Run SSHD service as Network Service

[manojampalam]

Please answer the following

"OpenSSH for Windows" version
0.0.12.0

OS details
All

What is failing
SSHD runs as NT Service\SSHD requiring adding configuration at startup (ex. setting up privileges for this new account)

Expected output
Run SSHD service as Network Service with "Unrestricted" sidtype. This is consistent with how rest Windows of the services are configured.

Actual output

[rgl]

But is that the way to go? I mean, shouldn't the aim be to run each service in its own account (i.e. for privilege separation)?

[manojampalam]

That's true. Running sshd in its own account provides isolation from other services running as Network Service. On the other hand, this requires additional configuration (setting up privileges on the service account) and potentially others that Network Service typically enjoys being a built in account. We are evaluating the security benefits Vs ease of configuration.
Perhaps, running it as Network Service would be alright and secure on most systems and could be moved to its own service account on sensitive systems.

[rgl]

Besides, it would show us (at least me ;-) how to do this on Windows :-)

[DarwinJS]

This is really an installation issue right? Or does the service need to be tested under both contexts as well?

[manojampalam]

@DarwinJS service should be able to run under any context, as long as the account has the required privileges and permissions to open up network ports.

[manojampalam]

In the interest of security, SSHD service will continue to run in its service account context.