could add Domain Group
>>>> Policy snapin and much to my surprise I was able to add the <local
>>>> server>\sshd_server user to the "Act as part of operating system"
>>>> and "replace process level token" lists. Again I didn't see an
>>>> "Increase quota". This got inetd and rsh working but ssh still
>>>> produces an error.
>>>>
>>>> Actually, assuming I can create say a domain "daemon" user for use
>>>> with sshd and inetd, etc., would it be better to do this at the
>>>> domain level. I would like to allow others in the domain to set up
>>>> ssh or inetd with the rights to SU...
>>> No tweaking of the permissions for sshd_server is necessary and it's
>>> not required to add sshd_server to any other users to get things to
>>> work. sshd_server is a local user created to run the service and
>>> nothing else. To login via 'ssh' with a domain user, just make sure
>>> the domain user is in your '/etc/passwd' file and your '/etc/group'
>>> file contains the proper
>>> domain groups. See 'man mkpasswd' and 'man mkgroup' if these users
>>> and groups are not already in these files.
>> /etc/passwd and /etc/group are symlinks to a shared and up to date
>> copy of the output of mkpasswd/mkgroup. That's not the issue. As I
>> understand it, for sshd (or in.rlogind) to "switch user" it needs
>> special privileges. Indeed the documentation alludes to that. And
>> until I added those permissions to the sshd_server user ssh/rsh would
>> not work at all.
> But if you ran /bin/ssh-host-config and told it to create sshd_server
> when it asked you to, it will add these rights automatically. There's
> no need to do it yourself. Just take a look at /bin/ssh-host-config.
> The calls to "editrights" in the section that handles the creation of
> the sshd_server user/group specifically adds the privileges that are
> necessary to switch the user context on W2K3. If it failed to set
> these permission you should have been warned.
I don't recall getting errors from ssh-host-config initially. I thought
that perhaps some sort of domain policy might be overriding me. In any
event I had high hopes that redoing this would correct the problems but
it doesn't appear to have. Here's what I did:
* Stopped current sshd service (net stop sshd)
* Removed service (cygrunsrv -R sshd)
* Removed local sshd_server account since I want ssh-host-config to
recreate it
* Removed /var/empty and /var/log/sshd.log, again I want ssh-host-config
to create these properly
* Ran ssh-host-config:
$ ssh-host-config
Overwrite existing /etc/ssh_config file? (yes/no) yes
Generating /etc/ssh_config file
Overwrite existing /etc/sshd_config file? (yes/no) yes
Privilege separation is set to yes by default since OpenSSH 3.3.
However, this requires a non-privileged account called 'sshd'.
For more info on privilege separation read
/usr/share/doc/openssh/README.privsep.
Should privilege separation be used? (yes/no) no
Generating /etc/sshd_config file
Warning: The following functions require administrator privileges!
Do you want to install sshd as service?
(Say "no" if it's already installed as service) (yes/no) yes
You appear to be running Windows 2003 Server or later. On 2003 and
later systems, it's not possible to use the LocalSystem account
if sshd should allow passwordless logon (e. g. public key authentication).
If you want to enable that functionality, it's required to create a new
account 'sshd_server' with special privileges, which is then used to run
the sshd service under.
Should this script create a new local account 'sshd_server' which has
the required privileges? (yes/no) yes
Please enter a password for new user 'sshd_server'. Please be sure that
this password matches the password rules given on your system.
Entering no password will exit the configuration. PASSWORD=******
WARNING: User sshd_server has password expiry set to system default.
Please check that password never expires or set it to your needs.
User 'sshd_server' has been created with password '******'.
If you change the password, please keep in mind to change the password
for the sshd service, too.
Also keep in mind that the user sshd_server needs read permissions on all
users' .ssh/authorized_keys file to allow public key authentication for
these users!. (Re-)running ssh-user-config for each user will set the
required permissions correctly.
Which value should the environment variable CYGWIN have when
sshd starts? It's recommended to set at least "ntsec" to be
able to change user context without password.
Default is "ntsec". CYGWIN=ntsec smbntsec
The service has been installed under sshd_server account.
To start the service, call `net start sshd' or `cygrunsrv -S sshd'.
chown: changing ownership of `/var/empty': Invalid argument
Host configuration finished. Have fun!
NOTE: I don't know why I have the chown error on /var/empty. On other
working systems it's owned by SYSTEM:SYSTEM so I:
$ chown SYSTEM:SYSTEM /var/empty
$ ls -ld /var/empty
drwxr-xr-x+ 2 SYSTEM SYSTEM 0 May 13 19:52 /var/empty/
* Start sshd (net start sshd)
* Check /var/log/sshd.log
$ ls -l /var/log/sshd.log
-rw-r--r-- 1 sshd_server ???????? 0 May 13 19:56 /var/log/sshd.log
Not sure why it's got a weird group (GID 109).
* Try and ssh into the local machine from the local machine:
$ ssh sons-sc-cc
ccadmin@sons-sc-cc's password:
Connection to sons-sc-cc closed.
$
* Checked the contents of the sshd.log:
$ cat /var/log/sshd.log
4 [main] sshd 8236 C:\Cygwin\usr\sbin\sshd.exe: *** fatal error -
could not load ws2_32, Win32 error 0
Same problem.
>> (rsh, started from inetd that is as inetd was also logging on as the
>> sshd_server user). Still, while rsh works, ssh refuses to work citing
>> the error message above in /var/log/sshd.log. IOW I can rsh <server>
>> and get in. I can also rsh <server> <command> and have <command> run
>> on <server> (provided /etc/passwd on <server> has a blank password
>> for the user). However I cannot ssh <server>. When I do so it prompts
>> for the password then abruptly logs out with the only clue left in
>> <server>:/var/log/sshd.log.
> Well you can always run the client and the server in debug mode and
> track each one's progress. The server is always a little more
> helpful. But if you can't figure out anything else, I'd go back and
> retry running /bin/ssh-host-config after deleting the sshd_server
> user/group. Pay close attention to what it says concerning sshd_server.
Well trying that gives me:
$ /usr/sbin/sshd -d
debug1: sshd version OpenSSH_4.3p2
Could not load host key: /etc/ssh_host_key
Could not load host key: /etc/ssh_host_rsa_key
Could not load host key: /etc/ssh_host_dsa_key
Disabling protocol version 1. Could not load host key
Disabling protocol version 2. Could not load host key
sshd: no hostkeys available -- exiting.
Apparently my user can't read on of those key files...
Chmod'ing them to 644 gets me to be able to start sshd with -d.
Attempting to ssh in then works! Hmmm... Chmod'ing back to 600 on those
ssh_host_*_key files and restarting sshd fails as before.
Trying to runas sshd_server says that user doesn't have login rights.
Used editrights to add SeInteractiveLogin right and remove
SeDenyInteractiveLogin right for the sshd_server user. Ran cmd as
sshd_server and then sshd -d. Attempted ssh to login and now I see....
Failed publickey for ccadmin from 192.168.0.99 port 4578 ssh2
debug1: userauth-request for user ccadmin service ssh-connection method
keyboard
-interactive
debug1: attempt 3 failures 3
debug1: keyboard-interactive devs
debug1: auth2_challenge: user=ccadmin devs=
debug1: kbdint_alloc: devices ''
Failed keyboard-interactive for ccadmin from 192.168.0.99 port 4578 ssh2
debug1: userauth-request for user ccadmin service ssh-connection method
password
debug1: attempt 4 failures 4
Accepted password for ccadmin from 192.168.0.99 port 4578 ssh2
debug1: Entering interactive session for SSH2.
debug1: server_init_dispatch_20
debug1: server_input_channel_open: ctype session rchan 0 win 65536 max 16384
debug1: input_session_request
debug1: channel 0: new [server-session]
debug1: session_new: init
debug1: session_new: session 0
debug1: session_open: channel 0
debug1: session_open: session 0: link with channel 0
debug1: server_input_channel_open: confirm session
debug1: server_input_channel_req: channel 0 request pty-req reply 0
debug1: session_by_channel: session 0 channel 0
debug1: session_input_channel_req: session 0 req pty-req
debug1: Allocating pty.
debug1: session_pty_req: session 0 alloc /dev/tty5
debug1: server_input_channel_req: channel 0 request shell reply 0
debug1: session_by_channel: session 0 channel 0
debug1: session_input_channel_req: session 0 req shell
4 [main] sshd 5480 C:\Cygwin\usr\sbin\sshd.exe: *** fatal error -
could not load ws2_32, Win32 error 0
debug1: Received SIGCHLD.
debug1: session_by_pid: pid 5480
debug1: session_exit_message: session 0 channel 0 pid 5480
debug1: session_exit_message: release channel 0
debug1: session_pty_cleanup: session 0 release /dev/tty5
syslogin_perform_logout: logout() returned an error
debug1: session_by_channel: session 0 channel 0
debug1: session_close_by_channel: channel 0 child 0
debug1: session_close: session 0 pid 0
debug1: channel 0: free: server-session, nchannels 1
Connection closed by 192.168.0.99
debug1: do_cleanup
Closing connection to 192.168.0.99
So this verifies the same thing I see in /var/log/sshd.log: sshd cannot
load ws2_32 for some reason!
--
FATAL ERROR! SYSTEM HALTED! - Press any key to do nothing.
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: cygcheck.out
URL: <http://cygwin.com/pipermail/cygwin/attachments/20060514/8b08a1b0/attachment.ksh>
-------------- next part --------------
--
Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple
Problem reports: http://cygwin.com/problems.html
Documentation: http://cygwin.com/docs.html
FAQ: http://cygwin.com/faq/
More information about the Cygwin
mailing list