4

I have been trying to configure OpenSSH for my Windows 10 Professional Edition media server. I can get normal password login working without issue but I am trying to set up public key authentication.

I have edited my sshd_config file to allow for public key authentication. The client and the server are running ssh-agent. I've copied and pasted my SSH public key from the client computer into the file C:\ProgramData\ssh\administrators_authorized_keys since the account is an administrator account. Permissions on the above file are set the same as the other key files in the directory of being just SYSTEM and Administrators both with full control and no one else is listed.

I added debug logging and when I try to connect using the public key, I get this:

debug1: userauth-request for user uther service ssh-connection method none [preauth]
debug1: attempt 0 failures 0 [preauth]
debug1: user uther matched group list administrators at line 84
debug1: userauth-request for user uther service ssh-connection method publickey [preauth]
debug1: attempt 1 failures 0 [preauth]
debug1: userauth_pubkey: test pkalg ssh-rsa pkblob RSA SHA256:jcQNaVuxvH90SIh4zu8xduBqJaav1WFQJIov3hiFSFM [preauth]
debug1: trying public key file C:\\ProgramData\\ssh\\administrators_authorized_keys
Failed publickey for uther from 10.0.0.24 port 60432 ssh2: RSA SHA256:jcQNaVuxvH90SIh4zu8xduBqJaav1WFQJIov3hiFSFM
debug1: userauth-request for user uther service ssh-connection method keyboard-interactive [preauth]

I'm at a loss of how to resolve this. I literally cut and paste the text from id_rsa.pub on the client to the server in the administrators authorized keys file using Remote Desktop. There doesn't seem to be a permissions error, I can't figure out why it won't authenticate.

I would appreciate any help anyone could offer in getting this working. It isn't critical, SSH isn't exposed to the Internet, but some of the scripts I use would do much better with public key authentication.

I should also note when I set up the server I used my Microsoft account, I have been wondering if that has anything to do with it, so I may try to set up a straight local account and see if that fixes it.

EDIT: I attempted to create a local user account, but I cannot. Even when I try to use control userpasswords2 the box comes up but all the options to create an account are disabled. I'm thinking this must be because I have Windows 10 Professional and not some higher and most expensive edition.

2
  • Check the logs on the server. Sep 17, 2020 at 13:39
  • I did, it only said that the authentication failed. Sep 17, 2020 at 13:40

5 Answers 5

7

I finally solved the problem by commenting out the lines:

Match Group administrators
       AuthorizedKeysFile __PROGRAMDATA__/ssh/administrators_authorized_keys

Then I placed the authorized keys into the normal file ~\.ssh\authorized_keys like any other time I've used ssh. I saw this didn't work for a lot of people when I did my initial research and had discounted it.

1
5

Use this sequence of commands in PowerShell to correct permission of administrators_authorized_keys

$acl = Get-Acl C:\ProgramData\ssh\administrators_authorized_keys
$acl.SetAccessRuleProtection($true, $false)
$administratorsRule = New-Object system.security.accesscontrol.filesystemaccessrule("Administrators","FullControl","Allow")
$systemRule = New-Object system.security.accesscontrol.filesystemaccessrule("SYSTEM","FullControl","Allow")
$acl.SetAccessRule($administratorsRule)
$acl.SetAccessRule($systemRule)
$acl | Set-Acl
1
  • 1
    YESSSS You made my day i was wondering how to do this on windows as its mostly permissions issues with ssh connections.
    – U.V.
    May 13, 2022 at 10:53
0

In addition to the answer by Sergio Cabral, the documentation provides another option to apply the appropriate permissions:

icacls.exe "C:\ProgramData\ssh\administrators_authorized_keys" /inheritance:r /grant "Administrators:F" /grant "SYSTEM:F"
0

@Sergio Cabral's answer didn't work for me, but this did:

$systemRule = New-Object system.security.accesscontrol.filesystemaccessrule("SYSTEM","FullControl","Allow")
$administratorsRule = New-Object system.security.accesscontrol.filesystemaccessrule("Administrators","FullControl","Allow")
$acl = Get-Acl C:\ProgramData\ssh\administrators_authorized_keys
$acl.SetAccessRule($systemRule)
$acl.SetAccessRule($administratorsRule)
$acl.SetAccessRuleProtection($true, $false)
$acl | Set-Acl
-1

$systemRule = New-Object system.security.accesscontrol.filesystemaccessrule("SYSTEM","FullControl","Allow") $administratorsRule = New-Object system.security.accesscontrol.filesystemaccessrule("Administrators","FullControl","Allow") $acl = Get-Acl C:\ProgramData\ssh\administrators_authorized_keys $acl.SetAccessRule($systemRule) $acl.SetAccessRule($administratorsRule) $acl.SetAccessRuleProtection($true, $false) $acl | Set-Acl

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .