3 ms·

I am on a corporate desktop, so I cannot use the Microsoft variant of the ssh-agent: C:\Users\luser>ssh-agent unable to start ssh-agent service, error :105

by chasil 3y ago

I am on a corporate desktop, so I cannot use the Microsoft variant of the ssh-agent: C:\Users\luser>ssh-agent unable to start ssh-agent service, error :1058 Obviously, getting that changed globally (or even for myself) is impossible. PuTTY has a workaround, allowing PAGENT.EXE to be used in place of the forbidden/inaccessible Microsoft agent: https://tartarus.org/~simon/putty-snapshots/htmldoc/Chapter9.html#pageant-cmdline-openssh https://tartarus.org/~simon/putty-snapshots/htmldoc/Chapter9... So PuTTY remains quite relevant because of the mechanisms that Microsoft has chosen.

WorldMaker 3y ago
I'm sorry that you need to work around the inability to run a simple Windows service because of some mistakenly bad corporate policy trying to micro-manage which Windows services are allowed to run. I don't think the long term solution should be "shadow IT install an older app just because it pretends to be a GUI rather than a Windows service", but I'm glad it is working for you in the short term. If you need ammunition to encourage your corporate IT to allow you to run the proper ssh-agent service to do your job instead of increasing your attack surface by installing PuTTY/Pageant, you could collect a list of vulnerabilities such as the one posted here (look at the huge count of affected versions on just this one!). There should be plenty of vulnerability maintenance evidence on the Microsoft-shipped version of an open source tool with a lot of eyeballs because it is "the standard" for almost all platforms over the "single developer" tool that took at least a decade off from active development (and it shows).
- stoperaticless 3y ago
  [dead]
- DEADMINCE 3y ago
  > some mistakenly bad corporate policy trying to micro-manage which Windows services are allowed to run. Actually, I'd say that's a good corporate policy.
  - chasil 3y ago
    ...and this is why PAGEANT.EXE is required for Microsoft OpenSSH.
    - chgs 3y ago
      And it’s why shadow IT exists and shadow IT is why companies don’t fall apart. It’s also why web apps are so popular and why the blackberry failed.
  - WorldMaker 3y ago
    That bad part is on the how it is tried to be micro-managed not the idea of allowlisting Windows Services in general. There are good reasons to allowlist things like Windows Services, sure. How you micro-manage that allowlist can be bad. Specific to this case, `ssh-agent` is a Windows Service shipped with Windows and signed by Microsoft. If your allowlist doesn't include built-in Windows services maybe your allowlist is deficient. Further specifically in this case, if you are using ssh (and/or sftp) as business tools and expecting some users to have those tools in their job workflows and processes, it really doesn't make sense not to allowlist the `ssh-agent` service so that those jobs can be performed, at least for those users doing those tasks. That should be obvious to any IT person that has used SSH ever before that having access to a reliable SSH agent is important. If your micro-management processes don't have good processes for making the right exceptions you teach your users to instead rely on the wrong loopholes, that's bad corporate policy. (Seriously, why would you encourage users to use an out-of-date program with known vulnerabilities, a tiny bus factor, existing known fakes that are malware vectors in the wild, when you can just quickly allowlist a single Windows service, shipped by Windows, and signed by Microsoft? How can you call any such corporate policy anything but bad in this specific example?)
    - DEADMINCE 3y ago
      > If your allowlist doesn't include built-in Windows services maybe your allowlist is deficient. Maybe. Or maybe as a matter of corporate policy you don't want your users connecting to other machines via SSH.
- gred 3y ago
  > If you need ammunition to encourage your corporate IT to allow you to run the proper ssh-agent service to do your job instead of increasing your attack surface by installing PuTTY/Pageant, you could collect a list of vulnerabilities such as the one posted here... This made me laugh :-) Grandparent is probably happy to just fly under the radar. The suggested conversation would probably play out thusly: > IT! You idiots! Your dumb policies are forcing me to use this insecure software! Look how many vulnerabilities it has had over the years! >> Hold up. Rewind. What's this software that you've installed? > It's called PuTTY. And if you just change this policy I could... >> And how insecure is it? > Just check out all these vulnerabilities! It's probably not worse than the average, but it's unnecessary extra attack surface area that... >> I'm going to need you to uninstall that. Now. And I'll need confirmation via email that you have done so by EOB, with your boss and the CISO on CC. > But if you just change this boneheaded policy... >> Now, please. We have a security incident on our hands. We can discuss policy another time. Is there anything else installed on your laptop that I should be aware of?
  - chasil 3y ago
    Actually, the corporate software repository is still pushing 0.67 or so. I need newer PuTTY to have a capable agent.
    - richardwhiuk 3y ago
      So the rationale you can't move to Windows SSH is because you can't run ssh-agent, but you can't run a useful version anyway?
      - chasil 3y ago
        I have my own copy of putty, which I use in preference to what is offered by corporate. I upgraded it to 0.81 today.
- chasil 3y ago
  Let me just explain my situation. We were directed to use our new corporate SFTP instead of direct communication with our vendors and customers. I tried direct ssh on the second account they gave us, got a shell, pulled /etc/passed, and my manager mailed it to corporate security. We had a long talk about configuring ssh. I don't know if it helped.
blueflow 3y ago
Really helpful. I found challenge in getting a Windows system (no admin) into a state where i can use it productively, and having a functional ssh-agent was one of the remaining pain points.
naikrovek 3y ago
ALWAYS GOOGLE THE ERROR MESSAGE, with context about what you’re doing! I encountered this, too, but the fix is quite simple. That service is set to “manual” by default, (or maybe “disabled”) and setting it to “automatic” then starting it will get you running. It is unlikely that this is a corporate lockdown measure.
- rzzzt 3y ago
  What about using AppLocker to restrict allowed executables to a subset of all available pieces of software on the machine?
  - naikrovek 3y ago
    It’s possible to lock this down, don’t misunderstand me. I’m saying it’s unlikely for a security team to make this decision on a system where pageant.exe is allowed to run.
- chasil 3y ago
  On my properties dialog for the OpenSSH authentication agent, all of the buttons under "service status" are disabled. I could probably get this enabled for myself, but all my users are also using this tool with ed25519 keys on PuTTY version 0.77. I need to stay in this realm.
  - naikrovek 3y ago
    > On my properties dialog for the OpenSSH authentication agent, all of the buttons under "service status" are disabled. Change the “Startup type” to either “manual” or “automatic” and some of those buttons should light up, if I am remembering correctly (I may be misremembering; I’ve been primarily a Mac user for over a year, now.) > I need to stay in this realm. That’s fine. PuTTygen converts ssh keys to and from OpenSSH format just fine, though, so it’s an option if you ever choose to explore it.
    - chasil 3y ago
nick__m 3y ago
WinCryptSSHAgent is a alternative

by chasil 3y ago

WorldMaker 3y ago

I'm sorry that you need to work around the inability to run a simple Windows service because of some mistakenly bad corporate policy trying to micro-manage which Windows services are allowed to run. I don't think the long term solution should be "shadow IT install an older app just because it pretends to be a GUI rather than a Windows service", but I'm glad it is working for you in the short term. If you need ammunition to encourage your corporate IT to allow you to run the proper ssh-agent service to do your job instead of increasing your attack surface by installing PuTTY/Pageant, you could collect a list of vulnerabilities such as the one posted here (look at the huge count of affected versions on just this one!). There should be plenty of vulnerability maintenance evidence on the Microsoft-shipped version of an open source tool with a lot of eyeballs because it is "the standard" for almost all platforms over the "single developer" tool that took at least a decade off from active development (and it shows).

stoperaticless 3y ago
[dead]
DEADMINCE 3y ago
> some mistakenly bad corporate policy trying to micro-manage which Windows services are allowed to run. Actually, I'd say that's a good corporate policy.
- chasil 3y ago
  ...and this is why PAGEANT.EXE is required for Microsoft OpenSSH.
  - chgs 3y ago
    And it’s why shadow IT exists and shadow IT is why companies don’t fall apart. It’s also why web apps are so popular and why the blackberry failed.
- WorldMaker 3y ago
  That bad part is on the how it is tried to be micro-managed not the idea of allowlisting Windows Services in general. There are good reasons to allowlist things like Windows Services, sure. How you micro-manage that allowlist can be bad. Specific to this case, `ssh-agent` is a Windows Service shipped with Windows and signed by Microsoft. If your allowlist doesn't include built-in Windows services maybe your allowlist is deficient. Further specifically in this case, if you are using ssh (and/or sftp) as business tools and expecting some users to have those tools in their job workflows and processes, it really doesn't make sense not to allowlist the `ssh-agent` service so that those jobs can be performed, at least for those users doing those tasks. That should be obvious to any IT person that has used SSH ever before that having access to a reliable SSH agent is important. If your micro-management processes don't have good processes for making the right exceptions you teach your users to instead rely on the wrong loopholes, that's bad corporate policy. (Seriously, why would you encourage users to use an out-of-date program with known vulnerabilities, a tiny bus factor, existing known fakes that are malware vectors in the wild, when you can just quickly allowlist a single Windows service, shipped by Windows, and signed by Microsoft? How can you call any such corporate policy anything but bad in this specific example?)
  - DEADMINCE 3y ago
    > If your allowlist doesn't include built-in Windows services maybe your allowlist is deficient. Maybe. Or maybe as a matter of corporate policy you don't want your users connecting to other machines via SSH.
gred 3y ago
> If you need ammunition to encourage your corporate IT to allow you to run the proper ssh-agent service to do your job instead of increasing your attack surface by installing PuTTY/Pageant, you could collect a list of vulnerabilities such as the one posted here... This made me laugh :-) Grandparent is probably happy to just fly under the radar. The suggested conversation would probably play out thusly: > IT! You idiots! Your dumb policies are forcing me to use this insecure software! Look how many vulnerabilities it has had over the years! >> Hold up. Rewind. What's this software that you've installed? > It's called PuTTY. And if you just change this policy I could... >> And how insecure is it? > Just check out all these vulnerabilities! It's probably not worse than the average, but it's unnecessary extra attack surface area that... >> I'm going to need you to uninstall that. Now. And I'll need confirmation via email that you have done so by EOB, with your boss and the CISO on CC. > But if you just change this boneheaded policy... >> Now, please. We have a security incident on our hands. We can discuss policy another time. Is there anything else installed on your laptop that I should be aware of?
- chasil 3y ago
  Actually, the corporate software repository is still pushing 0.67 or so. I need newer PuTTY to have a capable agent.
  - richardwhiuk 3y ago
    So the rationale you can't move to Windows SSH is because you can't run ssh-agent, but you can't run a useful version anyway?
    - chasil 3y ago
      I have my own copy of putty, which I use in preference to what is offered by corporate. I upgraded it to 0.81 today.
chasil 3y ago
Let me just explain my situation. We were directed to use our new corporate SFTP instead of direct communication with our vendors and customers. I tried direct ssh on the second account they gave us, got a shell, pulled /etc/passed, and my manager mailed it to corporate security. We had a long talk about configuring ssh. I don't know if it helped.

blueflow 3y ago

Really helpful. I found challenge in getting a Windows system (no admin) into a state where i can use it productively, and having a functional ssh-agent was one of the remaining pain points.

naikrovek 3y ago

ALWAYS GOOGLE THE ERROR MESSAGE, with context about what you’re doing! I encountered this, too, but the fix is quite simple. That service is set to “manual” by default, (or maybe “disabled”) and setting it to “automatic” then starting it will get you running. It is unlikely that this is a corporate lockdown measure.

rzzzt 3y ago
What about using AppLocker to restrict allowed executables to a subset of all available pieces of software on the machine?
- naikrovek 3y ago
  It’s possible to lock this down, don’t misunderstand me. I’m saying it’s unlikely for a security team to make this decision on a system where pageant.exe is allowed to run.
chasil 3y ago
On my properties dialog for the OpenSSH authentication agent, all of the buttons under "service status" are disabled. I could probably get this enabled for myself, but all my users are also using this tool with ed25519 keys on PuTTY version 0.77. I need to stay in this realm.
- naikrovek 3y ago
  > On my properties dialog for the OpenSSH authentication agent, all of the buttons under "service status" are disabled. Change the “Startup type” to either “manual” or “automatic” and some of those buttons should light up, if I am remembering correctly (I may be misremembering; I’ve been primarily a Mac user for over a year, now.) > I need to stay in this realm. That’s fine. PuTTygen converts ssh keys to and from OpenSSH format just fine, though, so it’s an option if you ever choose to explore it.
  - chasil 3y ago

nick__m 3y ago

WinCryptSSHAgent is a alternative