Skip to content

Can't ssh-authenticate on network-authenticated host #1516

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
twvacek opened this issue Dec 7, 2019 · 2 comments
Closed

Can't ssh-authenticate on network-authenticated host #1516

twvacek opened this issue Dec 7, 2019 · 2 comments

Comments

@twvacek
Copy link

twvacek commented Dec 7, 2019

OpenSSH version
8.0.0.0 This was installed via downloading the binary from https://github.com/PowerShell/Win32-OpenSSH/releases/tag/v8.0.0.0p1-Beta

Server OperatingSystem
Windows 10 Enterprise (Version 1903 OS Build 18362.476)

Client OperatingSystem
Same machine as host, have tried other machines (Windows 10 using Git Bash)
What is failing
Cannot password authenticate with my network credentials. My issue appears to be the same as #1399 where the reporter indicated that it is possible to authenticate when running sshd from the command line but not as a service.
Based on that discussion (https://github.com/PowerShell/Win32-OpenSSH/wiki/ssh.exe-examples#login-using-kerberos-authentication), I enabled gssapi in sshd_config and tried to log in with "ssh -K localhost"

The log trace (redacted with sed) is attached. The escaping looks funny to me. I also tried specifically providing my login name and the domain name, but there were other problems. I can send those traces if needed. I think the problem is that I need to figure out the right parameters for my organization, but not sure what the right tools are. Any pointers?

Expected output
Successful authentication

Actual output
Prompts for password entry until session discontinued. Logs indicate password authentication failure.

gssapi_redacted.txt

@twvacek
Copy link
Author

twvacek commented Dec 7, 2019

Note that in redacting the log, DOMAIN and USER used to redact the actual domain and user names in the log data. Thanks.

@maertendMSFT
Copy link
Collaborator

Looking in your log at this line: "11248 2019-12-06 21:41:25.719 debug1: generate_s4u_user_token: LsaLogonUser() failed. User 'DOMAIN\USER' Status: 0xC0000062 SubStatus 0."
Towards the bottom of the log. The error corresponds to an invalid username. Something is wrong with the account name.

Closing as this has been open a while and this may be resolved, please reopen if this issue persists

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants