7 ms·

Install Win32 OpenSSH test release

49 points by mikemaccana 11y ago

voltagex_ 11y ago
Backspace doesn't work from a Linux box SSHing into Windows (strange world we live in), but otherwise it's great.
- jlgaddis 11y ago
  It may just be the settings in your SSH client (some of them are weird). Which SSH client are you using and have you tried any others?
- mikemaccana 11y ago
  See https://github.com/PowerShell/Win32-OpenSSH/issues/57 https://github.com/PowerShell/Win32-OpenSSH/issues/57. For some reason putty works but iTerm has the backspace issue. Putty user: what's your $TERM? Ctrl H works as a workaround BTW.
  - voltagex_ 11y ago
    $TERM from PuTTY - xterm $TERM from Terminal.app - xterm-256color
- tthayer 11y ago
  What about ^H?
  - voltagex_ 11y ago
    Works as backspace. DEL is working, but not updating the screen if that makes sense.
jlgaddis 11y ago
So once you've done this and you SSH in to the Windows box, I assume you just end up, basically, in a command window? For example: $ ssh username@windows.example.com ... C:\> Is that right?
- mikemaccana 11y ago
  Yes. From my Mac: $ ssh mike@192.168.0.12 mike@192.168.0.12's password: Microsoft Windows [Version 10.0.10586] (c) 2015 Microsoft Corporation. All rights reserved. C:\Users\Mike>powershell -File - PS C:\Users\Mike>
mikemaccana 11y ago
See also https://github.com/PowerShell/Win32-OpenSSH/wiki/ssh.exe-examples https://github.com/PowerShell/Win32-OpenSSH/wiki/ssh.exe-exa... once you've got it running. To work around a bug, you'll currently need to run `powershell -File -` It's still way too early to us as a daily driver - lots of small bugs - but nevertheless interesting.
0x0 11y ago
Interesting that the build instructions refer to Cygwin. It's a bit surprising, I'd have expected something more native. What does this bring to the table that regular Cygwin OpenSSHd couldn't do 10 years ago?
- quanticle 11y ago
  Powershell integration. Cygwin SSH drops you into a bash prompt running on the Windows box. Powershell is much more deeply integrated with Windows, and is more useful for actual system administration (e.g. configuring IIS, SQL Server, etc) than Cygwin's bash.
  - EvanAnderson 11y ago
    What "integration" are you seeing? It looks to me like they're just dumping you out to a CMD.EXE instance and leaving it up to you if you want to run Powershell. It's nice to see MSFT embracing SSH and all, but this is nothing that we haven't already been able to do for going on 10 years (likely longer) w/ OpenSSH on Win32.
    - Sanddancer 11y ago
      This is just a very early step one in their roadmap [1]. The deeper integration is in the next few steps in their development plan. [1] http://blogs.msdn.com/b/powershell/archive/2015/10/19/openssh-for-windows-update.aspx http://blogs.msdn.com/b/powershell/archive/2015/10/19/openss...
  - mikemaccana 11y ago
    Asides from being an actual Windows app as you mentioned, it's also a current OpenSSH codebase.
    - 0x0 11y ago
      But cygwin seems to have v7.1 too. Is it "just" a build that doesn't depend on cygwin.dll? (Although I can appreciate that's probably a nontrivial porting job). Genuinely curious about what's new here.
YCOmega 11y ago
Microsoft is going about the whole SSH thing in a very backwards way. If all they did was make or back an official POSIX environment, all of this comes for free. Insisting that PowerShell be the focal point for all these changes is just bizarre. Just install msys2.
- EvanAnderson 11y ago
  They purchased a reasonably nice POSIX environment when they bought Interix in 1999 (https://en.wikipedia.org/wiki/Interix https://en.wikipedia.org/wiki/Interix). Interix was a lot of fun to use, and I really wish it still existed as a product. I used to have fanciful dreams of a POSIX-based Linux-like "distribution" of Windows that kept a lot of the things I like about the Windows NT environment (NTFS filesystem, kernel object manager, service control manager) but jettisoned those things I don't.
  - YCOmega 11y ago
    Yeah, it went through a pile of rebrands until Windows 8 when it ended up getting pulled in one of the preview releases IIRC. I've wanted similar to you just so that people could target some kinda baseline on Windows with FOSS. I mean, I get that coming from the other direction, powershell seems like a nice treat. And if you use it, colour me impressed. I know in some cases, it's the only option for doing script work on Windows machines. But there is a much bigger and more sane ecosystem waiting if MS just rallied around SFU again. Probably cheaper too, tell the investors that.
    - gfody 11y ago
      I loved using SFU/Interix with Gentoo-prefix on XP and Win7 enterprise. I'm using Msys2 now and am pretty happy with it. There are mingw packages for practically everything but openssh is msys only. So this native openssh should give some speedup.
    - brazzledazzle 11y ago
      >I mean, I get that coming from the other direction, powershell seems like a nice treat. And if you use it, colour me impressed. I know in some cases, it's the only option for doing script work on Windows machines. Your dismissive attitude towards PowerShell makes me think you either haven't put much time into using it (if any) or haven't touched it since the 1.x days (even then the benefits over a string-based shell should have been obvious). It's a really good shell and is in a completely different league than sh/bash/zsh. It's not the best scripting language and there are still warts but until they make a solid and practical Ruby or Python based shell it's going to sit far and away from the rest. If the many replies you've gotten haven't been enough motivation I encourage you to actually try it out for a while.
zrm 11y ago
Feature request: Domain group policy setting for authorized keys. Make some ssh key(s) authorized to logon as some domain user(s) for every machine in the domain.
- EvanAnderson 11y ago
  You could do this right now w/ w/ a "Startup Script" or using Group Policy Preferences. The authorization to logon is, presumably, tied to the "User Right" to logon interactively and shouldn't have anything to do w/ the SSH server (since it's just userland).
  - zrm 11y ago
    Authorized keys in the context of ssh means the ability to logon without password using public key authentication. Now that I'm thinking about this, anybody know how they're doing public key authentication for domain accounts at all? If you don't use a password to logon, how are you supposed to get a Kerberos ticket to use domain network resources?
    - dijit 11y ago
      On Linux you can still execute 'kinit' to power up and get a ticket. (Via password). I'm sure there will be something similar. Unless authentication in the first place cannot be decoupled from ssh login, then your key would have to be able to grant you a Kerberos ticket.
    - brazzledazzle 11y ago
      I think you can use "klist" with "get": https://technet.microsoft.com/en-us/library/hh134826.aspx?f=255&MSPPError=-2147217396 https://technet.microsoft.com/en-us/library/hh134826.aspx?f=...
    - EvanAnderson 11y ago
      Yeah-- that was a pretty braindead response. I was thinking "authorized hosts". Now I feel silly. re: the public key authentication for domain accounts - They're calling the undocumented NtCreateToken() API in "win32auth.c". They don't need a password to create a token going that route. They've also got an LSA Security Package to do the key validation inside LSA. I'm looking at this very quickly, but I'm not seeing that they extended the AD schema to store the public key in the user's AD account. That would be the best way to handle it, ultimately-- just have the DCs use that SSH-LSA Security Package to authenticate the users against the public key stored in their AD account.
finid 11y ago
You can already install OpenSSH for Windows without bothering with PowerShell. See http://linuxbsdos.com/2015/07/30/how-to-install-openssh-on-windows-10/ http://linuxbsdos.com/2015/07/30/how-to-install-openssh-on-w...
- detaro 11y ago
  Can you run PowerShell through this? Also, you probably want PowerShell if you manage a windows system remotely. (Ok, you specifically maybe not, but many users do)
mortonpe 11y ago
This project is _not_ about bringing UNIX to Windows. It is about bringing the open ssh protocol to Windows. As a daily UNIX and Windows user in an enterprise environment, I can say that a fully integrated sshd is a welcomed addition. I have written and maintained many WinRM interop ruby gems and cannot wait until we can deprecate them in favor of a better and sane remote she'll implementation. This is a real milestone, keep up the great work. As for Cygwin sshd, it does work if posix is the order of the day but if you need a reliable terminal (for things like powershell) that scales to hundreds of servers and many admins Cygwin simply fails the test. Clunky domain authentication, private key auth is a joke, powershell only works sometimes (thanks PTY), network tokens are non-existent, etc. the list goes on and on.
jamiesonbecker 11y ago
This is great news. @ Userify[1], we're looking forward to porting our shim to PowerShell asap. 1. https://userify.com https://userify.com

49 points by mikemaccana 11y ago

voltagex_ 11y ago

Backspace doesn't work from a Linux box SSHing into Windows (strange world we live in), but otherwise it's great.

jlgaddis 11y ago
It may just be the settings in your SSH client (some of them are weird). Which SSH client are you using and have you tried any others?
mikemaccana 11y ago
See https://github.com/PowerShell/Win32-OpenSSH/issues/57 https://github.com/PowerShell/Win32-OpenSSH/issues/57. For some reason putty works but iTerm has the backspace issue. Putty user: what's your $TERM? Ctrl H works as a workaround BTW.
- voltagex_ 11y ago
  $TERM from PuTTY - xterm $TERM from Terminal.app - xterm-256color
tthayer 11y ago
What about ^H?
- voltagex_ 11y ago
  Works as backspace. DEL is working, but not updating the screen if that makes sense.

jlgaddis 11y ago

So once you've done this and you SSH in to the Windows box, I assume you just end up, basically, in a command window? For example: $ ssh username@windows.example.com ... C:\> Is that right?

mikemaccana 11y ago
Yes. From my Mac: $ ssh mike@192.168.0.12 mike@192.168.0.12's password: Microsoft Windows [Version 10.0.10586] (c) 2015 Microsoft Corporation. All rights reserved. C:\Users\Mike>powershell -File - PS C:\Users\Mike>

mikemaccana 11y ago

See also https://github.com/PowerShell/Win32-OpenSSH/wiki/ssh.exe-examples https://github.com/PowerShell/Win32-OpenSSH/wiki/ssh.exe-exa... once you've got it running. To work around a bug, you'll currently need to run `powershell -File -` It's still way too early to us as a daily driver - lots of small bugs - but nevertheless interesting.

0x0 11y ago

Interesting that the build instructions refer to Cygwin. It's a bit surprising, I'd have expected something more native. What does this bring to the table that regular Cygwin OpenSSHd couldn't do 10 years ago?

quanticle 11y ago
Powershell integration. Cygwin SSH drops you into a bash prompt running on the Windows box. Powershell is much more deeply integrated with Windows, and is more useful for actual system administration (e.g. configuring IIS, SQL Server, etc) than Cygwin's bash.
- EvanAnderson 11y ago
  What "integration" are you seeing? It looks to me like they're just dumping you out to a CMD.EXE instance and leaving it up to you if you want to run Powershell. It's nice to see MSFT embracing SSH and all, but this is nothing that we haven't already been able to do for going on 10 years (likely longer) w/ OpenSSH on Win32.
  - Sanddancer 11y ago
    This is just a very early step one in their roadmap [1]. The deeper integration is in the next few steps in their development plan. [1] http://blogs.msdn.com/b/powershell/archive/2015/10/19/openssh-for-windows-update.aspx http://blogs.msdn.com/b/powershell/archive/2015/10/19/openss...
- mikemaccana 11y ago
  Asides from being an actual Windows app as you mentioned, it's also a current OpenSSH codebase.
  - 0x0 11y ago
    But cygwin seems to have v7.1 too. Is it "just" a build that doesn't depend on cygwin.dll? (Although I can appreciate that's probably a nontrivial porting job). Genuinely curious about what's new here.

YCOmega 11y ago

Microsoft is going about the whole SSH thing in a very backwards way. If all they did was make or back an official POSIX environment, all of this comes for free. Insisting that PowerShell be the focal point for all these changes is just bizarre. Just install msys2.

EvanAnderson 11y ago
They purchased a reasonably nice POSIX environment when they bought Interix in 1999 (https://en.wikipedia.org/wiki/Interix https://en.wikipedia.org/wiki/Interix). Interix was a lot of fun to use, and I really wish it still existed as a product. I used to have fanciful dreams of a POSIX-based Linux-like "distribution" of Windows that kept a lot of the things I like about the Windows NT environment (NTFS filesystem, kernel object manager, service control manager) but jettisoned those things I don't.
- YCOmega 11y ago
  Yeah, it went through a pile of rebrands until Windows 8 when it ended up getting pulled in one of the preview releases IIRC. I've wanted similar to you just so that people could target some kinda baseline on Windows with FOSS. I mean, I get that coming from the other direction, powershell seems like a nice treat. And if you use it, colour me impressed. I know in some cases, it's the only option for doing script work on Windows machines. But there is a much bigger and more sane ecosystem waiting if MS just rallied around SFU again. Probably cheaper too, tell the investors that.
  - gfody 11y ago
    I loved using SFU/Interix with Gentoo-prefix on XP and Win7 enterprise. I'm using Msys2 now and am pretty happy with it. There are mingw packages for practically everything but openssh is msys only. So this native openssh should give some speedup.
  - brazzledazzle 11y ago
    >I mean, I get that coming from the other direction, powershell seems like a nice treat. And if you use it, colour me impressed. I know in some cases, it's the only option for doing script work on Windows machines. Your dismissive attitude towards PowerShell makes me think you either haven't put much time into using it (if any) or haven't touched it since the 1.x days (even then the benefits over a string-based shell should have been obvious). It's a really good shell and is in a completely different league than sh/bash/zsh. It's not the best scripting language and there are still warts but until they make a solid and practical Ruby or Python based shell it's going to sit far and away from the rest. If the many replies you've gotten haven't been enough motivation I encourage you to actually try it out for a while.

zrm 11y ago

Feature request: Domain group policy setting for authorized keys. Make some ssh key(s) authorized to logon as some domain user(s) for every machine in the domain.

EvanAnderson 11y ago
You could do this right now w/ w/ a "Startup Script" or using Group Policy Preferences. The authorization to logon is, presumably, tied to the "User Right" to logon interactively and shouldn't have anything to do w/ the SSH server (since it's just userland).
- zrm 11y ago
  Authorized keys in the context of ssh means the ability to logon without password using public key authentication. Now that I'm thinking about this, anybody know how they're doing public key authentication for domain accounts at all? If you don't use a password to logon, how are you supposed to get a Kerberos ticket to use domain network resources?
  - dijit 11y ago
    On Linux you can still execute 'kinit' to power up and get a ticket. (Via password). I'm sure there will be something similar. Unless authentication in the first place cannot be decoupled from ssh login, then your key would have to be able to grant you a Kerberos ticket.
  - brazzledazzle 11y ago
    I think you can use "klist" with "get": https://technet.microsoft.com/en-us/library/hh134826.aspx?f=255&MSPPError=-2147217396 https://technet.microsoft.com/en-us/library/hh134826.aspx?f=...
  - EvanAnderson 11y ago
    Yeah-- that was a pretty braindead response. I was thinking "authorized hosts". Now I feel silly. re: the public key authentication for domain accounts - They're calling the undocumented NtCreateToken() API in "win32auth.c". They don't need a password to create a token going that route. They've also got an LSA Security Package to do the key validation inside LSA. I'm looking at this very quickly, but I'm not seeing that they extended the AD schema to store the public key in the user's AD account. That would be the best way to handle it, ultimately-- just have the DCs use that SSH-LSA Security Package to authenticate the users against the public key stored in their AD account.

finid 11y ago

You can already install OpenSSH for Windows without bothering with PowerShell. See http://linuxbsdos.com/2015/07/30/how-to-install-openssh-on-windows-10/ http://linuxbsdos.com/2015/07/30/how-to-install-openssh-on-w...

detaro 11y ago
Can you run PowerShell through this? Also, you probably want PowerShell if you manage a windows system remotely. (Ok, you specifically maybe not, but many users do)

mortonpe 11y ago

This project is _not_ about bringing UNIX to Windows. It is about bringing the open ssh protocol to Windows. As a daily UNIX and Windows user in an enterprise environment, I can say that a fully integrated sshd is a welcomed addition. I have written and maintained many WinRM interop ruby gems and cannot wait until we can deprecate them in favor of a better and sane remote she'll implementation. This is a real milestone, keep up the great work. As for Cygwin sshd, it does work if posix is the order of the day but if you need a reliable terminal (for things like powershell) that scales to hundreds of servers and many admins Cygwin simply fails the test. Clunky domain authentication, private key auth is a joke, powershell only works sometimes (thanks PTY), network tokens are non-existent, etc. the list goes on and on.

jamiesonbecker 11y ago

This is great news. @ Userify[1], we're looking forward to porting our shim to PowerShell asap. 1. https://userify.com https://userify.com