PowerShell / PowerShell/Win32-OpenSSH
Logging: Event Publishing Install Fails from install-sshd.ps1
Nobody has claimed this yet.
- Dominant language
- No language data
- Stars
- 8.3k
- Forks
- 819
- PR merge metrics
- No merged PRs in 30d
Description
Troubleshooting steps
https://github.com/PowerShell/Win32-OpenSSH/wiki/Troubleshooting-Steps
Terminal issue? please go through wiki
https://github.com/PowerShell/Win32-OpenSSH/wiki/TTY-PTY-support-in-Windows-OpenSSH
Please answer the following
"OpenSSH for Windows" version
((Get-Item (Get-Command sshd).Source).VersionInfo.FileVersion)
8.6.0.0
Server OperatingSystem
((Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows nt\CurrentVersion\" -Name ProductName).ProductName)
Windows Server 2019 Datacenter
Client OperatingSystem
Windows Server 2019 Datacenter
What is failing
When running the included install-sshd.ps1 script a failure is recorded:
**** Warning: Publisher OpenSSH resources could not be found or are not accessible
to the EventLog service account (NT SERVICE\EventLog).
This is from the command wevtutil im "$etwman" which is attempting to install the manifest `C:\Program Files\OpenSSH\openssh-events.man'
Expected output
wevtutil im when successful does not produce output
Actual output
**** Warning: Publisher OpenSSH resources could not be found or are not accessible
to the EventLog service account (NT SERVICE\EventLog).
Workaround
I current have a workaround where I attempt to apply least privilege to the directory by granting read to the local EventLog account (cannot apply directly to the manifest file as the account need to traverse):
$path = 'C:\Program Files\OpenSSH\'
$acl = Get-Acl $path
$p = New-Object System.Security.Principal.NTAccount("NT Service\EventLog")
$accessRule = New-Object System.Security.AccessControl.FileSystemAccessRule($p, "Read", "ContainerInherit, ObjectInherit", "None", "Allow")
$acl.AddAccessRule($accessRule)
$acl | Set-Acl -Path $path
This permission must persist as granting temporary access only when installing the manifest and revoking later will lead to no events being logged after sshd is restarted.
Also of note if you grant overly permissive access (Everyone or BUILTIN\Users) this will work; however upon sshd service restart connections will fail which I assume to be some sort of internal security check.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with install-sshd.ps1 and the wevtutil im call for openssh-events.man, then reproduce on Windows Server 2019 using the reported OpenSSH version. Investigate the EventLog service account's access to the installation directory and manifest. Done means installation succeeds without the warning and events continue logging after sshd restarts with least-privilege permissions.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- powershell
- Domain
- operating-systems, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100