PowerShell / PowerShell/Win32-OpenSSH

Logging: Event Publishing Install Fails from install-sshd.ps1

Open
#1,816 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
No language data
Stars
8.3k
Forks
819
PR merge metrics
No merged PRs in 30d

Description

Troubleshooting steps
https://github.com/PowerShell/Win32-OpenSSH/wiki/Troubleshooting-Steps

Terminal issue? please go through wiki
https://github.com/PowerShell/Win32-OpenSSH/wiki/TTY-PTY-support-in-Windows-OpenSSH

Please answer the following

"OpenSSH for Windows" version
((Get-Item (Get-Command sshd).Source).VersionInfo.FileVersion)
8.6.0.0

Server OperatingSystem
((Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows nt\CurrentVersion\" -Name ProductName).ProductName)
Windows Server 2019 Datacenter

Client OperatingSystem
Windows Server 2019 Datacenter

What is failing
When running the included install-sshd.ps1 script a failure is recorded:

**** Warning: Publisher OpenSSH resources could not be found or are not accessible
to the EventLog service account (NT SERVICE\EventLog).

This is from the command wevtutil im "$etwman" which is attempting to install the manifest `C:\Program Files\OpenSSH\openssh-events.man'

Expected output
wevtutil im when successful does not produce output

Actual output

**** Warning: Publisher OpenSSH resources could not be found or are not accessible
to the EventLog service account (NT SERVICE\EventLog).

Workaround
I current have a workaround where I attempt to apply least privilege to the directory by granting read to the local EventLog account (cannot apply directly to the manifest file as the account need to traverse):

$path = 'C:\Program Files\OpenSSH\'
$acl = Get-Acl $path
$p = New-Object System.Security.Principal.NTAccount("NT Service\EventLog")
$accessRule = New-Object System.Security.AccessControl.FileSystemAccessRule($p, "Read", "ContainerInherit, ObjectInherit", "None", "Allow")
$acl.AddAccessRule($accessRule)
$acl | Set-Acl -Path $path

This permission must persist as granting temporary access only when installing the manifest and revoking later will lead to no events being logged after sshd is restarted.
Also of note if you grant overly permissive access (Everyone or BUILTIN\Users) this will work; however upon sshd service restart connections will fail which I assume to be some sort of internal security check.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with install-sshd.ps1 and the wevtutil im call for openssh-events.man, then reproduce on Windows Server 2019 using the reported OpenSSH version. Investigate the EventLog service account's access to the installation directory and manifest. Done means installation succeeds without the warning and events continue logging after sshd restarts with least-privilege permissions.

Written by the indexing model from the issue text.

Assessment

Tech stack
powershell
Domain
operating-systems, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.