Do not allow all users to log in by default

Troubleshooting steps
https://github.com/PowerShell/Win32-OpenSSH/wiki/Troubleshooting-Steps

None

Terminal issue? please go through wiki
https://github.com/PowerShell/Win32-OpenSSH/wiki/TTY-PTY-support-in-Windows-OpenSSH

No

Please answer the following

"OpenSSH for Windows" version
((Get-Item (Get-Command sshd).Source).VersionInfo.FileVersion)

7.7.2.2

Server OperatingSystem
((Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows nt\CurrentVersion\" -Name ProductName).ProductName)

Windows Server 2019 Datacenter ( 10.0.17763.1339 )

Client OperatingSystem

Windows 10 Pro ( 10.0.19041.388 )

What is failing

Nothing

Expected output

Not applicable

Actual output

Not applicable

---

Suggestion

Please consider not allowing every user account to log in via ssh by default.
Many *nix-like systems have a group called ssh for this, which would be ideal on Windows too.
If not, at least restrict access to Administrators by default.

WinRM, DCOM, PSRemoting, RDP, CIM and all the other Windows remoting protocols only allow administrators by default
so that is the expected behavior.

Restricting access to only administrators later is not that easy because the well-known group S-1-5-32-544 has its name localized in the Windows OS, so it's sometimes "Administrators", sometimes "Administratoren", somtimes "Administrateurs" etc.
and the sshd_config does not accept a SID (#1640).
Not to mention, one cannot simply add the line "AllowGroups " to the end of the sshd_config file with a simple script, no you actually have to make sure it comes BEFORE the "Match Group administrators" entry which is in there by default or it has no effect! So there is actually some more sophisticated scripting needed to deploy ssh somewhat safely, which again could have its own bugs and failures.

I suggest:

1. Create local group "ssh" or "ssh users"
2. Add the S-1-5-32-544 ("Administrators" in english) group into "ssh"/"ssh users" by default
3. Allow the "ssh" or "ssh users" group ssh access by default, no one else

This is easy to manage for home users (just add people to the ssh group, although most home users only have 1 account and that is already an admin - not to mention you have to be an admin to install the ssh server anyway) and also sane for domain environments (admins have access by default, the other users don't)

Thanks

Start by reviewing the sshd_config entries mentioned in the issue, especially AllowGroups and the default Match Group administrators block. Determine how a default SSH-access group should be created and ordered relative to that block, then verify that administrators retain access while other users do not. The issue provides no test file or implementation entry point.