v9.4.0.0p1 and later enforce permissions on the logs folder, leading to undiagnosable crashes of the service after Windows Update
#2282
Labels
Comments
3 tasks
|
To be clear why I believe this is a notable issue: I installed OpenSSH from the Windows Feature on a number of machines. Generally speaking I'd expect that using Windows Update would be safe to update my servers with, and I'd still maintain access to them after running Windows Update. |
|
Thank you, I've wasted the morning looking for mistakes! |
|
Same issue here, after the patch tuesday OpenSSH server won't start, and nothing in the log even if set in DEBUG level. The Log folder was previously created by OpenSSH... Just a to delete it, start the server : working ok. |
|
Doesn't work for me. Installed it via msi, stopped the service, deleted the folder |
|
I also tried 9.8.0.0preview and I used the install-ssh.ps1 script. "New-NetFirewallRule -Name sshd -DisplayName 'OpenSSH SSH Server' -Enabled True -Direction Inbound -Protocol TCP -Action Allow -LocalPort 22 -Program "C:\OpenSSH-Win64\sshd.exe"" and even tried to give sshd an firewall exception for everything. From an ELEVATED power shell with ./sshd -ddd I got: debug1: get_passwd: lookup_sid() failed: 1332. Windows server 2022 21H2, Developer mode ON |
|
@crondrift and @Superberti I think your issues are unrelated (see #2281 for issues with 9.8). This issue is specifically about existing working installs when the service was working before and update, but failing afterwards and when the troubleshooting steps (specifically running (@crondrift make sure you've tried both https://github.com/PowerShell/Win32-OpenSSH/wiki/Troubleshooting-Steps and |
seansaleh
changed the title
logs folder, leading to undiagnosable crashes of the service after Windows Update
|
Same Issue here, same morning wasted. Deleting In fact, Windows notices that the folder cannot be accessed and prompts for authorization to permanently gain access to the folder. Evidently, pressing the Continue button adds additional permissions, which will then cause the sshd.exe service to fail to start. |
|
Thanks for reporting this and for providing the solution. Pretty appalled that this was released without a proper heads-up. Lost a good hour or two this morning chasing a fix until I saw yours. |
|
@seansaleh |
Sorry for all the headaches around this, and thank you for raising the issue here. To be clear, read access to the logs by any user is still permitted, but using the prompt for access grants full control. If you press 'continue` on the prompt, you'll just need to manually restrict the permissions in the folder properties to read/read & execute/list folder contents. |
Thanks por clarification. |
|
Is anyone else seeing connections and disconnects not logged anymore in v9.8? EDIT: Opened separate issue: #2292 |
Full control to the |
|
I also ran into this, however the fix for me was correctly adjusting the permission on both the |
|
I had the same symptoms but none of the listed fixes ended up working. In my case I had double quotes in my sshd_config file around the path for the sftp-server.exe default path |
|
Got 1607 error, not being able to start sshd. found my account have full control for %porgramdata%\ssh\log folder, issue fixed after removing my own account full control for this folder used GitHub release Zip to deploy Windows OS IOT LTSC 24h2
Deployment Image Servicing and Management tool Image Version: 10.0.26100.2033 Packages listing: ------------------------------------------------------------------------------------------------------- | ---------- | --------------- | -------------------
The operation completed successfully. |
3 tasks
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Prerequisites
Steps to reproduce
logsfolder atC:\ProgramData\ssh\logswithout extremely locked down permissions (I'm unable to confirm this right now, but it could have even been created by runningsshd.exeas a user, not as a service)Expected behavior
logsfolder to also have locked down permissions is documented somewhere, at least at https://github.com/PowerShell/Win32-OpenSSH/wiki/Security-protection-of-various-files-in-Win32-OpenSSHv9.4.0.0p1sayActual behavior
sshdruns fine withpsexec -s sshd.exe -dinstall-ssh.ps1or by doingrm C:\ProgramData\ssh\logs(and thus depending on the parent folder to have proper permissions)Solutions
psexec -s sshd.exe -dsuccessfullyinstall-ssh.ps1or
rm C:\ProgramData\ssh\logs(and thus depending on the parent folder to have proper permissions)Error details
No response
Environment data
Version
OpenSSH_for_Windows_9.5p1
Visuals
No response
The text was updated successfully, but these errors were encountered: