Skip to content

Run SSHD as NetworkService #121

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Apr 25, 2017
Merged

Run SSHD as NetworkService #121

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
17f7f31
C1
manojampalam Apr 21, 2017
b917abf
C2
manojampalam Apr 21, 2017
064a1c1
C3
manojampalam Apr 25, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Binary file added contrib/win32/openssh/Win32-OpenSSh-design.pptx
View file
Open in desktop
Binary file not shown.
70 changes: 2 additions & 68 deletions contrib/win32/openssh/install-sshd.ps1
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,70 +11,6 @@ $logsdir = Join-Path $scriptdir "logs"

$sshdAccount = "NT SERVICE\SSHD"

#Idea borrowed from http://sqldbamusings.blogspot.com/2012/03/powershell-adding-accounts-to-local.html
function Add-Privilege
{
param(
[string] $Account,

[ValidateSet("SeAssignPrimaryTokenPrivilege", "SeServiceLogonRight")]
[string] $Privilege
)

#Get $Account SID
$account_sid = $null
try
{
$ntprincipal = new-object System.Security.Principal.NTAccount "$Account"
$sid = $ntprincipal.Translate([System.Security.Principal.SecurityIdentifier])
$account_sid = $sid.Value.ToString()
}
catch
{
Throw 'Unable to resolve '+ $Account
}

#Prepare policy settings file to be applied
$settings_to_export = [System.IO.Path]::GetTempFileName()
"[Unicode]" | Set-Content $settings_to_export -Encoding Unicode
"Unicode=yes" | Add-Content $settings_to_export -Force -WhatIf:$false
"[Version]" | Add-Content $settings_to_export -Force -WhatIf:$false
"signature=`"`$CHICAGO`$`"" | Add-Content $settings_to_export -Force -WhatIf:$false
"Revision=1" | Add-Content $settings_to_export -Force -WhatIf:$false
"[Privilege Rights]" | Add-Content $settings_to_export -Force -WhatIf:$false

#Get Current policy settings
$imported_settings = [System.IO.Path]::GetTempFileName()
secedit.exe /export /areas USER_RIGHTS /cfg "$($imported_settings)" > $null

if (-not(Test-Path $imported_settings)) {
Throw "Unable to import current security policy settings"
}

#find current assigned accounts to $Privilege and add it to $settings_to_export
$current_settings = Get-Content $imported_settings -Encoding Unicode
$existing_setting = $null
foreach ($setting in $current_settings) {
if ($setting -like "$Privilege`*") {
$existing_setting = $setting
}
}

#Add $account_sid to list
if ($existing_setting -eq $null) {
$Privilege + " = *" + $account_sid | Add-Content $settings_to_export -Force -WhatIf:$false
}
else
{
$existing_setting + ",*" + $account_sid | Add-Content $settings_to_export -Force -WhatIf:$false
}

#export
secedit.exe /configure /db "secedit.sdb" /cfg "$($settings_to_export)" /areas USER_RIGHTS > $null

}


if (-not (Test-Path $sshdpath)) {
throw "sshd.exe is not present in script path"
}
Expand All @@ -95,10 +31,8 @@ New-Service -Name ssh-agent -BinaryPathName $sshagentpath -Description "SSH Agen
cmd.exe /c 'sc.exe sdset ssh-agent D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)(A;;RP;;;AU)'

New-Service -Name sshd -BinaryPathName $sshdpath -Description "SSH Daemon" -StartupType Manual -DependsOn ssh-agent | Out-Null
sc.exe config sshd obj= $sshdAccount

Add-Privilege -Account $sshdAccount -Privilege SeAssignPrimaryTokenPrivilege
Add-Privilege -Account $sshdAccount -Privilege SeServiceLogonRight
sc.exe config sshd obj= "NT AUTHORITY\NetworkService"
sc.exe sidtype sshd unrestricted

if(-not (test-path $logsdir -PathType Container))
{
Expand Down
35 changes: 23 additions & 12 deletions contrib/win32/win32compat/ssh-agent/agent-main.c
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
/*
* Author: Manoj Ampalam <[email protected]>
* ssh-agent implementation on Windows
* NT Service routines
*
* Copyright (c) 2015 Microsoft Corp.
* All rights reserved
Expand Down Expand Up @@ -43,7 +44,8 @@ static SERVICE_STATUS_HANDLE service_status_handle;
static SERVICE_STATUS service_status;


static VOID ReportSvcStatus(DWORD dwCurrentState, DWORD dwWin32ExitCode, DWORD dwWaitHint)
static VOID
ReportSvcStatus(DWORD dwCurrentState, DWORD dwWin32ExitCode, DWORD dwWaitHint)
{
service_status.dwCurrentState = dwCurrentState;
service_status.dwWin32ExitCode = dwWin32ExitCode;
Expand All @@ -62,7 +64,8 @@ static VOID ReportSvcStatus(DWORD dwCurrentState, DWORD dwWin32ExitCode, DWORD d
SetServiceStatus(service_status_handle, &service_status);
}

static VOID WINAPI service_handler(DWORD dwControl)
static VOID WINAPI
service_handler(DWORD dwControl)
{
switch (dwControl)
{
Expand All @@ -81,22 +84,27 @@ static VOID WINAPI service_handler(DWORD dwControl)
ReportSvcStatus(service_status.dwCurrentState, NO_ERROR, 0);
}

BOOL WINAPI ctrl_c_handler(
_In_ DWORD dwCtrlType
) {
BOOL WINAPI
ctrl_c_handler(_In_ DWORD dwCtrlType)
{
/* for any Ctrl type, shutdown agent*/
debug("Ctrl+C received");
agent_shutdown();
return TRUE;
}

int wmain(int argc, wchar_t **argv) {

int
wmain(int argc, wchar_t **argv)
{
w32posix_initialize();
/* this exits() on failure*/
load_config();
if (!StartServiceCtrlDispatcherW(dispatch_table)) {
if (GetLastError() == ERROR_FAILED_SERVICE_CONTROLLER_CONNECT) {

/*
* agent is not spawned by SCM
* Its either started in debug mode or a worker child
*/
if (argc == 2) {
if (wcsncmp(argv[1], L"-ddd", 4) == 0)
log_init("ssh-agent", 7, 1, 1);
Expand All @@ -105,9 +113,10 @@ int wmain(int argc, wchar_t **argv) {
else if (wcsncmp(argv[1], L"-d", 2) == 0)
log_init("ssh-agent", 5, 1, 1);

/* Set Ctrl+C handler if starting in debug mode */
if (wcsncmp(argv[1], L"-d", 2) == 0) {
SetConsoleCtrlHandler(ctrl_c_handler, TRUE);
agent_start(TRUE, FALSE, 0);
agent_start(TRUE);
return 0;
}

Expand All @@ -116,7 +125,7 @@ int wmain(int argc, wchar_t **argv) {
h += _wtoi(*(argv + 1));
if (h != 0) {
log_init("ssh-agent", config_log_level(), 1, 0);
agent_start(FALSE, TRUE, h);
agent_process_connection(h);
return 0;
}
}
Expand Down Expand Up @@ -146,14 +155,16 @@ int wmain(int argc, wchar_t **argv) {
return 0;
}

int scm_start_service(DWORD num, LPWSTR* args) {
int
scm_start_service(DWORD num, LPWSTR* args)
{
service_status_handle = RegisterServiceCtrlHandlerW(L"ssh-agent", service_handler);
ZeroMemory(&service_status, sizeof(service_status));
service_status.dwServiceType = SERVICE_WIN32_OWN_PROCESS;
ReportSvcStatus(SERVICE_START_PENDING, NO_ERROR, 300);
ReportSvcStatus(SERVICE_RUNNING, NO_ERROR, 0);
log_init("ssh-agent", config_log_level(), 1, 0);
agent_start(FALSE, FALSE, 0);
agent_start(FALSE);
return 0;
}

Loading