Configuring OpenSSH (Win32) for Public Key Authentication

<< Surreal | Home | New Tool: IPEnum.vbs >>

Configuring OpenSSH (Win32) for Public Key Authentication

(Updated Oct 13, 2005 to update my email address and link to SSH binaries. Thanks MJE!)

First, let me thank Anil John for sending me his configuration and walking me through the appropriate steps. You rock, Anil, seriously.

Secondly, if you notice any errors in this article, or have suggestions for improvement, please leave a comment, or email me at beau dot monday at gmail dot com.

Installing and Configuring OpenSSH Server:

OK, first, download OpenSSH from http://sshwindows.sourceforge.net
Unzip it, and run the resulting installer
Install the program to the directory of your choice (I will use c:\OpenSSH). You will be best served by putting OpenSSH into a directory that does not contain any spaces.
Take the defaults for the remaining setup screens
After OpenSSH is installed, open a command prompt and cd to the \OpenSSH\Bin directory
Run mkgroup -l >> ..\etc\group
Run mkgroup -d >> ..\etc\group
Run mkpasswd -l [-u ] >> ..\etc\passwd
Run mkpasswd -d [-u ] >> ..\etc\passwd
Run “net start opensshd“
On a seperate system equipped with an SSH client (such as PuTTY), ensure you can connect to the new server using a username and password that is valid for the server
Once you have verified the OpenSSH service is working correctly, go ahead and “net stop opensshd“ to stop it
From the command window on the server, cd\openssh\etc
Copy sshd_config to sshd_config.bak just in case something goes horribly wrong and you want to return to the default configuration and start over
Copy this sshd_config to the system, placing it into the \OpenSSH\etc directory and remove the .txt extension(this conf file will force public key authentication, and disallow password authentication. Feel free to adjust it to your needs later.)
cd ..\bin
Run “ssh-keygen -t rsa“ (we will be generating an SSH2 RSA key, which is the currently recommended key)
When asked for where we want the key files to be placed, DO NOT TAKE THE SUGGESTED LOCATION. Instead enter “/etc/id_rsa“ (the use of “/“ is important here, you cannot use “\“)
Enter a passphrase (you can leave the passphrase blank, but a passphrase will prevent the key from being used if someone happens to acquire it)
Enter the passphrase a second time
Observe two files being generated, “id_rsa“ (your private key, which your client machines will need) and “id_rsa.pub“ (your public key, which stays on your server)
Run “cd ..\etc“
Perform a “dir“ and ensure the two files are there. If they aren't go find them and put them there.
Run “copy id_rsa.pub authorized_keys“ The goal is to make a copy of the public key file, named “authorized_keys“
Grab the other file (id_rsa) and copy it by whatever means necessary (network, floppy, usb flash disk, pigeon, whatever it takes) to the machine you will be using as the client. (This file is your private key, and should be treated as highly confidential. If you used a well-thought-out passphrase when generating the key, then it is nigh unusable if someone comes across it. Otherwise, if someone gets a hold of this file, they can IMPERSONATE YOU when connecting to your SSH server. Pass phrase or not, this file should be treated as sensitive, and erased from whatever media you used to move it to your client.)
Run “net start opensshd“ and check in the Services applet that is has started and is running.
On the client, assuming you have SSH client tools installed, you can run “ssh -l “ from the directory where the id_rsa file was copied, and it should prompt you for the pass phrase, if you entered on during key generation. Once the pass phrase is entered, it should connect to the SSH server and give you a command prompt.
Pat yourself on the back and have a beer, preferably Fat Tire. But get your own. Just because I have a keg in my kitchen does not mean I have enough to share with other people!

Configuring PuTTY to use your shiny new key:

PuTTY is a free terminal emulation program, and it pretty much kicks ass. It supports all major encryption and authentication standards, and permits SSH tunnelling (which is what got me into this mess to begin with). I highly recommend it. You should go get it now and install it, if you haven't already.

First, the id_rsa file, your private key, needs to be converted to a format that PuTTY can work with:

Open a command prompt and navigate to the directory where PuTTY was installed
Run “puttygen“
Click “Load“
Change “Files of type:“ to “All Files (*.*)“
Navigate to where the id_rsa file was placed and select it, then click “Open“
If you set a pass phrase, you will be required to enter it before continuing
You should receive a Notice saying that the key has been successfully imported (blah blah blah). Hit OK there.
Ensure the “SSH2 RSA“ radio button is selected at the bottom of the window, in the box entitled “Parameters“
Click “Save Private Key“
Note the location, or pick a new one, and save the file as “id_rsa.ppk“
Close puttygen, you're done with it.

Now, configure a new SSH session in PuTTY to connect to your OpenSSH server:

Run PuTTY
Enter the Host Name or IP Address in the “Host Name“ box towards the top of the main window
Ensure “SSH“ is selected in the “Protocol“ box
In the “Saved Sessions“ top box, enter a name for the session you are creating
In the tree on the left, expand the “Connection“ and “SSH“ sections, if necessary
Under the “SSH“ tree, highlight “Auth“
Hit the “Browse“ button next to the box that says “Private key file for authentication“
Locate the “id_rsa.ppk“ file and double click on it (or highlight it and click “Open“)
Highlight the “Session“ section in the treeview on the left
Click “Save“ to save the session you have just configured (from now on, you can simply double-click on that session name when you start PuTTY and it will load all the settings you just configured)
Click “Open“ at the bottom of the window, or double-click on the newly-created session in the list box to start it.
If all goes well, you should establish a connection to the remote OpenSSH server, and be prompted for a user name
Enter a user name that is valid on the remote server and hit return
If you have configured a pass phrase, you will be challenged for it now. Otherwise...
You're done. I think we've earned another Fat Tire, don't you? I know I'm having another.

Pitfalls:

Directories with spaces in them MAY cause some issues with OpenSSH. Avoid them.
Don't place your public key (id_rsa.pub and authorized_keys file) into your user directory, which is the default location for them when using “ssh-keygen“. User dirs have funny permissions on them sometimes. Use a neutral location, like the suggested “\OpenSSH\etc“ dir.
Remove the private key from the server, or at least move it to a more secure location. This is the key to your kingdom. Even with a pass phrase, it can be broken by a hacker with enough motivation, horsepower and time.
Don't be dazzled by all the things PuttyGen can do. All you want to do it save the private key in the PuTTY format. All the noise about pasting text into “authorized_keys“ and stuff is not necessary in the scenario we walked through here. Ignore all that, follow my instructions (unless you know what you are doing, in which case, why the hell are you reading this drivel?).

Print | posted @ Thursday, October 13, 2005 10:25 AM

Comments on this entry:

# Secure Remote Access: Configuring OpenSSH (Win32) for Public Key Authentication

by SecureCoder by Anil John at 4/3/2004 7:34 AM

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by Anil John at 4/3/2004 7:35 AM

You are welcome! :-)

# Secure Remote Access: Configuring OpenSSH (Win32) for Public Key Authentication

by SecureCoder by Anil John at 4/3/2004 7:36 AM

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by Exile at 7/31/2004 8:46 PM

Thank you! This post saved me many frustrating hours. Seeing it all after the fact makes sense, but why the documentation that comes with OpenSSH is so sparse and incorrect is beyond me. I was going nuts trying to make the authentication_keys work from .ssh like the documentation clearly states.

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by Nicky Maddison at 9/3/2004 10:39 PM

Wow! a great job, every sysadmin should have a look at this how-to. This article will allow you to stay home to solve problems at the office. Put the SSH into a VPN (L2TP) and you have got the perfect secure tool to administrate you servers from home or anywhere else.

A trully nice work.

thanks

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by Brent at 10/6/2004 10:21 AM

Just a quick note. Works FLAWLESSLY for me, but when I generate keys it calls them is_rsa not id_rsa...but it still works regardless.

Thanks for a GREAT article!

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by Les Dabney at 11/11/2004 3:35 PM

This is a textbook example of how documentation should be done. Kudos to you sir for setting a fine example.

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by SunnyDayz at 11/18/2004 10:55 PM

Thanx...very nice tut..i can sleep now

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by Jason Tepoorten at 12/6/2004 7:02 PM

Hi.

I followed your instructions and completed the installation; however, when I login via SSH, I get the "setgid: invalid argument" error.

Regards,

Jason

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by Jason Tepoorten at 12/6/2004 7:46 PM

Please disregard my last comment.

I have overcome the setgid error.

To overcome, the following steps must be taken:

- Open "passwd"

- Replace "unused_by_nt/2000/xp" with "*"

- Replace ":513:" with ":544:"

That is all I had to do.

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by meckatzermichel at 12/14/2004 2:42 AM

hi there,
i followed your document step by step. but unfortunately, if connecting through putty it demands a password.
when using winscp it works with the key. what could be wrong ?
michel

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by meckatzermichel at 12/14/2004 5:08 AM

ignore the last posting.
i had an old version of putty. now it's working.
thank's for your documentation.
greetings
michel

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by Bode at 1/10/2005 2:48 AM

Hello All,

This is a document on how to set up key authentication, and i found it to work fine on windows 2000, but on windows 2003 server, i get authenticated and then logged out immediately!On degu mode, i see the following line after the
"Last login....." line

debug2:channel 0:recvd eof

And after that, it goes about closing down the connection and logging me out!Any ideas please ?

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by Arian at 1/19/2005 7:34 PM

Have anyone found out how to make it work in Windows 2003 Server, Enterprise Edition build 3790?? I've done the exact same setup in XP and it works fine... don't know why it doesn't work for Windows 2003.

************LOG from putty************

login as: Arian

****USAGE WARNING****

This is a private computer system. This computer system, including all
related equipment, networks, and network devices (specifically including
Internet access) are provided only for authorized use. This computer system
may be monitored for all lawful purposes, including to ensure that its use
is authorized, for management of the system, to facilitate protection against
unauthorized access, and to verify security procedures, survivability, and
operational security. Monitoring includes active attacks by authorized entities
to test or verify the security of this system. During monitoring, information
may be examined, recorded, copied and used for authorized purposes. All
information, including personal information, placed or sent over this system
may be monitored.

Use of this computer system, authorized or unauthorized, constitutes consent
to monitoring of this system. Unauthorized use may subject you to criminal
prosecution. Evidence of unauthorized use collected during monitoring may be
used for administrative, criminal, or other adverse action. Use of this system
constitutes consent to monitoring for these purposes.

Authenticating with public key "rsa-key-20050119"
Last login: Wed Jan 19 22:24:15 2005 from 127.0.0.1

**************END LOG******************

then it pops up the dialog box with "Connection closed by remote host"

any idea?

Thanks in advance

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by Greg at 1/20/2005 12:49 PM

I have the same problems as Adrian and Bode, also on Windows Server 2003. I have tried to set the path of they keys to something else, like c:/ssh_keys , but i somehow do not know how to set that path correctly in the sshd_config file.

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by Mark at 2/11/2005 2:34 PM

I've been through the instructions a couple of times, but continue to get a "server refused our key" message. It works fine if I try to login as root, but not when I use any other user name.

I've tried file perms of both 600 and 644.

Am I missing something obvious?

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by Landon at 2/25/2005 2:37 PM

This document was very helpful. However, just like the others, it works fine with WIN XP but not with Windows Server 2003. I get the same "server refused our key" message. Supplying the username and password does work with Windows 2003 Server if I change my sshd_config, but I would really like to use Public Key authentication.

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by Till at 3/10/2005 4:51 AM

If you get the "server refused our key" message, go to the sshd_config and change "StrictModes yes" to "StrictModes no".
The Server will work with the key, but after login with your pathphrase it will close the connection, don't know why.

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by Dale at 3/10/2005 8:59 PM

Need to change user running the service to a an actual user (ie. "ssh_usr" any will do), with admin rights, rather than system. also need to change ownership of the log file "/var/log/OpenSSHd.log" to the same user and permission to rwxrwx--- for that user. Also "Strict Modes no" in sshd_config.

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by Hari at 3/18/2005 1:31 AM

Thanks Man,

This worked for me in Win XP, where the server and clients were on the same machine .. :)

this article kicks some serious butt or what .....

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by Suitepotato at 3/28/2005 1:08 PM

I found that in order for StrictModes yes to work on Windows XP Home edition, there is a simpler way of making the permissions correct than rebooting to safe mode.

First, the account you're doing the set-up from must be an admin acct if it isn't the one you're setting up for, and second, the acct you're setting up for must be an admin. For instance, let's call the acct we're setting up for "spike".

As you said, spaces are not well handled by this code. I found putting the home directory just off of c:\ was the best thing. I also decided to go with the .ssh notation so frequently used and so:

c:\spike\.ssh

Which is where the authorized_keys file must go. BUT, and here is the EXTREMELY HUGE ROSEANNE BARR SIZED BUT, you MUST NOT do it willy-nilly. I tried Windows Explorer AND at the command prompt. Both times it failed. Rebooting to safe mode was no help despite hours of messing with the permissions. What I found worked was much much simpler.

Once password based authentication is working for that acct, you log in to the server as that acct. Once at the prompt in Putty, you change directory to c:\ and then mkdir spike and cd spike and then mkdir .ssh. Now you've made those folders SOLELY as the userid in question and NOT as the system acct or the admin acct you may have been logged into Windows with.

Next trick, you take advantage of inheritance and change your directory in the Putty session window to wherever you made the authorized_keys file. Then copy authorized_keys c:\spike\.ssh\ and it copies to it. Now, thanks to inheritance that defaults on file and folder permissions under XP Home on NTFS, the folders AND the authorized_keys file will have the appropriate permissions.

DO NOT BY ANY MEANS modify those folders or that file from anywhere but within Putty, logged in as the userid in question. ANY other userid modification can cause it to change permissions and break StrictModes yes. At least, that's the way it has been behaving so far.

To test, I run Putty against the OpenSSH service running on the same machine by pointing at localhost.

Of course, having NTFS as the filesystem is also a must for this to work at all.

Also, to make it look in the home directory, edit the registry to make home c:\ and then use:
AuthorizedKeysFile /home/%u/.ssh/authorized_keys
Which in the example I gave would cause it to look in c:\spike\.ssh\authorized_keys. StrictModes yes should now work.

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by Suitepotato at 3/28/2005 1:59 PM

I forgot that you should also try using CACLS.EXE from c:\ and then you should get something like the following using my "spike" userid example.

C:\>cacls spike
C:\spike BUILTIN\Administrators:F
BUILTIN\Administrators:(OI)(CI)(IO)F
NT AUTHORITY\SYSTEM:F
NT AUTHORITY\SYSTEM:(OI)(CI)(IO)F
NT AUTHORITY\SYSTEM:F
CREATOR OWNER:(OI)(CI)(IO)F
BUILTIN\Users:R
BUILTIN\Users:(OI)(CI)(IO)(special access:)
GENERIC_READ
GENERIC_EXECUTE

BUILTIN\Users:(CI)(special access:)
FILE_APPEND_DATA

BUILTIN\Users:(CI)(special access:)
FILE_WRITE_DATA

This is the state of permissions on my home directory with my current setup and StrictModes yes is working fine with it.

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by metator at 4/27/2005 11:04 AM

Well, first of all i must say thank you 'cause this was *the* only how-to i found in the net that truly works on windows.
But i had to change one little thing: in order to get the server to ask for the passphrase the client must connect with the command -> ssh -i id_rsa <hostname>. The '-i' option indicates our identity file, thus this command was executed on the directory where id_rsa file is (otherwise u would have to write the complete path).

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by AXL at 5/9/2005 12:22 AM

I got the "Server refused our key" message when using openssh on a win XP-machine (guess I should know better) until I did like Suitepotato said and changed

AuthorizedKeysFile
in the sshd_config file to
/home/%u/.ssh/authorized_keys
H

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by Suitepotato at 5/9/2005 11:45 AM

So you want to use SFTP with Ipswich WS_FTP Pro... (well, you might...)

(This is for version 9.01 btw...)

First, go into WS_FTP Pro.

Options...
SSH
Client Keys
Create...

Then, Export and name your key how you like and then go into WordPad and look at the .pub file you exported.

This is how the Ipswitch WS_FTP Pro key will look when exported and viewed in WordPad:

---- BEGIN SSH2 PUBLIC KEY ----
Comment: "Created by Ipswitch WS_FTP Pro"
(key gibberish)
(more key gibberish)
(yet more key gibberish)
(even more key gibberish)==
---- END SSH2 PUBLIC KEY ----

This is the correct format for a Unix box running OpenSSH. It isn't correct for OSSHfW.

Note the "==" at the end of the key. That is EXTREMELY important to have. Actually, you only really need the one “=” near as I can tell but why take chances I figure.

This is how it should look in the authorized_keys file for OpenSSH for Windows:

ssh-rsa (all the key gibberish in one line)== wsftp

You need the entire thing on ONE line, ONE return at the end, ONE key per line. The space and then the wsftp is my choice to identify the line as being my remote WS_FTP key. You could call it “susan” if you wanted.

So go to the copy of authorized_keys you left where you built it before copying within the SSH session and then edit it, putting in the key in the above format. When done, you should have something like this:

ssh-rsa (all the first key gibberish in one line)== spike
ssh-rsa (all the sftp key gibberish in one line)== wsftp

Once the editing is done, SSH in as before and go to the directory where your proper authorized_keys file is sitting and issue the command “rename authorized_keys authorized_keys.bak”, without using the quotes of course. Go to the directory where the edited authorized_keys is and copy it to the directory you were just in and then get out of the SSH session and go to Services in Windows and restart the OSSHfW service. Now restarted, it should have that key in its config.

Now you can go to WS_FTP and set up the site. This is what you need in addition to the address of the site and account information.

Site Options
Advanced
Server Type SFTP/SSH
Remote Port (the one you run OSSHfW on)

SSH
SSH Keypair (the key you created)

Try it out now and you should be able to SFTP using the key login. I generated the keys at work, e-mailed the public key to myself and when I got it at home, edited it and added it to my file and restarted the service. Next day it worked like a dream.

I use it to transfer files downloaded at work to my home machine and it works fine. The most important thing to remember is that the key generated by with the Export function to the .pub file must be correctly edited. “ssh-rsa”(space)”key gibberish here”==(space)”your identifier here” is the format and it goes ALL ON ONE LINE, each key on a separate line.

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by Tiago Andrade e Silva at 7/8/2005 5:22 AM

Thanks for this Great How To.

I have a problem connecting.After putting the phrase putty disconnectes without any error message:
Authenticating with public key "imported-openssh-key"
Passphrase for key "imported-openssh-key":
Last login: Thu Jul 7 17:51:58 2005 from xxx.yyyyy.com

Can you help ?
Thanks,

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by madGeek at 7/18/2005 7:08 PM

> I have a problem connecting.After putting the phrase putty disconnectes without any error message:

are you running windows server 2003 (any version)?

i had the same problem, it turns out that windows server 2003 isnt supported

there is a note in the readme about it, it just says that it will be fixed 'soon' - bear in mind that was written in July 2004

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by Ben Coleman at 7/19/2005 4:45 AM

Thanks for a brilliant how-to.
I was approaching to the hair pulling & swearing stage with getting this set-up; until I found this guide, got it sorted in minutes after reading this!

Thanks.

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by twosw33t at 7/21/2005 10:18 PM

hi,

Great instructions worked perfectly right away,

I do have an additional question about whether its possible to restrict users to the OpenSSh home folder eg. "c:\home" . At the moment I noticed that if a user logs in while they do default to their home folder there is nothing stopping them from browsing other locations eg. c:\windows\..., c:\program files\.., etc..

Is there a way to restrict?

I think there is a unix version called 'jail' but I'm not sure if there is a win32 version.

Any help would be appreciated.

Cheers

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by Deepak at 7/23/2005 8:21 AM

This process is not working for windows 2003

Any help ?

my email id is deepak.jena@gmail.com

Thanks
Deepak

# ******Configuring OpenSSH (Win32) for Public Key Authentication*******

by Michael at 8/10/2005 9:44 AM

Anyone found a way of making it work for windows server 2003 yet??

and how can i restrict the directory browsing to the home folder only?

Email me & Post Here For All To See:

michael@omega015.f9.co.uk

Thankyou Very Much.

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by DogDay at 9/12/2005 5:01 AM

Wow, after months trying to make openssh work this is the only way I have found to make the trick. Thanks a lot. Now everything is wonderfull for me. One question: Is there a way to make it work using both password and public key auth methods ?. Thanks a lot again.

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by Craig at 9/29/2005 1:49 PM

Like the post above, I have it working with key auth but can't get it to work both key AND password and wouldn't ya know it, someone in my ORG wants JUST THAT. Any ideas?

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by Mike at 11/18/2005 6:59 AM

This article is balls on. It was the only way I could get Public key authentication to work with Openssh on M$. I've not had any luck getting it to work on Server 2003. It connects, accepts the passphrase then punts you. Also no luck in getting keys and password to work.

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by Rob at 12/7/2005 9:46 AM

I had two problems "server refused our key" and "key is of wrong type (putty ssh2)"

The wrong type was solved by changing the default protocol "SSH" from 1 to 2. I don't know why it made a difference but it did.

For the server refusing the key issue, I had to make sure the execute bit was set on the full path to authorized_keys. I chould go as restrictive as 711, but the execute bit had to be set for other.

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by Charles Perreault at 12/14/2005 8:41 PM

Go see this site for a complete Windows 2003 solution. I tried it and it worked :

http://www.cs.bham.ac.uk/~smp/projects/ssh-windows/

If you get a problem starting the OpenSSH service, remember to go see error logs in /var/log.

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by Berkay at 1/11/2006 8:02 AM

This is just what I needed. Saved me a great deal of time.

Thanks!!!

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by Greg at 3/29/2006 5:43 AM

A good job,

just a question :

when i use a command with ssh i doesn't work

ex: ssh host ls

normally i should have a list of the folder but i have an error on mapping users and id

any idea ?

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by Marco at 8/18/2006 8:49 AM

I have the same problem with win2003 and the link http://www.cs.bham.ac.uk/~smp/projects/ssh-windows/
non work yet.

Someone have a copy of solutions?
Thks

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by dlhodge@pacbell.net at 10/10/2006 2:13 PM

This should help

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by Kanti at 10/12/2006 1:25 PM

I am having this error while trying to connect to windows 2003 openssh server from a windows 2003 client:
"c:\program files\openssh\sbin\shhd.exe: *** CreateFileMapping, Win32 error 0. Terminating.
Connection node-a closed"

So it closes the connection too soon.

Any help will be very much appreciated

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by Sean at 10/24/2006 9:08 AM

Anybody get this to work on a Win 2003 box?

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by Arby at 10/31/2006 9:53 AM

yes...on w2k3, i had to basically open up security on the entire openssh directory (I haven't fine tuned it yet). I also chaned the account that the opensshd service uses to a local admin, and gave the local admin log on as service rights.

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by Arby at 10/31/2006 11:41 AM

Oh, yeah, and also granted all the token level permissions in the local group policy. Did it on two boxes now successfully.

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by Bbw Dates at 11/7/2006 6:46 AM

Very interesting. Thanks!

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by PaulPoule at 11/14/2006 4:55 AM

Hi!
To solve the "server refused our key" problem, I had to change permissions on my public key on the server :

The .ssh dir under my homedir looks like this:
drwxr-xr-x 2 me users 4096 Nov 14 12:30 .ssh

the authorized_keys file in .ssh directory looks like this:
-rw-r--r-- 1 me users 610 Nov 14 12:25 authorized_keys

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by Steve at 11/24/2006 12:43 PM

Top man, i had several tyres after spending all day faffing about trying to get this work, one walk through on you site and im sorted!!

CHEERS!!!!!

Steve

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by Steveo at 11/27/2006 3:59 AM

In order to get this to work, i had to create a new group for all users on windows 2003 server, then remove any users created from the default users gourp and put them into the new group eg sshusers group. I then created a new home folder for each user thorugh windows 2003 users page.

Then recreate your passwd file to accept the changes to users. I created my users folders on a seperate drive (D:) and denied all permissions and inherited permissions to the C: for the group sshusers this stops the user browsing the root. You do though require rwx access to the openssh bin and share directory for this group. This didnt allow for the strict mode yes to work for me but tied the permissions down sufficiently to stop users browsing bavk up the direstory.

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by Mathew Lu at 1/22/2007 8:39 PM

I finally got OpenSSH working on Win2K3, and thought I'd share the intricacies here (because it is very particular with what you need to do).

To get OpenSSH for Windows (version SSH-2.0-OpenSSH_3.8.1p1) working on WIN2K3 server, you MUST run the OpenSSH service as a local admin user with the required permissions/privelages, and NOT the default SYSTEM account it is installed to run as (Trust me, running as SYSTEM will work on WinXP and WIN2K but NOT WIN2K3).

Refer to the instructions found at the following link (only the first section 'Installing OpenSSH for Windows 2003 Server - How to get it working. is relevant) - http://www.cs.bham.ac.uk/~smp/projects/ssh-windows/

The extra thing to watch out for from the instructions above is the granting of permissions to the folder ..\OpenSSH\var and subtree. Although you grant Ownership and Full control at the ..\OpenSSH\var folder level, and through inheritence it does propogate down to the sub-folders, the file
..\OpenSSH\var\log\OpenSSHd.log is quite stubborn. The server account you created to run the OpenSSH service needs to have Full control and be the owner of this file also. You may need to grant permissions to this file individually by first taking ownership of the file as the user you are logged in as, then granting full control to the server account you created and then once complete, changing the owner back to the server account. (very particular)

The service should start without any warnings.

Also Strict modes needs to be set to 'no' for public key authentication to work alongside password authentication. This is OK, because you can still lock down the users permissions and rights to view other folders. If you need further information regarding locking down a users permissions to restrict what they can and can't access with public key auth and strict modes set to 'no' email me and I'm happy to help.

Remember that the difficulty and challenge is what makes it fun and enjoyable.

Good Luck!!!
Mathew Lu
luhmathew@yahoo.com

# Does it work for multiple users ?

by Phil at 1/24/2007 8:42 AM

Does that work for several users ? (Each one with his own public/private key pair) ?

thanks

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by John at 1/28/2007 5:56 PM

nice article, thx.

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by AndiR at 2/17/2007 2:42 PM

I don't understand any of this.
I now have to start to use ssh because ports have closed and ssh is the only possiblity to do the work. Before we did it using RDP.
Now we have to use ssh to tunel RDP. opensshd is installed seems to be running some keys were generated. But how to do 11. Connect to the server? How to do that. I try to follow http://www.jfitz.com/tips/putty_config.html
but that's something about email I don't need and doesn't work either.

Has anybody a suitable config for me? A terminal server running opensshd and the clients using putty?

Sorry but we can't use Terminla Server because the machines don't use IIS.

Thank you.

Andy

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by Questor at 5/25/2007 9:57 AM

Got it working on W2K Server. I had to:

Change the OpenSSH\etc\sshd_config file:
RSAAuthentication yes
PubkeyAuthentication yes
PasswordAuthentication no
StrictMode yes

And made a neutral home dir for my user (c:\spike) while logged in as Spike through ssh. Also made the .ssh subdirectory while logged in as spike through ssh. Also copied my keys into the authorized keys files while logged in as spike through ssh.

Had to change the home dir of my user in passwd to the new location.

Had to make yet another user to run the ssh service, member of administrators, with the following special policy-set permissiosn:

ntrights +r SeAssignPrimaryTokenPrivilege -u sshd
ntrights +r SeCreateTokenPrivilege -u sshd
ntrights +r SeDenyInteractiveLogonRight -u sshd
ntrights +r SeDenyNetworkLogonRight -u sshd
ntrights +r SeDenyRemoteInteractiveLogonRight -u sshd
ntrights +r SeIncreaseQuotaPrivilege -u sshd
ntrights +r SeServiceLogonRight -u sshd

this user, (sshd), was added with full control to the openssh install folder. I changed the owner of the openssh isntall folder to ssh, and propogated perms down. Then had to manually add ssh with full control to the /openssh/var/log/openssh.log file, the openssh/etc/ssh_host_rsa_key and dsa_keys.

Then went into the properties of the openssh service and changed the Logon tab to logon as sshd.

Restarted sshd, and it worked.

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by cash advance at 5/28/2007 5:44 AM

cash

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by hoodia at 5/28/2007 5:44 AM

hoodia

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by ringtones at 5/28/2007 5:45 AM

free

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by rolex replica at 5/28/2007 5:45 AM

hello

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by rolex replica at 5/28/2007 5:46 AM

rolex

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by Wettforum Wettpoint Sport Wetten at 5/29/2007 7:42 AM

Very great and excellent article. It’s realy helpful. Thanks again.

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by free ringtones at 6/14/2007 1:03 PM

nice place!

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by Dome at 6/21/2007 3:53 AM

Anyone knows how/where set the home directory? Especially when I use a sftp client...

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by LPn at 6/22/2007 4:47 AM

i have the same problem as you explain with the win server 2003 but my server is running win xp pro x64.

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by LPn at 6/22/2007 4:48 AM

any idea how i can fix it?

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by Sd card at 12/9/2007 4:31 PM

Interesting article!
Thanks

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by Bob at 12/22/2007 6:01 PM

I am SSH newby. I have OpenSSH installed on winXPPro SP2 and WinSPC also on other WinXPPro SP2 machine. I have the same problem like many other: it doesn't work with Public Key Authentication -"server refused our key". I saw that people solved this problem with changing permissions on few files. How to do this with WinXP? My sshd_config looks very simmilar to yours.

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by automotive repair manual at 2/4/2008 9:22 AM

Then recreate your passwd file to accept the changes to users. I created my users folders on a seperate drive (D:) and denied all permissions and inherited permissions to the C: for the group sshusers this stops the user browsing the root. You do though require rwx access to the openssh bin and share directory for this group. This didnt allow for the strict mode yes to work for me but tied the permissions down sufficiently to stop users browsing bavk up the direstory.

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by Atlanta Real Estate at 2/22/2008 9:46 PM

went on to the install, typing “sudo aptitude install openssh-server,” and when it prompted me for the ubuntu install cd, I put it in the tray and pressed enter, but I get the error “cdrom: failed setting in the lba address space.” I tried hitting enter a few times, removed and reinserted the cd but no joy, so I <ctrl>-C'd out. I tried “sudo unmount /media/cdrom”, thinking I might unmount and remount the cd (which shows up OK in BIOS), but no better.

Any help in understanding these points is appreciated.

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by Drew Honnoll at 3/5/2008 9:31 PM

Didn't work at first because I had my remote server already setup and was 1,500 miles away trying to get it to work remoting in by way of ssh, (my config file allowd temporarily for login and password logins just in case something went horribly wrong 1,500 miles away since I am the only one with the admin password) But then again beeing ssh'ed in and trying to restart sshd is fun to say the least. My end users rebooted their computer. the next day it worked like a charm and I just now turned off user password logins. I think this thing is more secure than the banks in their country

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by Golf cart at 4/1/2008 5:57 AM

this user, (sshd), was added with full control to the openssh install folder. I changed the owner of the openssh isntall folder to ssh, and propogated perms down. Then had to manually add ssh with full control to the /openssh/var/log/openssh.log file, the openssh/etc/ssh_host_rsa_key and dsa_keys.

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by Gothic Forum at 4/4/2008 6:40 AM

I had to basically open up security on the entire openssh directory (I haven't fine tuned it yet). I also chaned the account that the opensshd service uses to a local admin, and gave the local admin log on as service rights.

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by Gothic Culture Community at 4/4/2008 6:41 AM

After months trying to make openssh work this is the only way I have found to make the trick. Thanks a lot. Now everything is wonderfull for me.

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by Gothic Magazine at 4/4/2008 6:43 AM

i have the same problem as you explain with the win server 2003 but my server is running win xp pro x64. Anybody can help me?

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by ventrilo hosting at 4/22/2008 1:55 AM

Installing and Configuring OpenSSH Server was much easier with your guide, thank you.

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by merde at 4/22/2008 7:54 AM

when i use a command with ssh i doesn't work
ex: ssh host ls
normaly i should have a list of the folder but i have an error on mapping users and id
any idea ?

Thanks

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by DUTCH at 4/28/2008 4:28 AM

I have installed OpenSSH on my windows server 2003 r2 and it works - problem is that when the SFTP client places a file into a directory with set NTFS permissions it seems to override and take ownership of that file meaning no one else apart from admin can do anything with it. Quite an inconvenience...want it to keep the NTFS permissions...Any ideas?

# re: Configuring

by voyance gratuite at 5/20/2008 9:34 AM

I think there is a unix version called 'jail' but I'm not sure if there is a win32 version.

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by Just_Me at 5/20/2008 5:46 PM

I have followed the instructions for Server 2003 very carefully to the letter. When trying to start the service I get an error 1067. From googling the only thing that shows up is that something else is already running on port 443. But, a netstat -a shows that there is nothing on that port. IIS is running several sites, but none using anything other than the default port 80

Any ideas?

# 授权你的SSH免密码登录

by Paul Lin's Personal Blog at 5/27/2008 5:28 PM

???????????SSH??,????????????,??????????????????
?????????,?????????
1. ??ssh-keygen??????????????????, ???./key??????????, ./key.pub??????

[paul@localhost ~]$ ssh-keygen -t dsa -f ./key
Generating public/private dsa key pair.
Enter passphrase (emp

# re: Configuring OpenSSH (Win32)

by voyance at 6/10/2008 3:47 AM

Oh, yeah, and also granted all the token level permissions in the local group policy. Did it on two boxes now successfully.

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by GSS Gallery at 6/16/2008 10:14 AM

It works fine for me. Thanks!

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by Jason at 6/18/2008 12:02 AM

you just saved me SO much time, thank you so much!!

# re: Configuring OpenSSH (Win32)

by pornhub at 6/23/2008 5:32 AM

Oh, yeah, and also granted all the token level permissions in the local group policy. Thanks

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by john at 6/23/2008 9:40 AM

forget putty, use a web based ssh client instead -

http://www.browsershell.com

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by Jay at 6/30/2008 3:17 AM

Thanks, Great Tutorial.

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by porno at 7/2/2008 11:22 AM

Top man, i had several tyres after spending all day faffing about trying to get this work, one walk through on you site and im sorted!!

# Configuring OpenSSH for Public Key Authentication

by casting at 7/12/2008 8:45 AM

Great looking theater, cool concept and good work !

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by Girls Games at 7/16/2008 8:42 PM

Oh, yeah, and also granted all the token level permissions in the local group policy. Did it on two boxes now successfully.

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by Picture frames at 7/22/2008 5:36 AM

i have the same problem as you explain with the win server 2003 but my server is running win xp pro x64. Anybody can help me?

# Configuring OpenSSH (Win32) for Public Key Authentication

by coquine at 8/1/2008 8:26 AM

I also chaned the account that the opensshd service uses to a local admin, and gave the local admin log on as service rights...

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by Riyas at 8/11/2008 3:54 AM

Nice article!!!!!
Can you tell me how to set an authentication for an exe(eg: IE,notepad... etc) through win32 code?

Thanks in advance,
Riyas.B
riyas.bowser@wipro.com(contact email address)

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by Manish at 8/21/2008 7:00 AM

Hi All,
I want to use SFTP.
For this I have downloaded OpenSSH for Windows v3.8.1p1-1.
After installing this it is working for password authentication but when I am trying for public key authentication It gives error.
I have folloewd all the step but still getting error like :

C:\Documents and Settings\kumarmam>SFTP kumarmam@192.168.9.150
Connecting to 192.168.9.150...

****USAGE WARNING****

This is a private computer system. This computer system, including all
.......................
.......................
related equipment, networks, and network
prosecution. Evidence of unauthorized use collected during monitoring may be
used for administrative, criminal, or other adverse action. Use of this system
constitutes consent to monitoring for these purposes.

Permission denied (publickey,keyboard-interactive).
Connection closed

I am stuck here.plz. reply as soon as possible

Thanks in advance.
Manish

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by Manish at 8/21/2008 7:02 AM

One thing I forgot to mention, I am using Window XP.
Regards,
Manish

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by Adrya at 8/24/2008 9:00 AM

Hi Manish

I think you should run the command from the directory where you have the private key like this:
sftp -i id_rsa kumarmam@192.168.9.150
or if you don't run it from that directory specify the full path to the private key file

Hope was usefull
Adrya

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by Voyance at 9/30/2008 2:17 AM

Thank you for taking the time to publish this information very useful!

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by LR at 10/2/2008 12:46 PM

Is hat article still actual?

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by medium at 10/16/2008 2:46 AM

I think this article is outdated

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by LR Kosmetik at 10/21/2008 5:12 AM

Nice pic of seatle. But quite nice blog with lot of good info. Thank you guys

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by Jeddah Dolls at 10/25/2008 9:40 PM

^^^^

Where's the pic of Seatle ?

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by kreditrechner at 11/1/2008 3:55 AM

I also chaned the account that the opensshd service uses to a local admin, and gave the local admin log on as service rights...

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by Raj at 4/21/2009 8:20 AM

Aaah this was so cool cutting all the crap..u are the hero .

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by club penguin cheats at 6/9/2009 4:01 AM

I was approaching to the hair pulling & swearing stage with getting this set-up; until I found this guide, got it sorted in minutes after reading this!

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by Mike - Music Notation Software at 6/17/2009 2:16 PM

Yay, I was able to follow the directions here, and I connected to my site via SSH with no problem. I can now perform admin tasks as desired.

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by Anand Kanagaraj at 6/25/2009 1:55 AM

Hi,

Iam getting the below mentioned error while connecting thrgh putty,

"Server refused our key"

Thanks,
Anand Kanagaraj

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by yuche at 8/5/2009 5:37 AM

Hi All,
I follow all step, and connect fine in password authentication,but when use public,I face some problem and some question.
1.I gen the key with 'admin' account,is that mean this account must be set in to passwd file? and only can use 'admin' account to connect ssh server?
2.If another accout need to create eg:abc, when create public, should I use abc to create the key, and add the key to authorized_keys
3.I use WINSCP to connect with account 'admin', it cause an error "Cannot initialize SFTP protocol. Is the host running a SFTP server?", but I change no settings on sshd_config,is any possible thing I fogot?

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by Fernando at 8/13/2009 9:15 AM

I made all steps, all works nicelly, but when i try to connect by WinSCP, gives me that de "server refused our key", also by PuTTY, i regenerated all again and again, and nothing... i can't connect by public key.

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by The D00d at 9/28/2009 1:00 PM

awesome write up.. kudos!

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by mato at 10/12/2009 3:27 PM

@Charles Perreault
Thanks!

It's 4 years after your post here but it saved my time! I was playing around why it's not working on 2003 (and yet working on XP with the same setup)

Once again, thanks!

Regards,
Mato

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by Frühe Schwangerschaft at 10/26/2009 8:08 AM

I had two problems, "Server refused our key" and "key is the wrong type (putty ssh2)"

The wrong way was solved by changing the default protocol "SSH" 1-2 I do not know why it made a difference, but it did.

For the server denies the central question, I had to make sure the execute bit on the full path to authorized_keys set. I chould go so restrictive as 711, but the execute bit is also set for others.

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by HappyUser at 10/28/2009 5:00 PM

Awesome instructions. Worked first time.
Thank you!

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by movie download links at 11/3/2009 2:59 AM

Once password based authentication is working for that acct, you log in to the server as that acct. Once at the prompt in Putty, you change directory to c:\ and then mkdir spike and cd spike and then mkdir .ssh. Now you've made those folders SOLELY as the userid in question and NOT as the system acct or the admin acct you may have been logged into Windows with.

Next trick, you take advantage of inheritance and change your directory in the Putty session window to wherever you made the authorized_keys file. Then copy authorized_keys c:\spike\.ssh\ and it copies to it. Now, thanks to inheritance that defaults on file and folder permissions under XP Home on NTFS, the folders AND the authorized_keys file will have the appropriate permissions.

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by Bindiya at 11/4/2009 12:06 PM

I followed all the steps and it worked . i had been trying this for a couple of weeks and could not get it working.

Installing Openssh in C:\ instead of in C:\Program files solved my issue

Thanks

# re: Configuring OpenSSH (Win32) for Public Key Authentication

by Capt Mandrake at 11/8/2009 5:54 PM

Great instructions, but wanted to add this because I too was experiencing the "server refused our key" error.

In my case, after generating the keys I ran the following to create an authorized_keys file

$>echo "id_rsa.pub" > authorized_Keys

which did exactly what I entered BUT NOT what I wanted - it echo'ed id_rsa.pub into the new file auhtorized_keys instead of the key string data, which is what is needed.

Everything else in my config was correct except this - what a DOH, head palm moment to be sure. :0

Once I "copied" the id_rsa.pub file as a new file named authorized_keys - everything worked.

Hope this helps someone.....

Peace