May update broke publickey authentification #1617
Comments
|
@Meivyn - May update doesn't have new openssh binaries. I am guessing this is something to do with ssh-agent. Please check if ssh-agent is started on your machine. There is a known bug that after windows update, ssh-agent is stopped so there is a manual step to start the ssh-agent service. We fixed this bug in the next windows release which is available during fall time. |
|
As far as I know, ssh-agent is used only on the client-side to retain keys? I never used it on Windows, nor on Linux. In fact, I choose to not use a passphrase to not bother me with it. But to answer, "OpenSSH Authentification Agent" is disabled in services. I don't know if it was before the update. I don't think this is required either, at least on Linux servers. Windows have another behavior? I managed to "fix" this by using In fact, installing OpenSSH Server from Windows features directly was the only thing I had to do to set up the server. Then I deployed my key using |
|
I am in this exact same situation. What are the correct permissions for that file? On an open |
|
Using |
|
I used Then I used: to understand which was the SID that was being complained about. Thanks @Meivyn ! |
|
Glad you figure out the issue. Default sshd_config expects the administrator keys be present in $env:programdata\ssh\administrators_authorized_keys file. This is added to fix a security issue and is expected. I'm closing this issue. |
|
In that case, why it was working in the first place? It stopped working only after the may update. |
|
@Meivyn - I wonder that too. There is no version update in the May release. |
|
I had to create this file and add my key manually only after this update, this file wasn't in ssh folder before that. I didn't modify anything, as I said, everything was already working fine by installing OpenSSH server from Windows optional features. |
|
@Meivyn - Did you modify your $env:programdata\ssh\sshd_config file? The default config expects the admin keys to be present in $env:programdata\ssh\administrators_authorized_keys. |
|
I modified it in a way that allows only public key authentification. Nothing more than that. |
|
so the below config exist in the $env:programdata\ssh\sshd_config file before the upgrade? If yes, then I doubt the issue should be present before the upgrade as well as there is no change to the sshd.exe binary. Match Group administrators |
|
I didn't memorize everything in that file, so I can't answer that. I just know that it was working literally before the update as I used SSH right before, then it stopped working after the reboot. Based on the fact that these lines are in the file now, I'd say it was also there before the update since the file shouldn't have been modified by the update. Something is going with this update, in a way or another in my opinion. But if you tell me it wasn't supposed to work before the update, then the issue was before the update and it actually fixed it. I still have an ISO of Windows 1909, I could install it on a virtual machine and see if it's working with this version. |
|
@Meivyn - May update shouldn't update anything related to binaries or the configuration.
|
|
So after installing Windows on the VM:
Here is the full log: And full config: |
|
What is the OpenSSH version before upgrade? |
|
Looks like it's 7.7.2.2 This seems to be the issue: |
|
@Meivyn, Couple more questions,
I am not around when v7.7.2.3 is released so I don't have the full context how v7.7.2.3 is patched. |
I could try migrating the VM to Windows 2004 so we can see the server version after the upgrade... |
|
Can you try to run windows update to get security patches installed. Note that this shouldn't be the update to May 2004 update (19041.264)? I am expecting V7.7.2.3 is part of security patch. I just need confirmation. |
|
After the updates, I am still on v7.7.2.2, and I'm not offered to migrate on Windows 2004 when I'm manually searching for updates. |
|
Thanks @Meivyn for helping to debug the issue. All non-english windows OS version will have this issue when they update to May 2004 update (19041.264). For future reference, this is expected behavior. |
|
Just in case, I confirm the May update installs the version v.7.7.2.3 of the server. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
"OpenSSH for Windows" version
7.7.2.3
Server OperatingSystem
Windows 10 Pro
Client OperatingSystem
Arch Linux
What is failing
As in the title, I can't SSH into my Windows 10 machine using publickey authentification.
This is definitely an issue related to the new May 2004 update (19041.264). My authentification setup was working perfectly fine prior to upgrading my system.
Password authentification is not affected by this issue. I'm using ed25519 key, I didn't tested another format. I am not even prompted to enter my passphrase.
Looking at logs using verbose, I have this:
I can't find anything useful using
DEBUG3, I have only these lines after theauthorized_keyspart:The text was updated successfully, but these errors were encountered: