Error retrieving user environment variables. RegOpenKeyExW returned 5

[Sedee]

Please answer the following

Windows 2008 R2 7601 SP1
sshd 0.0.10.0

When attempting to use rsa key authentication, the following error occurs:

2012 11:23:11 430 error: Error retrieving user environment variables. RegOpenKeyExW returned 5

passwordless login.

From windows / putty with agent and imported key
Authenticating with public key "imported-openssh-key" from agent Server refused public-key signature despite accepting key!
From Bash for windows with agent running and key loaded

debug1: Host '10.0.0.50' is known and matches the ECDSA host key. debug1: Found key in /home/testuser/.ssh/known_hosts:2 debug1: ssh_ecdsa_verify: signature correct debug2: kex_derive_keys debug2: set_newkeys: mode 1 debug1: SSH2_MSG_NEWKEYS sent debug1: expecting SSH2_MSG_NEWKEYS debug2: set_newkeys: mode 0 debug1: SSH2_MSG_NEWKEYS received debug1: SSH2_MSG_SERVICE_REQUEST sent debug2: service_accept: ssh-userauth debug1: SSH2_MSG_SERVICE_ACCEPT received debug2: key: /home/testuser/.ssh/id_rsa (0x7fffd79e2d50), debug2: key: /home/testuser/.ssh/id_dsa ((nil)), debug2: key: /home/testuser/.ssh/id_ecdsa ((nil)), debug2: key: /home/testuser/.ssh/id_ed25519 ((nil)), debug1: Authentications that can continue: publickey,password,keyboard-interactive debug1: Next authentication method: publickey debug1: Offering RSA public key: /home/testuser/.ssh/id_rsa debug2: we sent a publickey packet, wait for reply debug1: Server accepts key: pkalg ssh-rsa blen 279 debug2: input_userauth_pk_ok: fp 25:25:25:25:25:25:25:25:25:25:25:25:25:25:25:25 debug1: key_parse_private2: missing begin marker debug1: read PEM private key done: type RSA debug1: Authentications that can continue: publickey,password,keyboard-interactive debug1: Trying private key: /home/testuser/.ssh/id_dsa debug1: Trying private key: /home/testuser/.ssh/id_ecdsa debug1: Trying private key: /home/testuser/.ssh/id_ed25519 debug2: we did not send a packet, disable method debug1: Next authentication method: keyboard-interactive debug2: userauth_kbdint debug2: we sent a keyboard-interactive packet, wait for reply debug1: Authentications that can continue: publickey,password,keyboard-interactive debug2: we did not send a packet, disable method debug1: Next authentication method: password [email protected]'s password:

Key is in /users/testuser/.ssh/authorized_keys on the target host.

sshd_config has the directives for RSAAuthenticatio, PubkeyAuthentication set to yes, and agents are set to yes.

Is this an outstanding issue? or is there something I'm doing wrong?
Authentication with passwords is working fine, but I'm trying to get key based authentication working.
TIA for any assistance.

[manojampalam]

Can you share ssh-agent logs? See wiki for trouble shooting steps.

[Sedee]

ssh-agent.log file is empty

I used the wiki to perform the install, with one exception, after installing the ssh-lsa, I didn't reboot - hard to get outages, is there any way to avoid a reboot? This looked like a simple dll registration, but I'm a unix admin, havent really played on windows for a decade.

When I run regsvr32 c:\windows\system32\ssh-lsa.dll I get
The module was located but the entry-point DllRegisterServer was not found.
Make sure that ssh-lsa.dll is a valid DLL or OCX file then try again.

I'm guessing that that reboot is something I cant avoid. if so, thanks for your help. I'll close the comment.

[manojampalam]

If you need key based authentication to work with workgroup (non-domain) accounts, it is necessary to run install-sshlsa.ps1 and reboot the machine. This unfortunately is a limitation of Windows security subsystem.

That said, I am working on alternative solution that might not need a machine reboot, but its not ready yet.

[anjohnson]

I'm seeing this error message in my logs too, but I'm not sure if it is the reason why my logins don't always work (however I'm not writing about that here). I looked up Microsoft's documentation for the routine RegOpenKeyExW() and there is a note in the Remarks that says:

If your service or application impersonates different users, do not use this function with HKEY_CURRENT_USER. Instead, call the RegOpenCurrentUser function.

This would appear to be the fix necessary, since session.c line 336 is doing exactly that which the documentation says not to do. The return value 5 that we're seeing is ERROR_ACCESS_DENIED.

[anjohnson]

To confirm: The error message which is the subject of this issue gets logged (4 times per login) even when I successfully login to a local account using a public key that is present in the authorized_keys file.

[dwcoffin]

Windows 2008 R2 7601 SP1
sshd 0.0.11.0

Issues:

1. Unable to login with AD account within same domain. No modifications to sshd_config.

2. Running install-sshlsa.ps1 generates errors listed below.

Ran PS commands to get most recent packages.

Followed installation instructions from:
https://github.com/PowerShell/Win32-OpenSSH/wiki/Install-Win32-OpenSSH

Unable to run "powershell -executionpolicy bypass -file install-sshlsa.ps1" as these errors appear.

===============================================================
PS C:\Program Files\OpenSSH> powershell -executionpolicy bypass -file install-sshlsa.ps1
Copy-Item : Cannot find path 'C:\ssh-lsa.dll' because it does not exist.
At C:\Program Files\OpenSSH\install-sshlsa.ps1:1 char:10

• Copy-Item <<<< -Path $PSScriptRoot\ssh-lsa.dll -Destination "$env:windir\system32"
  • CategoryInfo : ObjectNotFound: (C:\ssh-lsa.dll:String) [Copy-Item], ItemNotFoundException
  • FullyQualifiedErrorId : PathNotFound,Microsoft.PowerShell.Commands.CopyItemCommand

Method invocation failed because [Microsoft.Win32.RegistryKey] doesn't contain a method named 'OpenBaseKey'.
At C:\Program Files\OpenSSH\install-sshlsa.ps1:4 char:50

• $reg = [Microsoft.Win32.RegistryKey]::OpenBaseKey <<<< ('LocalMachine', 0)
  • CategoryInfo : InvalidOperation: (OpenBaseKey:String) [], RuntimeException
  • FullyQualifiedErrorId : MethodNotFound

You cannot call a method on a null-valued expression.
At C:\Program Files\OpenSSH\install-sshlsa.ps1:5 char:23

• $key = $reg.OpenSubKey <<<< ($subkey, $true)
  • CategoryInfo : InvalidOperation: (OpenSubKey:String) [], RuntimeException
  • FullyQualifiedErrorId : InvokeMethodOnNull

You cannot call a method on a null-valued expression.
At C:\Program Files\OpenSSH\install-sshlsa.ps1:6 char:21

• $arr = $key.GetValue <<<< ($value)
  • CategoryInfo : InvalidOperation: (GetValue:String) [], RuntimeException
  • FullyQualifiedErrorId : InvokeMethodOnNull

You cannot call a method on a null-valued expression.
At C:\Program Files\OpenSSH\install-sshlsa.ps1:9 char:16

• $key.SetValue <<<< ($value, [string[]]$arr, 'MultiString')
  • CategoryInfo : InvalidOperation: (SetValue:String) [], RuntimeException
  • FullyQualifiedErrorId : InvokeMethodOnNull
    =============================================================

Value for HKLM\System\CurrentControlSet\Control\LSA\Authentication Packages = "msv1_0"

sshd.log on sshd start

==============================================================

#6324 18:22:10 553 Server listening on :: port 22.
6324 18:22:10 553 Server listening on 0.0.0.0 port 22.
6324 18:22:10 554 error: Couldn't create pid file "./sshd.pid": Permission denied#

===============================================================

additional logs on attempt to connect:

===============================================================

#4896 18:24:30 730 error: Couldn't create pid file "./sshd.pid": Permission denied
4896 18:24:39 249 Accepted password for [email protected] from 192.168.1.248 port 53920 ssh2
4896 18:24:39 470 error: Error retrieving user environment variables. RegOpenKeyExW returned 5
4896 18:24:39 471 fatal: ERROR. Cannot create process (1314).\n #

=================================================================

Nothing in ssh-agent.log before or after connection attempts.

Apologize for any "Funky" Markdowns...

[clouds56]

Now version 0.0.12.0, there's no ssh-lsa.dll, but still "Error retrieving user environment variables. RegOpenKeyExW returned 5" error. Do I have to reboot?

[bagajjal]

while establishing the session, sshd process will try to retrieve the environment information from the windows registry.. are you seeing this in the sshd.log file?
Does this block establishing the sessions?

[clouds56]

Yes, in a seesion (sorry the error number is 234 instead of 5)

error: Couldn't create pid file "./sshd.pid": Permission denied
Accepted password for <my_username> from UNKNOWN port 0 ssh2
error: Error retrieving user environment variables. RegEnumValueW returned 234

when creating a session, it shows these logs in sshd.log, while the ssh-agent.log is empty.

It does not block establishing the sessions, but I could not get correct PATH for the user.
echo %PATH% only shows the paths defined system wide, but not combined with the PATH variable for the user.

[bagajjal]

For the below error,
error: Couldn't create pid file "./sshd.pid": Permission denied

Try changing the sshd_config as mentioned in this issue #493.

[clouds56]

Do you think it cannot get correct PATH since it could not create pid file?

According to error code, it refers to

ERROR_MORE_DATA
234 (0xEA)
More data is available.

Anyway, I'll try fix the pid issue first.

[bagajjal]

I don't think so.. its a code fix.. how big is your PATH..
In code we are reading max upto 256 characters..

[clouds56]

I investigated the code you sent, 256 is the length of name which has no problem.
The issue is you do not check the return value for ERROR_MORE_DATA.

[clouds56]

From: https://msdn.microsoft.com/en-us/library/windows/desktop/ms724865(v=vs.85).aspx

If lpData is NULL and lpcbData is non-NULL, the function stores the size of the data, in bytes, in the variable pointed to by lpcbData. This enables an application to determine the best way to allocate a buffer for the data.

Return value
If the function succeeds, the return value is ERROR_SUCCESS.
If the function fails, the return value is a system error code. If there are no more values available, the function returns ERROR_NO_MORE_ITEMS.
If the lpData buffer is too small to receive the value, the function returns ERROR_MORE_DATA.

First time calling this, data is NULL, so it succeed. The next time found that the buffer is not enough, it would return ERROR_MORE_DATA and never goes to the code path to extend data.

[bagajjal]

This for the data (lpData) not for the name (lpValueName).. The code shown is for the lpValueName

[clouds56]

Could you help review the pull request?

[anjohnson]

Note that the subject line of this particular github issue is about a different error return value and from a different function than that pull request is fixing...

[manojampalam]

Thanks @clouds56. Merged your PR.

[mabrowning]

@anjohnson is right... this issue is different from the PATH error fixed in #696

Here is my log from v0.0.12.0:

5188 10:09:19 767 Starting session: shell on console for mabrowning from 10.4.0.35 port 64794 id 0
5188 10:09:19 769 error: Error retrieving user environment variables. RegOpenKeyExW returned 5
5188 10:09:19 769 debug1: Executing command: C:\\Program Files\\OpenSSH\\ssh-shellhost.exe 
5188 10:09:19 789 fatal: ERROR. Cannot create process (1314).\n
5188 10:09:19 789 debug1: do_cleanup
5188 10:09:19 789 debug1: session_pty_cleanup: session 0 release console

I've got password & key authentication working, but this appears to be agent permission issues still.

[anjohnson]

@mabrowning Thanks for confirming this is still happening in a newer version. Whenever I login to my system that has this installed I get these log entries added to the sshd.log file:

2836 12:01:50 677 Accepted publickey for jenkins from 164.54.9.24 port 54272 ssh2: RSA SHA256:…
2836 12:01:50 724 error: Error retrieving user environment variables. RegOpenKeyExW returned 5

I already pointed out where the error message comes from, quoting Microsoft's own documentation, which even explains how to fix it. However @bingbing8 doesn't seem to care that the bug hasn't actually been fixed, just that the Github issue has been disposed of.

[mabrowning]

@anjohnson Am I understanding you correctly that you are successfully logging in, even with this error? All of my connections are getting 'socket closed' on the client side. Perhaps that is yet a different problem..

[anjohnson]

@mabrowning yes, my logins do succeed, so I doubt that the RegOpenKeyExW error is the cause of your problem. I think I'm running an older version than you are though (v0.0.10 IIRC) and in fact I have given up trying to use this software for my purposes until some other bugs get fixed — the stdin/stdout channels don't transport binary data properly, so I went back to the Cygwin sshd for now.

[neoblackxt]

My log file:
7164 16:18:58 515 Server listening on :: port 22.
7164 16:18:58 515 Server listening on 0.0.0.0 port 22.
5972 16:19:50 042 Accepted password for neo from ::1 port 49687 ssh2
5972 16:19:50 044 error: Error retrieving user environment variables. RegOpenKeyExW returned 5
5972 16:19:50 045 fatal: ERROR. Cannot create process (1314).\n
3632 16:37:17 495 Server listening on :: port 22.
3632 16:37:17 495 Server listening on 0.0.0.0 port 22.

I changed the SSHD service's attribution. Make it login as local system account other than "NT SERVICE\SSDH", and restart it, then it works. I don't know if to do this will lower the security.

[manojampalam]

@neoblackxt see if #690 helps. (assign needed privileges to sshd)

[manojampalam]

Reopening this issue to track "RegOpenKeyExW returned 5". This is fixed as part of #726