如何在域和 Linux 活动目录中启用指纹传感器

Question

user1173240

Asked: 2019-06-08 01:34:30 +0800 CST2019-06-08 01:34:30 +0800 CST 2019-06-08 01:34:30 +0800 CST

Windows SSH 服务器拒绝来自客户端的基于密钥的身份验证

772

在 Windows 10 1809 上，我启用了内置的 SSH 服务器，并进行了配置。

在另一台机器上，我使用 WinSCP 和 PuTTy 生成器生成身份验证密钥。我复制了公钥部分并将其附加到.ssh\authorized_keys我的 SSH 服务器用户的文件中。我根据需要为密钥文件固定了文件权限，仅对我的用户（即登录用户）有效。

在客户端计算机上，我使用 .PPK 私钥和 WinSCP 尝试连接到与我的服务器的 SFTP 会话，但我收到一条消息，表明服务器拒绝了我选择的密钥。

我可以使用密码进行身份验证，但密钥对无法正常工作。通过挖掘sshd服务器上生成的日志，我看到了这个：

10200 2019-06-07 01:38:16.376 debug1: attempt 1 failures 0 [preauth]
10200 2019-06-07 01:38:16.376 debug2: input_userauth_request: try method publickey [preauth]
10200 2019-06-07 01:38:16.376 debug1: userauth_pubkey: test pkalg ssh-rsa pkblob RSA SHA256:B6s0omPbz6HJB2cIZf3+5MKHU42wp+JfOTyAM+EVqoY [preauth]
10200 2019-06-07 01:38:16.376 debug2: userauth_pubkey: disabled because of invalid user [preauth]

我不确定这里发生了什么，以及这是否是连接被拒绝的原因。防火墙不是问题，因为我可以使用密码身份验证登录服务器。客户端机器和 WinScp 在服务器上被识别，只是服务器拒绝提供的密钥。

PuTTy 生成的密钥（或用公钥复制的密钥内容）是否在任何地方都不支持？没有与密钥关联的密码，但我认为这不是问题。

服务器计算机上只有一个用户，即登录用户。该sshd服务正在LOCAL SYSTEM帐户下运行。它是否应该在用户帐户下运行（我试过但服务根本没有启动，事件日志抱怨缺少权限......）

编辑 - 更多信息

我在以下内容中注释掉了sshd_config：

 #Match Group administrators  
 #      AuthorizedKeysFile __PROGRAMDATA__/ssh/administrators_authorized_keys

但是现在，连接尝试抱怨authorized_keys权限不正确。该机器只有一个用户，并且该用户authorized_keys的 .ssh 文件夹中只有该用户访问权限。我尝试Repair-AuthorizedKeyPermission在密钥文件上使用，它将 SYSTEM 和 sshd（NT 服务用户）作为用户添加到密钥文件，sshd 具有读取权限。但是现在，连接尝试抱怨为用户设置了错误的权限，S-1-5-80这NT Service user sshd与Repair-AutorizedKeyFile. 再次删除该用户的读取权限（仅权限）会出现旧错误，说Access Denied.

编辑 - sshd.exe 来自连接尝试的日志：

> 2696 2019-06-10 03:57:09.020 debug2: fd 3 setting O_NONBLOCK
> 
> 2696 2019-06-10 03:57:09.020 debug3: sock_set_v6only: set socket 3
> IPV6_V6ONLY
> 
> 2696 2019-06-10 03:57:09.020 debug1: Bind to port 22 on ::.
> 
> 2696 2019-06-10 03:57:09.020 Server listening on :: port 22.
> 
> 2696 2019-06-10 03:57:09.020 debug2: fd 4 setting O_NONBLOCK
> 
> 2696 2019-06-10 03:57:09.020 debug1: Bind to port 22 on 0.0.0.0.
> 
> 2696 2019-06-10 03:57:09.020 Server listening on 0.0.0.0 port 22.
> 
> 2696 2019-06-10 03:57:35.475 debug3: fd 5 is not O_NONBLOCK
> 
> 2696 2019-06-10 03:57:35.477 debug3: spawning
> "C:\\WINDOWS\\System32\\OpenSSH\\sshd.exe" "-R"
> 
> 2696 2019-06-10 03:57:35.483 debug3: send_rexec_state: entering fd = 8
> config len 287
> 
> 2696 2019-06-10 03:57:35.484 debug3: ssh_msg_send: type 0
> 
> 2696 2019-06-10 03:57:35.485 debug3: send_rexec_state: done
> 
> 9428 2019-06-10 03:57:35.556 debug1: inetd sockets after dupping: 3, 3
> 
> 9428 2019-06-10 03:57:35.556 Connection from 130.147.168.135 port
> 64534 on 161.85.17.107 port 22
> 
> 9428 2019-06-10 03:57:35.556 debug1: Client protocol version 2.0;
> client software version WinSCP_release_5.15.2
> 
> 9428 2019-06-10 03:57:35.556 debug1: no match: WinSCP_release_5.15.2
> 
> 9428 2019-06-10 03:57:35.556 debug1: Local version string
> SSH-2.0-OpenSSH_for_Windows_7.7
> 
> 9428 2019-06-10 03:57:35.556 debug2: fd 3 setting O_NONBLOCK
> 
> 9428 2019-06-10 03:57:35.568 debug3: spawning
> "C:\\WINDOWS\\System32\\OpenSSH\\sshd.exe" "-y"
> 
> 9428 2019-06-10 03:57:35.572 debug2: Network child is on pid 6944
> 
> 9428 2019-06-10 03:57:35.573 debug3: send_rexec_state: entering fd = 6
> config len 287
> 
> 9428 2019-06-10 03:57:35.573 debug3: ssh_msg_send: type 0
> 
> 9428 2019-06-10 03:57:35.575 debug3: send_rexec_state: done
> 
> 9428 2019-06-10 03:57:35.575 debug3: ssh_msg_send: type 0
> 
> 9428 2019-06-10 03:57:35.576 debug3: ssh_msg_send: type 0
> 
> 9428 2019-06-10 03:57:35.576 debug3: preauth child monitor started
> 
> 9428 2019-06-10 03:57:35.607 debug1: list_hostkey_types:
> ssh-rsa,rsa-sha2-512,rsa-sha2-256,ecdsa-sha2-nistp256,ssh-ed25519
> [preauth]
> 
> 9428 2019-06-10 03:57:35.607 debug3: send packet: type 20 [preauth]
> 
> 9428 2019-06-10 03:57:35.607 debug1: SSH2_MSG_KEXINIT sent [preauth]
> 
> 9428 2019-06-10 03:57:35.794 debug3: receive packet: type 20 [preauth]
> 
> 9428 2019-06-10 03:57:35.794 debug1: SSH2_MSG_KEXINIT received
> [preauth]
> 
> 9428 2019-06-10 03:57:35.795 debug2: local server KEXINIT proposal
> [preauth]
> 
> 9428 2019-06-10 03:57:35.796 debug2: KEX algorithms:
> curve25519-sha256,[email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1
> [preauth]
> 
> 9428 2019-06-10 03:57:35.797 debug2: host key algorithms:
> ssh-rsa,rsa-sha2-512,rsa-sha2-256,ecdsa-sha2-nistp256,ssh-ed25519
> [preauth]
> 
> 9428 2019-06-10 03:57:35.798 debug2: ciphers ctos:
> [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected]
> [preauth]
> 
> 9428 2019-06-10 03:57:35.798 debug2: ciphers stoc:
> [email protected],aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected]
> [preauth]
> 
> 9428 2019-06-10 03:57:35.798 debug2: MACs ctos:
> [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1
> [preauth]
> 
> 9428 2019-06-10 03:57:35.798 debug2: MACs stoc:
> [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-sha1
> [preauth]
> 
> 9428 2019-06-10 03:57:35.798 debug2: compression ctos: none [preauth]
> 
> 9428 2019-06-10 03:57:35.798 debug2: compression stoc: none [preauth]
> 
> 9428 2019-06-10 03:57:35.799 debug2: languages ctos:  [preauth]
> 
> 9428 2019-06-10 03:57:35.799 debug2: languages stoc:  [preauth]
> 
> 9428 2019-06-10 03:57:35.799 debug2: first_kex_follows 0  [preauth]
> 
> 9428 2019-06-10 03:57:35.799 debug2: reserved 0  [preauth]
> 
> 9428 2019-06-10 03:57:35.799 debug2: peer client KEXINIT proposal
> [preauth]
> 
> 9428 2019-06-10 03:57:35.799 debug2: KEX algorithms:
> [email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,rsa2048-sha256,rsa1024-sha1,diffie-hellman-group1-sha1
> [preauth]
> 
> 9428 2019-06-10 03:57:35.799 debug2: host key algorithms:
> ssh-ed25519,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss [preauth]
> 
> 9428 2019-06-10 03:57:35.799 debug2: ciphers ctos:
> aes256-ctr,aes256-cbc,[email protected],aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,[email protected],blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128
> [preauth]
> 
> 9428 2019-06-10 03:57:35.800 debug2: ciphers stoc:
> aes256-ctr,aes256-cbc,[email protected],aes192-ctr,aes192-cbc,aes128-ctr,aes128-cbc,[email protected],blowfish-ctr,blowfish-cbc,3des-ctr,3des-cbc,arcfour256,arcfour128
> [preauth]
> 
> 9428 2019-06-10 03:57:35.800 debug2: MACs ctos:
> hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,[email protected],[email protected],[email protected],[email protected] [preauth]
> 
> 9428 2019-06-10 03:57:35.800 debug2: MACs stoc:
> hmac-sha2-256,hmac-sha1,hmac-sha1-96,hmac-md5,[email protected],[email protected],[email protected],[email protected] [preauth]
> 
> 9428 2019-06-10 03:57:35.800 debug2: compression ctos: none,zlib
> [preauth]
> 
> 9428 2019-06-10 03:57:35.800 debug2: compression stoc: none,zlib
> [preauth]
> 
> 9428 2019-06-10 03:57:35.800 debug2: languages ctos:  [preauth]
> 
> 9428 2019-06-10 03:57:35.800 debug2: languages stoc:  [preauth]
> 
> 9428 2019-06-10 03:57:35.800 debug2: first_kex_follows 0  [preauth]
> 
> 9428 2019-06-10 03:57:35.800 debug2: reserved 0  [preauth]
> 
> 9428 2019-06-10 03:57:35.801 debug1: kex: algorithm:
> [email protected] [preauth]
> 
> 9428 2019-06-10 03:57:35.801 debug1: kex: host key algorithm:
> ssh-ed25519 [preauth]
> 
> 9428 2019-06-10 03:57:35.801 debug1: kex: client->server cipher:
> aes256-ctr MAC: hmac-sha2-256 compression: none [preauth]
> 
> 9428 2019-06-10 03:57:35.801 debug1: kex: server->client cipher:
> aes256-ctr MAC: hmac-sha2-256 compression: none [preauth]
> 
> 9428 2019-06-10 03:57:35.801 debug1: expecting SSH2_MSG_KEX_ECDH_INIT
> [preauth]
> 
> 9428 2019-06-10 03:57:35.834 debug3: receive packet: type 30 [preauth]
> 
> 9428 2019-06-10 03:57:35.843 debug3: mm_key_sign entering [preauth]
> 
> 9428 2019-06-10 03:57:35.843 debug3: mm_request_send entering: type 6
> [preauth]
> 
> 9428 2019-06-10 03:57:35.843 debug3: mm_key_sign: waiting for
> MONITOR_ANS_SIGN [preauth]
> 
> 9428 2019-06-10 03:57:35.843 debug3: mm_request_receive_expect
> entering: type 7 [preauth]
> 
> 9428 2019-06-10 03:57:35.843 debug3: mm_request_receive entering
> [preauth]
> 
> 9428 2019-06-10 03:57:35.843 debug3: mm_request_receive entering
> 
> 9428 2019-06-10 03:57:35.843 debug3: monitor_read: checking request 6
> 
> 9428 2019-06-10 03:57:35.843 debug3: mm_answer_sign
> 
> 9428 2019-06-10 03:57:35.846 debug3: mm_answer_sign: hostkey proof
> signature 0000029369ED8600(83)
> 
> 9428 2019-06-10 03:57:35.846 debug3: mm_request_send entering: type 7
> 
> 9428 2019-06-10 03:57:35.846 debug2: monitor_read: 6 used once,
> disabling now
> 
> 9428 2019-06-10 03:57:35.846 debug3: send packet: type 31 [preauth]
> 
> 9428 2019-06-10 03:57:35.846 debug3: send packet: type 21 [preauth]
> 
> 9428 2019-06-10 03:57:35.846 debug2: set_newkeys: mode 1 [preauth]
> 
> 9428 2019-06-10 03:57:35.846 debug1: rekey after 4294967296 blocks
> [preauth]
> 
> 9428 2019-06-10 03:57:35.846 debug1: SSH2_MSG_NEWKEYS sent [preauth]
> 
> 9428 2019-06-10 03:57:35.846 debug1: expecting SSH2_MSG_NEWKEYS
> [preauth]
> 
> 9428 2019-06-10 03:57:36.356 debug3: receive packet: type 21 [preauth]
> 
> 9428 2019-06-10 03:57:36.356 debug1: SSH2_MSG_NEWKEYS received
> [preauth]
> 
> 9428 2019-06-10 03:57:36.356 debug2: set_newkeys: mode 0 [preauth]
> 
> 9428 2019-06-10 03:57:36.356 debug1: rekey after 4294967296 blocks
> [preauth]
> 
> 9428 2019-06-10 03:57:36.356 debug1: KEX done [preauth]
> 
> 9428 2019-06-10 03:57:36.399 debug3: receive packet: type 5 [preauth]
> 
> 9428 2019-06-10 03:57:36.399 debug3: send packet: type 6 [preauth]
> 
> 9428 2019-06-10 03:57:36.435 debug3: receive packet: type 50 [preauth]
> 
> 9428 2019-06-10 03:57:36.435 debug1: userauth-request for user
> TestUser service ssh-connection method none [preauth]
> 
> 9428 2019-06-10 03:57:36.435 debug1: attempt 0 failures 0 [preauth]
> 
> 9428 2019-06-10 03:57:36.435 debug3: mm_getpwnamallow entering
> [preauth]
> 
> 9428 2019-06-10 03:57:36.436 debug3: mm_request_send entering: type 8
> [preauth]
> 
> 9428 2019-06-10 03:57:36.436 debug3: mm_getpwnamallow: waiting for
> MONITOR_ANS_PWNAM [preauth]
> 
> 9428 2019-06-10 03:57:36.436 debug3: mm_request_receive_expect
> entering: type 9 [preauth]
> 
> 9428 2019-06-10 03:57:36.436 debug3: mm_request_receive entering
> [preauth]
> 
> 9428 2019-06-10 03:57:36.436 debug3: mm_request_receive entering
> 
> 9428 2019-06-10 03:57:36.436 debug3: monitor_read: checking request 8
> 
> 9428 2019-06-10 03:57:36.436 debug3: mm_answer_pwnamallow
> 
> 9428 2019-06-10 03:57:36.439 debug2: parse_server_config: config
> reprocess config len 287
> 
> 9428 2019-06-10 03:57:36.439 debug3: checking match for 'Group
> administrators' user TestUser host 130.147.168.135 addr
> 130.147.168.135 laddr 161.85.17.107 lport 22
> 
> 9428 2019-06-10 03:57:36.446 debug3: LsaLogonUser Succeeded
> (Impersonation: 0)
> 
> 9428 2019-06-10 03:57:36.448 debug1: user TestUser matched group list
> administrators at line 84
> 
> 9428 2019-06-10 03:57:36.448 debug3: match found
> 
> 9428 2019-06-10 03:57:36.448 debug3: reprocess config:85 setting
> AuthorizedKeysFile __PROGRAMDATA__/ssh/administrators_authorized_keys
> 
> 9428 2019-06-10 03:57:36.449 debug3: mm_answer_pwnamallow: sending
> MONITOR_ANS_PWNAM: 1
> 
> 9428 2019-06-10 03:57:36.449 debug3: mm_request_send entering: type 9
> 
> 9428 2019-06-10 03:57:36.450 debug2: monitor_read: 8 used once,
> disabling now
> 
> 9428 2019-06-10 03:57:36.450 debug2: input_userauth_request: setting
> up authctxt for TestUser [preauth]
> 
> 9428 2019-06-10 03:57:36.450 debug3: mm_inform_authserv entering
> [preauth]
> 
> 9428 2019-06-10 03:57:36.450 debug3: mm_request_send entering: type 4
> [preauth]
> 
> 9428 2019-06-10 03:57:36.451 debug3: mm_request_receive entering
> 
> 9428 2019-06-10 03:57:36.451 debug3: monitor_read: checking request 4
> 
> 9428 2019-06-10 03:57:36.451 debug3: mm_answer_authserv:
> service=ssh-connection, style=
> 
> 9428 2019-06-10 03:57:36.451 debug2: monitor_read: 4 used once,
> disabling now
> 
> 9428 2019-06-10 03:57:36.451 debug2: input_userauth_request: try
> method none [preauth]
> 
> 9428 2019-06-10 03:57:36.452 debug3: userauth_finish: failure
> partial=0 next methods="publickey,password,keyboard-interactive"
> [preauth]
> 
> 9428 2019-06-10 03:57:36.452 debug3: send packet: type 51 [preauth]
> 
> 9428 2019-06-10 03:57:36.453 debug3: receive packet: type 50 [preauth]
> 
> 9428 2019-06-10 03:57:36.453 debug1: userauth-request for user
> TestUser service ssh-connection method publickey [preauth]
> 
> 9428 2019-06-10 03:57:36.453 debug1: attempt 1 failures 0 [preauth]
> 
> 9428 2019-06-10 03:57:36.454 debug2: input_userauth_request: try
> method publickey [preauth]
> 
> 9428 2019-06-10 03:57:36.454 debug1: userauth_pubkey: test pkalg
> ssh-rsa pkblob RSA SHA256:ospJEFHH81sy96YBMFEySGGUokk1KZHV+AbgNTFRrjE
> [preauth]
> 
> 9428 2019-06-10 03:57:36.455 debug3: mm_key_allowed entering [preauth]
> 
> 9428 2019-06-10 03:57:36.455 debug3: mm_request_send entering: type 22
> [preauth]
> 
> 9428 2019-06-10 03:57:36.455 debug3: mm_request_receive entering
> 
> 9428 2019-06-10 03:57:36.455 debug3: monitor_read: checking request 22
> 
> 9428 2019-06-10 03:57:36.456 debug3: mm_answer_keyallowed entering
> 
> 9428 2019-06-10 03:57:36.456 debug3: mm_answer_keyallowed:
> key_from_blob: 0000029369F0D8B0
> 
> 9428 2019-06-10 03:57:36.456 debug1: trying public key file
> __PROGRAMDATA__/ssh/administrators_authorized_keys
> 
> 9428 2019-06-10 03:57:36.456 debug3: Failed to open
> file:C:/ProgramData/ssh/administrators_authorized_keys error:2
> 
> 9428 2019-06-10 03:57:36.456 debug1: Could not open authorized keys
> '__PROGRAMDATA__/ssh/administrators_authorized_keys': No such file or
> directory
> 
> 9428 2019-06-10 03:57:36.456 debug3: mm_answer_keyallowed: publickey
> authentication test: RSA key is not allowed
> 
> 9428 2019-06-10 03:57:36.456 Failed publickey for TestUser from
> 130.147.168.135 port 64534 ssh2: RSA SHA256:ospJEFHH81sy96YBMFEySGGUokk1KZHV+AbgNTFRrjE
> 
> 9428 2019-06-10 03:57:36.456 debug3: mm_request_send entering: type 23
> 
> 9428 2019-06-10 03:57:36.457 debug3: mm_key_allowed: waiting for
> MONITOR_ANS_KEYALLOWED [preauth]
> 
> 9428 2019-06-10 03:57:36.457 debug3: mm_request_receive_expect
> entering: type 23 [preauth]
> 
> 9428 2019-06-10 03:57:36.457 debug3: mm_request_receive entering
> [preauth]
> 
> 9428 2019-06-10 03:57:36.457 debug2: userauth_pubkey: authenticated 0
> pkalg ssh-rsa [preauth]
> 
> 9428 2019-06-10 03:57:36.457 debug3: userauth_finish: failure
> partial=0 next methods="publickey,password,keyboard-interactive"
> [preauth]
> 
> 9428 2019-06-10 03:57:36.457 debug3: send packet: type 51 [preauth]
> 
> 9428 2019-06-10 03:57:36.482 debug3: receive packet: type 50 [preauth]
> 
> 9428 2019-06-10 03:57:36.482 debug1: userauth-request for user
> TestUser service ssh-connection method keyboard-interactive [preauth]
> 
> 9428 2019-06-10 03:57:36.482 debug1: attempt 2 failures 1 [preauth]
> 
> 9428 2019-06-10 03:57:36.482 debug2: input_userauth_request: try
> method keyboard-interactive [preauth]
> 
> 9428 2019-06-10 03:57:36.482 debug1: keyboard-interactive devs 
> [preauth]
> 
> 9428 2019-06-10 03:57:36.483 debug1: auth2_challenge: user=TestUser
> devs= [preauth]
> 
> 9428 2019-06-10 03:57:36.483 debug1: kbdint_alloc: devices ''
> [preauth]
> 
> 9428 2019-06-10 03:57:36.483 debug2: auth2_challenge_start: devices 
> [preauth]
> 
> 9428 2019-06-10 03:57:36.483 debug3: userauth_finish: failure
> partial=0 next methods="publickey,password,keyboard-interactive"
> [preauth]
> 
> 9428 2019-06-10 03:57:36.483 debug3: send packet: type 51 [preauth]

4 个回答

Voted

Bob · Answer 1 · 2019-06-11T20:04:11+08:00

从 Windows 10 v1809 开始，默认配置（在中找到）为管理员用户%ProgramData%/ssh/sshd_config定义了一个单独的配置：AuthorizedKeysFile

Match Group administrators
       AuthorizedKeysFile __PROGRAMDATA__/ssh/administrators_authorized_keys

This means any user who is in the special Windows Administrators group (SID S-1-5-32-544) will not look at the %UserProfile%/.ssh/authorized_keys file but will rather look at %ProgramData%/ssh/administrators_authorized_keys.

You have a few options:

Use a non-administrator user, or
Comment out those two lines from the bottom of sshd_config, which will then revert back to the default per-user AuthorizedKeysFile, or
Add your keys to the (global!) administrators_authorized_keys file

My recommendation is to use a non-admin user if possible, or modify the config otherwise. A global key that is accepted for any account in the Administrators group sounds like unnecessary complexity.¹

¹ In a default config it is always possible to impersonate any other user from an admin user, since an admin user generally implies full root-level control in Windows. That might be their rationale for this default. But of course it makes configuration of a multi-user system rather confusing, where some (non-admin) users have their own authorized keys in a standard location while other (admin) users must share a single nonstandard authorized key list.

I believe there are no security benefits to such a configuration, apart from making it obvious that all admins can impersonate each other.

A future release may create user-specific folders under %ProgramData/ssh.

This is somewhat explored here: https://github.com/PowerShell/Win32-OpenSSH/issues/1324

Stephen Quan · Answer 2 · 2020-11-26T13:27:04+08:00

OpenSSH on Windows 10 requires additional configuration to recognize authorized_keys:

Save your authorized_keys into the file C:\ProgramData\ssh\administrators_authorized_keys with no extension
Use the below PowerShell script to set the correct permissions on the file

    $acl = Get-Acl C:\ProgramData\ssh\administrators_authorized_keys
    $acl.SetAccessRuleProtection($true, $false)
    $administratorsRule = New-Object system.security.accesscontrol.filesystemaccessrule("Administrators","FullControl","Allow")
    $systemRule = New-Object system.security.accesscontrol.filesystemaccessrule("SYSTEM","FullControl","Allow")
    $acl.SetAccessRule($administratorsRule)
    $acl.SetAccessRule($systemRule)
    $acl | Set-Acl

This, effectively, grants Full Control privileges to the administrators_authorized_keys file to both Administrators and SYSTEM.

If you don't do this, and instead only place the file in the .ssh folder for the user, you'll either get prompted for your password (instead of using the key file), or your connection will fail with "Too many authentication attempts".

References:

https://www.concurrency.com/blog/may-2019/key-based-authentication-for-openssh-on-windows

user159960 · Answer 3 · 2019-08-05T04:44:09+08:00

Try to put more details here, if anyone has installed a built-in openssh server in Windows 10 (build 1809 or later, or Server 2016), whether or not following Microsoft's documents: Installation, Configuration and Key management. Seems they're pretty old or sort of incomplete and need updating.

After installation of this service, start it, you should connect it from your localhost via ssh username@localhost, assuming your Windows login name is username. But we want key based authentications and we must fail only according to Microsoft documents listed above:

We can't rely on Repair-AuthorizedKeyPermission to fix authorized_keys's permission, since we can't install OpenSSHUtils module for now. Reason here, seems the signature is outdated.
As @Bob indicated, we have to comment something in sshd_config if we don't setup key pair for Administrators.

If you just want use a single user's key based authentication, we just have to do as follows (Administrator privilege is required, all based on default built-in openssh server installation):

Since we can't install OpenSSHUtils module, we set the permissions manually. Check authorized_keys's ownership and permissions:

PS C:\>(get-acl .\users\username\.ssh\authorized_keys).owner
username
PS C:\>icacls .\users\username\.ssh\authorized_keys
ssh_host_dsa_key   BUILTIN\Administrators:(F)
                   username:(F) 
                   otheruser1:(IR)
                   otheruser2:(R)

Set correct ownership and permissions for authorized_keys:

PS C:\>icacls .\users\username\.ssh\authorized_keys /inheritance:r
PS C:\>icacls .\users\username\.ssh\authorized_keys /remove otheruser2

Search for and comment group matching policy in sshd_config:

#Match Group administrators
#       AuthorizedKeysFile __PROGRAMDATA__/ssh/administrators_authorized_keys

(Optional) Enable key based authentication. Search for and change the text to:

PubkeyAuthentication yes

(Optional) Disable password based authentication. Search for and change the text to:

PasswordAuthentication no

Copy and paste the user's public key into authorized_keys who you want to connect as.
Restart sshd service. Now you should connect to this host with key authentications.

Consult following links for more detailed contents (this answer comes from):

Ed'ka · Answer 4 · 2021-04-24T01:30:58+08:00

Ed'ka

2021-04-24T01:30:58+08:002021-04-24T01:30:58+08:00

Just to help someone like me who might be struggling to make public key authentication work for Administrator.

Make sure that only Administrators and SYSTEM can access C:\ProgramData\ssh\administrators_authorized_keys.
Basically you need to have the following security settings on your file:

In my case the file had also inherited permissions (so Authenticated Users could also access it) and as a result I was getting Failed publickey for Administrator error in sshd logs and could only login via password. Lost a couple hours trying to figure out why it wasn't working :-/

2

Windows SSH 服务器拒绝来自客户端的基于密钥的身份验证

Windows 照片查看器因为内存不足而无法运行？

支持结束后如何激活 WindowsXP？

远程桌面间歇性冻结

Windows 10 服务称为 AarSvc_70f961。它是什么，我该如何禁用它？

子网掩码 /32 是什么意思？

鼠标指针在 Windows 中按下的箭头键上移动？

VirtualBox 无法以 VERR_NEM_VM_CREATE_FAILED 启动

应用程序不会出现在 MacBook 的摄像头和麦克风隐私设置中

ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] 证书验证失败：无法获取本地颁发者证书 (_ssl.c:1056)

我如何知道 Windows 安装在哪个驱动器上？

Windows SSH 服务器拒绝来自客户端的基于密钥的身份验证

4 个回答

相关问题