AllowGroups using "cached" group Membership information

Troubleshooting steps
https://github.com/PowerShell/Win32-OpenSSH/wiki/Troubleshooting-Steps

Terminal issue? please go through wiki
https://github.com/PowerShell/Win32-OpenSSH/wiki/TTY-PTY-support-in-Windows-OpenSSH

Please answer the following

"OpenSSH for Windows" version
((Get-Item (Get-Command sshd).Source).VersionInfo.FileVersion)

8.6.0.0

Server OperatingSystem
((Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows nt\CurrentVersion\" -Name ProductName).ProductName)

Windows Server 2016 Datacenter

Client OperatingSystem

Ubuntu 20.04.3 LTS (WSL2 / Windows 11 21H2)

What is failing

Background
We are using https://topicus-keyhub.com/ for access control, and public key provisioning in the AD.
Basically this products enabled/disables and add's or removes user from groups (timebased) on the AD.

SSHD uses AllowGroups "administrators", and this group contains the domain security groups that users are added / removed from.

Now if the user is added to the correct domain group, before logon everething works. But not in the reverse situation.

And if after a successfully logon, the ssh session is closed normally and the user is removed from the domain group, the user kan still logon for some time.

Somehow group information is cached?

I think it is the same issues described for VPN's here https://docs.microsoft.com/en-us/troubleshoot/windows-client/group-policy/group-membership-changes-not-updating-over-some-vpn-connections

Using RDP/WinRM this behavior doesn't seem happen.

sshd_config

# This is the sshd server system-wide configuration file.  See
# sshd_config(5) for more information.

# The strategy used for options in the default sshd_config shipped with
# OpenSSH is to specify options with their default value where
# possible, but leave them commented.  Uncommented options override the
# default value.

#Port 22
#AddressFamily any
#ListenAddress 0.0.0.0
#ListenAddress ::

#HostKey __PROGRAMDATA__/ssh/ssh_host_rsa_key
#HostKey __PROGRAMDATA__/ssh/ssh_host_dsa_key
#HostKey __PROGRAMDATA__/ssh/ssh_host_ecdsa_key
#HostKey __PROGRAMDATA__/ssh/ssh_host_ed25519_key

# Ciphers and keying
#RekeyLimit default none

# Logging
#SyslogFacility AUTH
#LogLevel INFO

SyslogFacility LOCAL0
LogLevel DEBUG3

# Authentication:

#LoginGraceTime 2m
LoginGraceTime 60
#PermitRootLogin prohibit-password
#StrictModes yes
#MaxAuthTries 6
#MaxSessions 10

#PubkeyAuthentication yes

CASignatureAlgorithms -rsa-sha2-512,rsa-sha2-256
Ciphers -aes128-ctr,aes192-ctr,aes256-ctr
MACs -hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha1
HostbasedAcceptedKeyTypes -rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,,rsa-sha2-512,rsa-sha2-256,ssh-rsa
HostKeyAlgorithms -rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,rsa-sha2-512,rsa-sha2-256,ssh-rsa
PubkeyAcceptedKeyTypes -ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,sk-ecdsa-sha2-nistp256@openssh.com,rsa-sha2-512,rsa-sha2-256,ssh-rsa

# The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2
# but this is overridden so installations will only check .ssh/authorized_keys
AuthorizedKeysFile	.ssh/authorized_keys

AuthorizedKeysCommand C:\ProgramData\ssh\adauthorizedkeys.cmd
AuthorizedKeysCommandUser System

#AuthorizedPrincipalsFile none

# For this to work you will also need host keys in %programData%/ssh/ssh_known_hosts
#HostbasedAuthentication no
# Change to yes if you don't trust ~/.ssh/known_hosts for
# HostbasedAuthentication
#IgnoreUserKnownHosts no
# Don't read the user's ~/.rhosts and ~/.shosts files
#IgnoreRhosts yes

# To disable tunneled clear text passwords, change to no here!
#PasswordAuthentication yes
PasswordAuthentication no
#PermitEmptyPasswords no

# GSSAPI options
#GSSAPIAuthentication no

#AllowAgentForwarding yes
#AllowTcpForwarding yes
#GatewayPorts no
#PermitTTY yes
#PrintMotd yes
#PrintLastLog yes
#TCPKeepAlive yes
#UseLogin no
#PermitUserEnvironment no
#ClientAliveInterval 0
ClientAliveInterval 300
#ClientAliveCountMax 3
ClientAliveCountMax 0
#UseDNS no
#PidFile /var/run/sshd.pid
#MaxStartups 10:30:100
#PermitTunnel no
#ChrootDirectory none
#VersionAddendum none
DisableForwarding yes

DenyUsers "administrator" "guest" 
AllowGroups "administrators" 

# no default banner path
#Banner none
Banner C:\ProgramData\ssh\banner

# override default of no subsystems
Subsystem	sftp	sftp-server.exe

# Example of overriding settings on a per-user basis
#Match User anoncvs
#	AllowTcpForwarding no
#	PermitTTY no
#	ForceCommand cvs server

Match Group administrators
       AuthorizedKeysFile __PROGRAMDATA__/ssh/administrators_authorized_keys

adauthorizedkeys.cmd

@ECHO OFF
FOR /F "tokens=2 delims=\\" %%G in ("%1") DO (
  C:\Windows\System32\dsquery.exe * -filter "(&(objectClass=user)(sAMAccountName=%%G))" -attr sshPublicKey -l
)

sshd.log

5644 2022-01-20 10:07:41.757 debug2: fd 3 setting O_NONBLOCK
5644 2022-01-20 10:07:41.757 debug3: sock_set_v6only: set socket 3 IPV6_V6ONLY
5644 2022-01-20 10:07:41.757 debug1: Bind to port 22 on ::.
5644 2022-01-20 10:07:41.757 Server listening on :: port 22.
5644 2022-01-20 10:07:41.757 debug2: fd 4 setting O_NONBLOCK
5644 2022-01-20 10:07:41.757 debug1: Bind to port 22 on 0.0.0.0.
5644 2022-01-20 10:07:41.757 Server listening on 0.0.0.0 port 22.
5644 2022-01-20 10:07:45.841 debug3: fd 5 is not O_NONBLOCK
5644 2022-01-20 10:07:45.841 debug3: spawning "C:\\Program Files\\OpenSSH-Win64\\sshd.exe" -R as subprocess
5644 2022-01-20 10:07:45.841 debug3: send_rexec_state: entering fd = 8 config len 1500
5644 2022-01-20 10:07:45.841 debug3: ssh_msg_send: type 0
5644 2022-01-20 10:07:45.841 debug3: send_rexec_state: done
4820 2022-01-20 10:07:45.872 debug1: inetd sockets after dupping: 4, 4
4820 2022-01-20 10:07:45.872 Connection from 10.x.x.82 port 60638 on 10.x.x.34 port 22
4820 2022-01-20 10:07:45.872 debug1: Local version string SSH-2.0-OpenSSH_for_Windows_8.6
4820 2022-01-20 10:07:45.872 debug1: Remote protocol version 2.0, remote software version OpenSSH_8.2p1 Ubuntu-4ubuntu0.4
4820 2022-01-20 10:07:45.872 debug1: compat_banner: match: OpenSSH_8.2p1 Ubuntu-4ubuntu0.4 pat OpenSSH* compat 0x04000000
4820 2022-01-20 10:07:45.872 debug2: fd 4 setting O_NONBLOCK
4820 2022-01-20 10:07:45.904 debug3: spawning "C:\\Program Files\\OpenSSH-Win64\\sshd.exe" -y as user
4820 2022-01-20 10:07:45.904 debug2: Network child is on pid 3760
4820 2022-01-20 10:07:45.904 debug3: send_rexec_state: entering fd = 6 config len 1500
4820 2022-01-20 10:07:45.904 debug3: ssh_msg_send: type 0
4820 2022-01-20 10:07:45.904 debug3: send_rexec_state: done
4820 2022-01-20 10:07:45.904 debug3: ssh_msg_send: type 0
4820 2022-01-20 10:07:45.904 debug3: ssh_msg_send: type 0
4820 2022-01-20 10:07:45.904 debug3: preauth child monitor started
4820 2022-01-20 10:07:45.919 debug3: append_hostkey_type: rsa-sha2-512 key not permitted by HostkeyAlgorithms [preauth]
4820 2022-01-20 10:07:45.919 debug3: append_hostkey_type: rsa-sha2-256 key not permitted by HostkeyAlgorithms [preauth]
4820 2022-01-20 10:07:45.919 debug3: append_hostkey_type: ssh-rsa key not permitted by HostkeyAlgorithms [preauth]
4820 2022-01-20 10:07:45.919 debug1: list_hostkey_types: ecdsa-sha2-nistp256,ssh-ed25519 [preauth]
4820 2022-01-20 10:07:45.919 debug3: send packet: type 20 [preauth]
4820 2022-01-20 10:07:45.919 debug1: SSH2_MSG_KEXINIT sent [preauth]
4820 2022-01-20 10:07:45.919 debug3: receive packet: type 20 [preauth]
4820 2022-01-20 10:07:45.919 debug1: SSH2_MSG_KEXINIT received [preauth]
4820 2022-01-20 10:07:45.919 debug2: local server KEXINIT proposal [preauth]
4820 2022-01-20 10:07:45.919 debug2: KEX algorithms: curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256 [preauth]
4820 2022-01-20 10:07:45.919 debug2: host key algorithms: ecdsa-sha2-nistp256,ssh-ed25519 [preauth]
4820 2022-01-20 10:07:45.919 debug2: ciphers ctos: chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com [preauth]
4820 2022-01-20 10:07:45.919 debug2: ciphers stoc: chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com [preauth]
4820 2022-01-20 10:07:45.919 debug2: MACs ctos: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512 [preauth]
4820 2022-01-20 10:07:45.919 debug2: MACs stoc: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512 [preauth]
4820 2022-01-20 10:07:45.919 debug2: compression ctos: none,zlib@openssh.com [preauth]
4820 2022-01-20 10:07:45.919 debug2: compression stoc: none,zlib@openssh.com [preauth]
4820 2022-01-20 10:07:45.919 debug2: languages ctos:  [preauth]
4820 2022-01-20 10:07:45.919 debug2: languages stoc:  [preauth]
4820 2022-01-20 10:07:45.919 debug2: first_kex_follows 0  [preauth]
4820 2022-01-20 10:07:45.919 debug2: reserved 0  [preauth]
4820 2022-01-20 10:07:45.919 debug2: peer client KEXINIT proposal [preauth]
4820 2022-01-20 10:07:45.919 debug2: KEX algorithms: curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,ext-info-c [preauth]
4820 2022-01-20 10:07:45.919 debug2: host key algorithms: ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256@openssh.com,ssh-ed25519,sk-ssh-ed25519@openssh.com,rsa-sha2-512,rsa-sha2-256,ssh-rsa [preauth]
4820 2022-01-20 10:07:45.919 debug2: ciphers ctos: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com [preauth]
4820 2022-01-20 10:07:45.919 debug2: ciphers stoc: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com [preauth]
4820 2022-01-20 10:07:45.919 debug2: MACs ctos: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1 [preauth]
4820 2022-01-20 10:07:45.919 debug2: MACs stoc: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1 [preauth]
4820 2022-01-20 10:07:45.919 debug2: compression ctos: none,zlib@openssh.com,zlib [preauth]
4820 2022-01-20 10:07:45.919 debug2: compression stoc: none,zlib@openssh.com,zlib [preauth]
4820 2022-01-20 10:07:45.919 debug2: languages ctos:  [preauth]
4820 2022-01-20 10:07:45.919 debug2: languages stoc:  [preauth]
4820 2022-01-20 10:07:45.919 debug2: first_kex_follows 0  [preauth]
4820 2022-01-20 10:07:45.919 debug2: reserved 0  [preauth]
4820 2022-01-20 10:07:45.919 debug1: kex: algorithm: curve25519-sha256 [preauth]
4820 2022-01-20 10:07:45.919 debug1: kex: host key algorithm: ecdsa-sha2-nistp256 [preauth]
4820 2022-01-20 10:07:45.919 debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none [preauth]
4820 2022-01-20 10:07:45.919 debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none [preauth]
4820 2022-01-20 10:07:45.919 debug1: expecting SSH2_MSG_KEX_ECDH_INIT [preauth]
4820 2022-01-20 10:07:45.972 debug3: receive packet: type 30 [preauth]
4820 2022-01-20 10:07:45.972 debug1: SSH2_MSG_KEX_ECDH_INIT received [preauth]
4820 2022-01-20 10:07:45.972 debug3: mm_sshkey_sign: entering [preauth]
4820 2022-01-20 10:07:45.972 debug3: mm_request_send: entering, type 6 [preauth]
4820 2022-01-20 10:07:45.972 debug3: mm_sshkey_sign: waiting for MONITOR_ANS_SIGN [preauth]
4820 2022-01-20 10:07:45.972 debug3: mm_request_receive_expect: entering, type 7 [preauth]
4820 2022-01-20 10:07:45.972 debug3: mm_request_receive: entering [preauth]
4820 2022-01-20 10:07:45.972 debug3: mm_request_receive: entering
4820 2022-01-20 10:07:45.972 debug3: monitor_read: checking request 6
4820 2022-01-20 10:07:45.972 debug3: mm_answer_sign: entering
4820 2022-01-20 10:07:45.988 debug3: mm_answer_sign: KEX signature 0000017619191500(100)
4820 2022-01-20 10:07:45.988 debug3: mm_request_send: entering, type 7
4820 2022-01-20 10:07:45.988 debug2: monitor_read: 6 used once, disabling now
4820 2022-01-20 10:07:45.988 debug3: send packet: type 31 [preauth]
4820 2022-01-20 10:07:45.988 debug3: send packet: type 21 [preauth]
4820 2022-01-20 10:07:45.988 debug2: set_newkeys: mode 1 [preauth]
4820 2022-01-20 10:07:45.988 debug1: rekey out after 134217728 blocks [preauth]
4820 2022-01-20 10:07:45.988 debug1: SSH2_MSG_NEWKEYS sent [preauth]
4820 2022-01-20 10:07:45.988 debug1: Sending SSH2_MSG_EXT_INFO [preauth]
4820 2022-01-20 10:07:45.988 debug3: send packet: type 7 [preauth]
4820 2022-01-20 10:07:45.988 debug1: expecting SSH2_MSG_NEWKEYS [preauth]
4820 2022-01-20 10:07:46.035 debug3: receive packet: type 21 [preauth]
4820 2022-01-20 10:07:46.035 debug1: SSH2_MSG_NEWKEYS received [preauth]
4820 2022-01-20 10:07:46.035 debug2: set_newkeys: mode 0 [preauth]
4820 2022-01-20 10:07:46.035 debug1: rekey in after 134217728 blocks [preauth]
4820 2022-01-20 10:07:46.035 debug1: KEX done [preauth]
4820 2022-01-20 10:07:46.144 debug3: receive packet: type 5 [preauth]
4820 2022-01-20 10:07:46.144 debug3: send packet: type 6 [preauth]
4820 2022-01-20 10:07:46.160 debug3: receive packet: type 50 [preauth]
4820 2022-01-20 10:07:46.160 debug1: userauth-request for user username service ssh-connection method none [preauth]
4820 2022-01-20 10:07:46.160 debug1: attempt 0 failures 0 [preauth]
4820 2022-01-20 10:07:46.160 debug3: mm_getpwnamallow: entering [preauth]
4820 2022-01-20 10:07:46.160 debug3: mm_request_send: entering, type 8 [preauth]
4820 2022-01-20 10:07:46.160 debug3: mm_getpwnamallow: waiting for MONITOR_ANS_PWNAM [preauth]
4820 2022-01-20 10:07:46.160 debug3: mm_request_receive_expect: entering, type 9 [preauth]
4820 2022-01-20 10:07:46.160 debug3: mm_request_receive: entering [preauth]
4820 2022-01-20 10:07:46.160 debug3: mm_request_receive: entering
4820 2022-01-20 10:07:46.160 debug3: monitor_read: checking request 8
4820 2022-01-20 10:07:46.160 debug3: mm_answer_pwnamallow: entering
4820 2022-01-20 10:07:46.160 debug2: parse_server_config_depth: config reprocess config len 1500
4820 2022-01-20 10:07:46.160 debug3: checking match for 'Group administrators' user domain\\username host 10.x.x.82 addr 10.x.x.82 laddr 10.x.x.34 lport 22
4820 2022-01-20 10:07:46.176 debug3: lookup_principal_name: Successfully discovered explicit principal name: 'domain\\username'=>'username@domain.local'
4820 2022-01-20 10:07:46.176 debug1: generate_s4u_user_token: LsaLogonUser() failed. User 'domain\\username' Status: 0xC000006E SubStatus -1073741710.
4820 2022-01-20 10:07:46.176 debug3: get_user_token - unable to generate token for user domain\\username
4820 2022-01-20 10:07:46.207 debug3: lookup_principal_name: Successfully discovered explicit principal name: 'domain\\username'=>'username@domain.local'
4820 2022-01-20 10:07:46.207 debug1: generate_s4u_user_token: LsaLogonUser() failed. User 'domain\\username' Status: 0xC000006E SubStatus -1073741710.
4820 2022-01-20 10:07:46.207 error: get_user_token - unable to generate token on 2nd attempt for user domain\\username
4820 2022-01-20 10:07:46.207 fatal: ga_init, unable to resolve user domain\\username
4820 2022-01-20 10:07:46.207 debug1: do_cleanup
4820 2022-01-20 10:07:46.207 debug1: Killing privsep child 3760
5644 2022-01-20 10:07:59.644 debug3: fd 5 is not O_NONBLOCK
5644 2022-01-20 10:07:59.644 debug3: spawning "C:\\Program Files\\OpenSSH-Win64\\sshd.exe" -R as subprocess
5644 2022-01-20 10:07:59.660 debug3: send_rexec_state: entering fd = 8 config len 1500
5644 2022-01-20 10:07:59.660 debug3: ssh_msg_send: type 0
5644 2022-01-20 10:07:59.660 debug3: send_rexec_state: done
4448 2022-01-20 10:07:59.675 debug1: inetd sockets after dupping: 4, 4
4448 2022-01-20 10:07:59.675 Connection from 10.x.x.82 port 60642 on 10.x.x.34 port 22
4448 2022-01-20 10:07:59.675 debug1: Local version string SSH-2.0-OpenSSH_for_Windows_8.6
4448 2022-01-20 10:07:59.675 debug1: Remote protocol version 2.0, remote software version OpenSSH_8.2p1 Ubuntu-4ubuntu0.4
4448 2022-01-20 10:07:59.675 debug1: compat_banner: match: OpenSSH_8.2p1 Ubuntu-4ubuntu0.4 pat OpenSSH* compat 0x04000000
4448 2022-01-20 10:07:59.675 debug2: fd 4 setting O_NONBLOCK
4448 2022-01-20 10:07:59.691 debug3: spawning "C:\\Program Files\\OpenSSH-Win64\\sshd.exe" -y as user
4448 2022-01-20 10:07:59.691 debug2: Network child is on pid 3284
4448 2022-01-20 10:07:59.706 debug3: send_rexec_state: entering fd = 6 config len 1500
4448 2022-01-20 10:07:59.706 debug3: ssh_msg_send: type 0
4448 2022-01-20 10:07:59.706 debug3: send_rexec_state: done
4448 2022-01-20 10:07:59.706 debug3: ssh_msg_send: type 0
4448 2022-01-20 10:07:59.706 debug3: ssh_msg_send: type 0
4448 2022-01-20 10:07:59.706 debug3: preauth child monitor started
4448 2022-01-20 10:07:59.722 debug3: append_hostkey_type: rsa-sha2-512 key not permitted by HostkeyAlgorithms [preauth]
4448 2022-01-20 10:07:59.722 debug3: append_hostkey_type: rsa-sha2-256 key not permitted by HostkeyAlgorithms [preauth]
4448 2022-01-20 10:07:59.722 debug3: append_hostkey_type: ssh-rsa key not permitted by HostkeyAlgorithms [preauth]
4448 2022-01-20 10:07:59.722 debug1: list_hostkey_types: ecdsa-sha2-nistp256,ssh-ed25519 [preauth]
4448 2022-01-20 10:07:59.722 debug3: send packet: type 20 [preauth]
4448 2022-01-20 10:07:59.722 debug1: SSH2_MSG_KEXINIT sent [preauth]
4448 2022-01-20 10:07:59.722 debug3: receive packet: type 20 [preauth]
4448 2022-01-20 10:07:59.722 debug1: SSH2_MSG_KEXINIT received [preauth]
4448 2022-01-20 10:07:59.722 debug2: local server KEXINIT proposal [preauth]
4448 2022-01-20 10:07:59.722 debug2: KEX algorithms: curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256 [preauth]
4448 2022-01-20 10:07:59.722 debug2: host key algorithms: ecdsa-sha2-nistp256,ssh-ed25519 [preauth]
4448 2022-01-20 10:07:59.722 debug2: ciphers ctos: chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com [preauth]
4448 2022-01-20 10:07:59.722 debug2: ciphers stoc: chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com [preauth]
4448 2022-01-20 10:07:59.722 debug2: MACs ctos: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512 [preauth]
4448 2022-01-20 10:07:59.722 debug2: MACs stoc: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512 [preauth]
4448 2022-01-20 10:07:59.722 debug2: compression ctos: none,zlib@openssh.com [preauth]
4448 2022-01-20 10:07:59.722 debug2: compression stoc: none,zlib@openssh.com [preauth]
4448 2022-01-20 10:07:59.722 debug2: languages ctos:  [preauth]
4448 2022-01-20 10:07:59.722 debug2: languages stoc:  [preauth]
4448 2022-01-20 10:07:59.722 debug2: first_kex_follows 0  [preauth]
4448 2022-01-20 10:07:59.722 debug2: reserved 0  [preauth]
4448 2022-01-20 10:07:59.722 debug2: peer client KEXINIT proposal [preauth]
4448 2022-01-20 10:07:59.722 debug2: KEX algorithms: curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,ext-info-c [preauth]
4448 2022-01-20 10:07:59.722 debug2: host key algorithms: ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256@openssh.com,ssh-ed25519,sk-ssh-ed25519@openssh.com,rsa-sha2-512,rsa-sha2-256,ssh-rsa [preauth]
4448 2022-01-20 10:07:59.722 debug2: ciphers ctos: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com [preauth]
4448 2022-01-20 10:07:59.722 debug2: ciphers stoc: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com [preauth]
4448 2022-01-20 10:07:59.722 debug2: MACs ctos: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1 [preauth]
4448 2022-01-20 10:07:59.722 debug2: MACs stoc: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1 [preauth]
4448 2022-01-20 10:07:59.722 debug2: compression ctos: none,zlib@openssh.com,zlib [preauth]
4448 2022-01-20 10:07:59.722 debug2: compression stoc: none,zlib@openssh.com,zlib [preauth]
4448 2022-01-20 10:07:59.722 debug2: languages ctos:  [preauth]
4448 2022-01-20 10:07:59.722 debug2: languages stoc:  [preauth]
4448 2022-01-20 10:07:59.722 debug2: first_kex_follows 0  [preauth]
4448 2022-01-20 10:07:59.722 debug2: reserved 0  [preauth]
4448 2022-01-20 10:07:59.722 debug1: kex: algorithm: curve25519-sha256 [preauth]
4448 2022-01-20 10:07:59.722 debug1: kex: host key algorithm: ecdsa-sha2-nistp256 [preauth]
4448 2022-01-20 10:07:59.722 debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none [preauth]
4448 2022-01-20 10:07:59.722 debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none [preauth]
4448 2022-01-20 10:07:59.722 debug1: expecting SSH2_MSG_KEX_ECDH_INIT [preauth]
4448 2022-01-20 10:07:59.785 debug3: receive packet: type 30 [preauth]
4448 2022-01-20 10:07:59.785 debug1: SSH2_MSG_KEX_ECDH_INIT received [preauth]
4448 2022-01-20 10:07:59.800 debug3: mm_sshkey_sign: entering [preauth]
4448 2022-01-20 10:07:59.800 debug3: mm_request_send: entering, type 6 [preauth]
4448 2022-01-20 10:07:59.800 debug3: mm_request_receive: entering
4448 2022-01-20 10:07:59.800 debug3: monitor_read: checking request 6
4448 2022-01-20 10:07:59.800 debug3: mm_answer_sign: entering
4448 2022-01-20 10:07:59.800 debug3: mm_answer_sign: KEX signature 000001ADF7B3DE70(101)
4448 2022-01-20 10:07:59.800 debug3: mm_request_send: entering, type 7
4448 2022-01-20 10:07:59.800 debug2: monitor_read: 6 used once, disabling now
4448 2022-01-20 10:07:59.800 debug3: mm_sshkey_sign: waiting for MONITOR_ANS_SIGN [preauth]
4448 2022-01-20 10:07:59.800 debug3: mm_request_receive_expect: entering, type 7 [preauth]
4448 2022-01-20 10:07:59.800 debug3: mm_request_receive: entering [preauth]
4448 2022-01-20 10:07:59.800 debug3: send packet: type 31 [preauth]
4448 2022-01-20 10:07:59.800 debug3: send packet: type 21 [preauth]
4448 2022-01-20 10:07:59.800 debug2: set_newkeys: mode 1 [preauth]
4448 2022-01-20 10:07:59.800 debug1: rekey out after 134217728 blocks [preauth]
4448 2022-01-20 10:07:59.800 debug1: SSH2_MSG_NEWKEYS sent [preauth]
4448 2022-01-20 10:07:59.800 debug1: Sending SSH2_MSG_EXT_INFO [preauth]
4448 2022-01-20 10:07:59.800 debug3: send packet: type 7 [preauth]
4448 2022-01-20 10:07:59.800 debug1: expecting SSH2_MSG_NEWKEYS [preauth]
4448 2022-01-20 10:07:59.847 debug3: receive packet: type 21 [preauth]
4448 2022-01-20 10:07:59.847 debug1: SSH2_MSG_NEWKEYS received [preauth]
4448 2022-01-20 10:07:59.863 debug2: set_newkeys: mode 0 [preauth]
4448 2022-01-20 10:07:59.863 debug1: rekey in after 134217728 blocks [preauth]
4448 2022-01-20 10:07:59.863 debug1: KEX done [preauth]
4448 2022-01-20 10:07:59.894 debug3: receive packet: type 5 [preauth]
4448 2022-01-20 10:07:59.894 debug3: send packet: type 6 [preauth]
4448 2022-01-20 10:07:59.910 debug3: receive packet: type 50 [preauth]
4448 2022-01-20 10:07:59.910 debug1: userauth-request for user username service ssh-connection method none [preauth]
4448 2022-01-20 10:07:59.910 debug1: attempt 0 failures 0 [preauth]
4448 2022-01-20 10:07:59.910 debug3: mm_getpwnamallow: entering [preauth]
4448 2022-01-20 10:07:59.910 debug3: mm_request_send: entering, type 8 [preauth]
4448 2022-01-20 10:07:59.910 debug3: mm_request_receive: entering
4448 2022-01-20 10:07:59.910 debug3: monitor_read: checking request 8
4448 2022-01-20 10:07:59.910 debug3: mm_answer_pwnamallow: entering
4448 2022-01-20 10:07:59.910 debug2: parse_server_config_depth: config reprocess config len 1500
4448 2022-01-20 10:07:59.910 debug3: checking match for 'Group administrators' user domain\\username host 10.x.x.82 addr 10.x.x.82 laddr 10.x.x.34 lport 22
4448 2022-01-20 10:07:59.925 debug3: lookup_principal_name: Successfully discovered explicit principal name: 'domain\\username'=>'username@domain.local'
4448 2022-01-20 10:07:59.925 debug3: LsaLogonUser Succeeded (Impersonation: 0)
4448 2022-01-20 10:07:59.925 debug1: user domain\\username matched group list administrators at line 109
4448 2022-01-20 10:07:59.925 debug3: match found
4448 2022-01-20 10:07:59.925 debug3: reprocess config:110 setting AuthorizedKeysFile __PROGRAMDATA__/ssh/administrators_authorized_keys
4448 2022-01-20 10:07:59.925 debug3: lookup_principal_name: Successfully discovered explicit principal name: 'domain\\username'=>'username@domain.local'
4448 2022-01-20 10:07:59.925 debug3: LsaLogonUser Succeeded (Impersonation: 0)
4448 2022-01-20 10:07:59.925 debug3: mm_answer_pwnamallow: sending MONITOR_ANS_PWNAM: 1
4448 2022-01-20 10:07:59.925 debug3: mm_request_send: entering, type 9
4448 2022-01-20 10:07:59.925 debug2: monitor_read: 8 used once, disabling now
4448 2022-01-20 10:07:59.925 debug3: mm_getpwnamallow: waiting for MONITOR_ANS_PWNAM [preauth]
4448 2022-01-20 10:07:59.925 debug3: mm_request_receive_expect: entering, type 9 [preauth]
4448 2022-01-20 10:07:59.925 debug3: mm_request_receive: entering [preauth]
4448 2022-01-20 10:07:59.925 debug2: input_userauth_request: setting up authctxt for username [preauth]
4448 2022-01-20 10:07:59.925 debug3: mm_inform_authserv: entering [preauth]
4448 2022-01-20 10:07:59.925 debug3: mm_request_send: entering, type 4 [preauth]
4448 2022-01-20 10:07:59.925 debug3: mm_auth2_read_banner: entering [preauth]
4448 2022-01-20 10:07:59.925 debug3: mm_request_send: entering, type 10 [preauth]
4448 2022-01-20 10:07:59.925 debug3: mm_request_receive_expect: entering, type 11 [preauth]
4448 2022-01-20 10:07:59.925 debug3: mm_request_receive: entering [preauth]
4448 2022-01-20 10:07:59.925 debug3: mm_request_receive: entering
4448 2022-01-20 10:07:59.925 debug3: monitor_read: checking request 4
4448 2022-01-20 10:07:59.925 debug3: mm_answer_authserv: service=ssh-connection, style=
4448 2022-01-20 10:07:59.925 debug2: monitor_read: 4 used once, disabling now
4448 2022-01-20 10:07:59.925 debug3: mm_request_receive: entering
4448 2022-01-20 10:07:59.925 debug3: monitor_read: checking request 10
4448 2022-01-20 10:07:59.925 debug3: mm_request_send: entering, type 11
4448 2022-01-20 10:07:59.925 debug2: monitor_read: 10 used once, disabling now
4448 2022-01-20 10:07:59.925 debug3: send packet: type 53 [preauth]
4448 2022-01-20 10:07:59.925 debug1: userauth_send_banner: sent [preauth]
4448 2022-01-20 10:07:59.925 debug2: input_userauth_request: try method none [preauth]
4448 2022-01-20 10:07:59.925 debug3: user_specific_delay: user specific delay 0.000ms [preauth]
4448 2022-01-20 10:07:59.925 debug3: ensure_minimum_time_since: elapsed 15.608ms, delaying 4.782ms (requested 5.098ms) [preauth]
4448 2022-01-20 10:07:59.941 debug3: userauth_finish: failure partial=0 next methods="publickey,keyboard-interactive" [preauth]
4448 2022-01-20 10:07:59.941 debug3: send packet: type 51 [preauth]
4448 2022-01-20 10:08:00.003 debug3: receive packet: type 50 [preauth]
4448 2022-01-20 10:08:00.003 debug1: userauth-request for user username service ssh-connection method publickey [preauth]
4448 2022-01-20 10:08:00.003 debug1: attempt 1 failures 0 [preauth]
4448 2022-01-20 10:08:00.003 debug2: input_userauth_request: try method publickey [preauth]
4448 2022-01-20 10:08:00.003 debug2: userauth_pubkey: valid user username querying public key ssh-ed25519 <pubkey> [preauth]
4448 2022-01-20 10:08:00.003 debug1: userauth_pubkey: test pkalg ssh-ed25519 pkblob ED25519 SHA256:<pubkey> [preauth]
4448 2022-01-20 10:08:00.003 debug3: mm_key_allowed: entering [preauth]
4448 2022-01-20 10:08:00.003 debug3: mm_request_send: entering, type 22 [preauth]
4448 2022-01-20 10:08:00.003 debug3: mm_key_allowed: waiting for MONITOR_ANS_KEYALLOWED [preauth]
4448 2022-01-20 10:08:00.003 debug3: mm_request_receive_expect: entering, type 23 [preauth]
4448 2022-01-20 10:08:00.003 debug3: mm_request_receive: entering [preauth]
4448 2022-01-20 10:08:00.003 debug3: mm_request_receive: entering
4448 2022-01-20 10:08:00.003 debug3: monitor_read: checking request 22
4448 2022-01-20 10:08:00.003 debug3: mm_answer_keyallowed: entering
4448 2022-01-20 10:08:00.003 debug3: mm_answer_keyallowed: key_from_blob: 000001ADF7B06BA0
4448 2022-01-20 10:08:00.003 debug1: trying public key file __PROGRAMDATA__/ssh/administrators_authorized_keys
4448 2022-01-20 10:08:00.003 debug3: Failed to open file:C:/ProgramData/ssh/administrators_authorized_keys error:2
4448 2022-01-20 10:08:00.003 debug1: Could not open authorized keys '__PROGRAMDATA__/ssh/administrators_authorized_keys': No such file or directory
4448 2022-01-20 10:08:00.003 debug3: subprocess: AuthorizedKeysCommand command "C:\\ProgramData\\ssh\\adauthorizedkeys.cmd domain\\username" running as system (flags 0x6)
4448 2022-01-20 10:08:00.003 debug1: starting subprocess using posix_spawnp
4448 2022-01-20 10:08:00.003 debug3: spawning "C:\\ProgramData\\ssh\\adauthorizedkeys.cmd" domain\\username as subprocess
4448 2022-01-20 10:08:00.035 debug3: subprocess: AuthorizedKeysCommand pid 5788
4448 2022-01-20 10:08:00.128 debug1: C:\\ProgramData\\ssh\\adauthorizedkeys.cmd:1: matching key found: ED25519 SHA256:<pubkey>
4448 2022-01-20 10:08:00.128 debug1: C:\\ProgramData\\ssh\\adauthorizedkeys.cmd:1: key options: agent-forwarding port-forwarding pty user-rc x11-forwarding
4448 2022-01-20 10:08:00.128 Accepted key ED25519 SHA256:<pubkey> found at C:\\ProgramData\\ssh\\adauthorizedkeys.cmd:1
4448 2022-01-20 10:08:00.128 debug3: mm_answer_keyallowed: publickey authentication test: ED25519 key is allowed
4448 2022-01-20 10:08:00.128 debug3: mm_request_send: entering, type 23
4448 2022-01-20 10:08:00.128 debug3: send packet: type 60 [preauth]
4448 2022-01-20 10:08:00.128 debug2: userauth_pubkey: authenticated 0 pkalg ssh-ed25519 [preauth]
4448 2022-01-20 10:08:00.128 debug3: user_specific_delay: user specific delay 0.000ms [preauth]
4448 2022-01-20 10:08:00.128 debug3: ensure_minimum_time_since: elapsed 124.990ms, delaying 38.131ms (requested 5.098ms) [preauth]
4448 2022-01-20 10:08:00.175 Postponed publickey for username from 10.x.x.82 port 60642 ssh2 [preauth]
4448 2022-01-20 10:08:00.222 debug3: receive packet: type 50 [preauth]
4448 2022-01-20 10:08:00.222 debug1: userauth-request for user username service ssh-connection method publickey [preauth]
4448 2022-01-20 10:08:00.222 debug1: attempt 2 failures 0 [preauth]
4448 2022-01-20 10:08:00.222 debug2: input_userauth_request: try method publickey [preauth]
4448 2022-01-20 10:08:00.222 debug2: userauth_pubkey: valid user username attempting public key ssh-ed25519 <pubkey> [preauth]
4448 2022-01-20 10:08:00.222 debug3: userauth_pubkey: have ssh-ed25519 signature for ED25519 SHA256:<pubkey> [preauth]
4448 2022-01-20 10:08:00.222 debug3: mm_key_allowed: entering [preauth]
4448 2022-01-20 10:08:00.222 debug3: mm_request_send: entering, type 22 [preauth]
4448 2022-01-20 10:08:00.222 debug3: mm_key_allowed: waiting for MONITOR_ANS_KEYALLOWED [preauth]
4448 2022-01-20 10:08:00.222 debug3: mm_request_receive_expect: entering, type 23 [preauth]
4448 2022-01-20 10:08:00.222 debug3: mm_request_receive: entering [preauth]
4448 2022-01-20 10:08:00.222 debug3: mm_request_receive: entering
4448 2022-01-20 10:08:00.222 debug3: monitor_read: checking request 22
4448 2022-01-20 10:08:00.222 debug3: mm_answer_keyallowed: entering
4448 2022-01-20 10:08:00.222 debug3: mm_answer_keyallowed: key_from_blob: 000001ADF7B06F10
4448 2022-01-20 10:08:00.222 debug1: trying public key file __PROGRAMDATA__/ssh/administrators_authorized_keys
4448 2022-01-20 10:08:00.222 debug3: Failed to open file:C:/ProgramData/ssh/administrators_authorized_keys error:2
4448 2022-01-20 10:08:00.222 debug1: Could not open authorized keys '__PROGRAMDATA__/ssh/administrators_authorized_keys': No such file or directory
4448 2022-01-20 10:08:00.222 debug3: subprocess: AuthorizedKeysCommand command "C:\\ProgramData\\ssh\\adauthorizedkeys.cmd domain\\username" running as system (flags 0x6)
4448 2022-01-20 10:08:00.222 debug1: starting subprocess using posix_spawnp
4448 2022-01-20 10:08:00.222 debug3: spawning "C:\\ProgramData\\ssh\\adauthorizedkeys.cmd" domain\\username as subprocess
4448 2022-01-20 10:08:00.222 debug3: subprocess: AuthorizedKeysCommand pid 5896
4448 2022-01-20 10:08:00.331 debug1: C:\\ProgramData\\ssh\\adauthorizedkeys.cmd:1: matching key found: ED25519 SHA256:<pubkey>
4448 2022-01-20 10:08:00.331 debug1: C:\\ProgramData\\ssh\\adauthorizedkeys.cmd:1: key options: agent-forwarding port-forwarding pty user-rc x11-forwarding
4448 2022-01-20 10:08:00.331 Accepted key ED25519 SHA256:<pubkey> found at C:\\ProgramData\\ssh\\adauthorizedkeys.cmd:1
4448 2022-01-20 10:08:00.331 debug3: mm_answer_keyallowed: publickey authentication: ED25519 key is allowed
4448 2022-01-20 10:08:00.331 debug3: mm_request_send: entering, type 23
4448 2022-01-20 10:08:00.331 debug3: mm_sshkey_verify: entering [preauth]
4448 2022-01-20 10:08:00.331 debug3: mm_request_send: entering, type 24 [preauth]
4448 2022-01-20 10:08:00.331 debug3: mm_request_receive: entering
4448 2022-01-20 10:08:00.331 debug3: monitor_read: checking request 24
4448 2022-01-20 10:08:00.331 debug3: mm_answer_keyverify: publickey 000001ADF7B06BA0 signature verified
4448 2022-01-20 10:08:00.331 debug1: auth_activate_options: setting new authentication options
4448 2022-01-20 10:08:00.331 debug3: mm_request_send: entering, type 25
4448 2022-01-20 10:08:00.347 Accepted publickey for username from 10.x.x.82 port 60642 ssh2: ED25519 SHA256:<pubkey>
4448 2022-01-20 10:08:00.347 debug1: monitor_child_preauth: user username authenticated by privileged process
4448 2022-01-20 10:08:00.347 debug3: mm_get_keystate: Waiting for new keys
4448 2022-01-20 10:08:00.347 debug3: mm_request_receive_expect: entering, type 26
4448 2022-01-20 10:08:00.347 debug3: mm_request_receive: entering
4448 2022-01-20 10:08:00.394 debug3: mm_get_keystate: GOT new keys
4448 2022-01-20 10:08:00.394 debug3: mm_sshkey_verify: waiting for MONITOR_ANS_KEYVERIFY [preauth]
4448 2022-01-20 10:08:00.394 debug3: mm_request_receive_expect: entering, type 25 [preauth]
4448 2022-01-20 10:08:00.394 debug3: mm_request_receive: entering [preauth]
4448 2022-01-20 10:08:00.394 debug1: auth_activate_options: setting new authentication options [preauth]
4448 2022-01-20 10:08:00.394 debug2: userauth_pubkey: authenticated 1 pkalg ssh-ed25519 [preauth]
4448 2022-01-20 10:08:00.394 debug3: user_specific_delay: user specific delay 0.000ms [preauth]
4448 2022-01-20 10:08:00.394 debug3: ensure_minimum_time_since: elapsed 124.995ms, delaying 38.126ms (requested 5.098ms) [preauth]
4448 2022-01-20 10:08:00.394 debug3: send packet: type 52 [preauth]
4448 2022-01-20 10:08:00.394 debug3: mm_request_send: entering, type 26 [preauth]
4448 2022-01-20 10:08:00.394 debug3: mm_send_keystate: Finished sending state [preauth]
4448 2022-01-20 10:08:00.394 debug1: monitor_read_log: child log fd closed
4448 2022-01-20 10:08:00.394 debug3: lookup_principal_name: Successfully discovered explicit principal name: 'domain\\username'=>'username@domain.local'
4448 2022-01-20 10:08:00.394 debug3: LsaLogonUser Succeeded (Impersonation: 1)
4448 2022-01-20 10:08:00.410 debug3: spawning "C:\\Program Files\\OpenSSH-Win64\\sshd.exe" -z as user
4448 2022-01-20 10:08:00.410 User child is on pid 4660
4448 2022-01-20 10:08:00.410 debug3: send_rexec_state: entering fd = 5 config len 1500
4448 2022-01-20 10:08:00.410 debug3: ssh_msg_send: type 0
4448 2022-01-20 10:08:00.425 debug3: send_rexec_state: done
4448 2022-01-20 10:08:00.425 debug3: ssh_msg_send: type 0
4448 2022-01-20 10:08:00.425 debug3: ssh_msg_send: type 0
4660 2022-01-20 10:08:00.425 debug3: recv_idexch_state: entering fd = 3
4660 2022-01-20 10:08:00.425 debug3: ssh_msg_recv entering
4660 2022-01-20 10:08:00.425 debug3: recv_idexch_state: done
4660 2022-01-20 10:08:00.425 debug2: fd 4 setting O_NONBLOCK
4660 2022-01-20 10:08:00.425 debug3: recv_autxctx_state: entering fd = 3
4660 2022-01-20 10:08:00.425 debug3: ssh_msg_recv entering
4448 2022-01-20 10:08:00.425 debug3: ssh_msg_send: type 0
4660 2022-01-20 10:08:00.425 debug3: recv_autxctx_state: done
4660 2022-01-20 10:08:00.425 debug2: parse_server_config_depth: config reprocess config len 1500
4660 2022-01-20 10:08:00.425 debug3: checking match for 'Group administrators' user domain\\username host 10.x.x.82 addr 10.x.x.82 laddr 10.x.x.34 lport 22
4660 2022-01-20 10:08:00.425 debug3: get_user_token - i am running as domain\\username, returning process token
4660 2022-01-20 10:08:00.425 debug1: user domain\\username matched group list administrators at line 109
4660 2022-01-20 10:08:00.425 debug3: match found
4660 2022-01-20 10:08:00.425 debug3: reprocess config:110 setting AuthorizedKeysFile __PROGRAMDATA__/ssh/administrators_authorized_keys
4660 2022-01-20 10:08:00.425 debug3: get_user_token - i am running as domain\\username, returning process token
4448 2022-01-20 10:08:00.425 debug3: ssh_msg_send: type 0
4660 2022-01-20 10:08:00.425 debug3: monitor_recv_keystate: entering 
4660 2022-01-20 10:08:00.425 debug3: ssh_msg_recv entering
4660 2022-01-20 10:08:00.425 debug3: monitor_recv_keystate: done
4660 2022-01-20 10:08:00.425 debug3: monitor_apply_keystate: packet_set_state
4660 2022-01-20 10:08:00.425 debug2: set_newkeys: mode 0
4660 2022-01-20 10:08:00.425 debug1: rekey in after 134217728 blocks
4660 2022-01-20 10:08:00.425 debug2: set_newkeys: mode 1
4660 2022-01-20 10:08:00.425 debug1: rekey out after 134217728 blocks
4660 2022-01-20 10:08:00.425 debug1: ssh_packet_set_postauth: called
4660 2022-01-20 10:08:00.425 debug3: ssh_packet_set_state: done
4660 2022-01-20 10:08:00.425 debug3: monitor_recv_authopt: entering 
4660 2022-01-20 10:08:00.425 debug3: ssh_msg_recv entering
4448 2022-01-20 10:08:00.425 debug3: ssh_msg_send: type 0
4660 2022-01-20 10:08:00.425 debug3: monitor_recv_authopt: done
4660 2022-01-20 10:08:00.425 debug3: notify_hostkeys: key 0: ssh-rsa SHA256:+TmwBO/kipGLNVWphM+9qFCXNg68ihfAEJ9uFZ94zvM
4660 2022-01-20 10:08:00.425 debug3: notify_hostkeys: key 1: ecdsa-sha2-nistp256 SHA256:ejFES9PWNwoEhN7TfeO8vlasi/D7t5difu1qMLGipGU
4660 2022-01-20 10:08:00.425 debug3: notify_hostkeys: key 2: ssh-ed25519 SHA256:YKiccWtwQr58hLkEvjDmX91kpaNlcJXO1Tpitc2v2mc
4660 2022-01-20 10:08:00.425 debug3: notify_hostkeys: sent 3 hostkeys
4660 2022-01-20 10:08:00.425 debug3: send packet: type 80
4660 2022-01-20 10:08:00.425 debug1: active: key options: agent-forwarding port-forwarding pty user-rc x11-forwarding
4660 2022-01-20 10:08:00.425 debug1: Entering interactive session for SSH2.
4660 2022-01-20 10:08:00.425 debug2: fd 7 setting O_NONBLOCK
4660 2022-01-20 10:08:00.425 debug2: fd 8 setting O_NONBLOCK
4660 2022-01-20 10:08:00.425 debug1: server_init_dispatch
4660 2022-01-20 10:08:00.425 debug3: receive packet: type 90
4660 2022-01-20 10:08:00.425 debug1: server_input_channel_open: ctype session rchan 0 win 1048576 max 16384
4660 2022-01-20 10:08:00.425 debug1: input_session_request
4660 2022-01-20 10:08:00.425 debug1: channel 0: new [server-session]
4660 2022-01-20 10:08:00.425 debug2: session_new: allocate (allocated 0 max 10)
4660 2022-01-20 10:08:00.425 debug3: session_unused: session id 0 unused
4660 2022-01-20 10:08:00.425 debug1: session_new: session 0
4660 2022-01-20 10:08:00.425 debug1: session_open: channel 0
4660 2022-01-20 10:08:00.425 debug1: session_open: session 0: link with channel 0
4660 2022-01-20 10:08:00.425 debug1: server_input_channel_open: confirm session
4660 2022-01-20 10:08:00.425 debug3: send packet: type 91
4660 2022-01-20 10:08:00.425 debug3: receive packet: type 80
4660 2022-01-20 10:08:00.425 debug1: server_input_global_request: rtype no-more-sessions@openssh.com want_reply 0
4660 2022-01-20 10:08:00.550 debug3: receive packet: type 98
4660 2022-01-20 10:08:00.550 debug1: server_input_channel_req: channel 0 request pty-req reply 1
4660 2022-01-20 10:08:00.550 debug1: session_by_channel: session 0 channel 0
4660 2022-01-20 10:08:00.550 debug1: session_input_channel_req: session 0 req pty-req
4660 2022-01-20 10:08:00.550 debug1: Allocating pty.
4660 2022-01-20 10:08:00.550 debug3: fd 9 is not O_NONBLOCK
4660 2022-01-20 10:08:00.550 debug3: fd 10 is not O_NONBLOCK
4660 2022-01-20 10:08:00.550 debug1: session_pty_req: session 0 alloc windows-pty
4660 2022-01-20 10:08:00.550 debug1: Ignoring unsupported tty mode opcode 1 (0x1)
4660 2022-01-20 10:08:00.550 debug1: Ignoring unsupported tty mode opcode 2 (0x2)
4660 2022-01-20 10:08:00.550 debug1: Ignoring unsupported tty mode opcode 3 (0x3)
4660 2022-01-20 10:08:00.550 debug1: Ignoring unsupported tty mode opcode 4 (0x4)
4660 2022-01-20 10:08:00.550 debug1: Ignoring unsupported tty mode opcode 5 (0x5)
4660 2022-01-20 10:08:00.550 debug1: Ignoring unsupported tty mode opcode 6 (0x6)
4660 2022-01-20 10:08:00.550 debug1: Ignoring unsupported tty mode opcode 7 (0x7)
4660 2022-01-20 10:08:00.550 debug1: Ignoring unsupported tty mode opcode 8 (0x8)
4660 2022-01-20 10:08:00.550 debug1: Ignoring unsupported tty mode opcode 9 (0x9)
4660 2022-01-20 10:08:00.550 debug1: Ignoring unsupported tty mode opcode 10 (0xa)
4660 2022-01-20 10:08:00.550 debug1: Ignoring unsupported tty mode opcode 12 (0xc)
4660 2022-01-20 10:08:00.550 debug1: Ignoring unsupported tty mode opcode 13 (0xd)
4660 2022-01-20 10:08:00.550 debug1: Ignoring unsupported tty mode opcode 14 (0xe)
4660 2022-01-20 10:08:00.550 debug1: Ignoring unsupported tty mode opcode 18 (0x12)
4660 2022-01-20 10:08:00.550 debug1: Ignoring unsupported tty mode opcode 30 (0x1e)
4660 2022-01-20 10:08:00.550 debug1: Ignoring unsupported tty mode opcode 31 (0x1f)
4660 2022-01-20 10:08:00.550 debug1: Ignoring unsupported tty mode opcode 32 (0x20)
4660 2022-01-20 10:08:00.550 debug1: Ignoring unsupported tty mode opcode 33 (0x21)
4660 2022-01-20 10:08:00.550 debug1: Ignoring unsupported tty mode opcode 34 (0x22)
4660 2022-01-20 10:08:00.550 debug1: Ignoring unsupported tty mode opcode 35 (0x23)
4660 2022-01-20 10:08:00.550 debug1: Ignoring unsupported tty mode opcode 36 (0x24)
4660 2022-01-20 10:08:00.550 debug1: Ignoring unsupported tty mode opcode 37 (0x25)
4660 2022-01-20 10:08:00.550 debug1: Ignoring unsupported tty mode opcode 38 (0x26)
4660 2022-01-20 10:08:00.550 debug1: Ignoring unsupported tty mode opcode 39 (0x27)
4660 2022-01-20 10:08:00.550 debug1: Ignoring unsupported tty mode opcode 40 (0x28)
4660 2022-01-20 10:08:00.550 debug1: Ignoring unsupported tty mode opcode 41 (0x29)
4660 2022-01-20 10:08:00.550 debug1: Ignoring unsupported tty mode opcode 42 (0x2a)
4660 2022-01-20 10:08:00.550 debug1: Ignoring unsupported tty mode opcode 50 (0x32)
4660 2022-01-20 10:08:00.550 debug1: Ignoring unsupported tty mode opcode 51 (0x33)
4660 2022-01-20 10:08:00.550 debug1: Ignoring unsupported tty mode opcode 52 (0x34)
4660 2022-01-20 10:08:00.550 debug1: Ignoring unsupported tty mode opcode 53 (0x35)
4660 2022-01-20 10:08:00.550 debug1: Ignoring unsupported tty mode opcode 54 (0x36)
4660 2022-01-20 10:08:00.550 debug1: Ignoring unsupported tty mode opcode 55 (0x37)
4660 2022-01-20 10:08:00.550 debug1: Ignoring unsupported tty mode opcode 56 (0x38)
4660 2022-01-20 10:08:00.550 debug1: Ignoring unsupported tty mode opcode 57 (0x39)
4660 2022-01-20 10:08:00.550 debug1: Ignoring unsupported tty mode opcode 58 (0x3a)
4660 2022-01-20 10:08:00.550 debug1: Ignoring unsupported tty mode opcode 59 (0x3b)
4660 2022-01-20 10:08:00.550 debug1: Ignoring unsupported tty mode opcode 60 (0x3c)
4660 2022-01-20 10:08:00.550 debug1: Ignoring unsupported tty mode opcode 61 (0x3d)
4660 2022-01-20 10:08:00.550 debug1: Ignoring unsupported tty mode opcode 62 (0x3e)
4660 2022-01-20 10:08:00.550 debug1: Ignoring unsupported tty mode opcode 70 (0x46)
4660 2022-01-20 10:08:00.550 debug1: Ignoring unsupported tty mode opcode 71 (0x47)
4660 2022-01-20 10:08:00.550 debug1: Ignoring unsupported tty mode opcode 72 (0x48)
4660 2022-01-20 10:08:00.550 debug1: Ignoring unsupported tty mode opcode 73 (0x49)
4660 2022-01-20 10:08:00.550 debug1: Ignoring unsupported tty mode opcode 74 (0x4a)
4660 2022-01-20 10:08:00.550 debug1: Ignoring unsupported tty mode opcode 75 (0x4b)
4660 2022-01-20 10:08:00.550 debug1: Ignoring unsupported tty mode opcode 90 (0x5a)
4660 2022-01-20 10:08:00.550 debug1: Ignoring unsupported tty mode opcode 91 (0x5b)
4660 2022-01-20 10:08:00.550 debug1: Ignoring unsupported tty mode opcode 92 (0x5c)
4660 2022-01-20 10:08:00.550 debug1: Ignoring unsupported tty mode opcode 93 (0x5d)
4660 2022-01-20 10:08:00.550 debug3: send packet: type 99
4660 2022-01-20 10:08:00.550 debug3: receive packet: type 98
4660 2022-01-20 10:08:00.550 debug1: server_input_channel_req: channel 0 request env reply 0
4660 2022-01-20 10:08:00.550 debug1: session_by_channel: session 0 channel 0
4660 2022-01-20 10:08:00.550 debug1: session_input_channel_req: session 0 req env
4660 2022-01-20 10:08:00.550 debug2: Ignoring env request LANG: disallowed name
4660 2022-01-20 10:08:00.550 debug3: receive packet: type 98
4660 2022-01-20 10:08:00.550 debug1: server_input_channel_req: channel 0 request shell reply 1
4660 2022-01-20 10:08:00.550 debug1: session_by_channel: session 0 channel 0
4660 2022-01-20 10:08:00.550 debug1: session_input_channel_req: session 0 req shell
4660 2022-01-20 10:08:00.550 Starting session: shell on windows-pty for domain\\username from 10.x.x.82 port 60642 id 0
4660 2022-01-20 10:08:00.551 debug2: fd 11 setting O_NONBLOCK
4660 2022-01-20 10:08:00.551 debug2: fd 12 setting O_NONBLOCK
4660 2022-01-20 10:08:00.551 debug2: fd 13 setting O_NONBLOCK
4660 2022-01-20 10:08:00.551 debug2: fd 14 setting O_NONBLOCK
4660 2022-01-20 10:08:00.551 debug2: fd 15 setting O_NONBLOCK
4660 2022-01-20 10:08:00.551 debug2: fd 16 setting O_NONBLOCK
4660 2022-01-20 10:08:00.551 debug3: shell: "c:\\windows\\system32\\cmd.exe"
4660 2022-01-20 10:08:00.551 debug3: shell_option: /c
4660 2022-01-20 10:08:00.551 debug3: couldn't find CreatePseudoConsole() in kernel32.dll dll
4660 2022-01-20 10:08:00.551 debug3: This windows OS doesn't support conpty
4660 2022-01-20 10:08:00.551 debug3: pty commandline: "C:\\Program Files\\OpenSSH-Win64\\ssh-shellhost.exe" ---pty "c:\\windows\\system32\\cmd.exe"
4660 2022-01-20 10:08:00.556 debug2: fd 4 setting TCP_NODELAY
4660 2022-01-20 10:08:00.556 debug2: channel 0: rfd 13 isatty
4660 2022-01-20 10:08:00.556 debug3: fd 13 is O_NONBLOCK
4660 2022-01-20 10:08:00.556 debug3: fd 12 is O_NONBLOCK
4660 2022-01-20 10:08:00.557 debug3: send packet: type 99
4660 2022-01-20 10:08:03.418 debug2: channel 0: read<=0 rfd 13 len 0
4660 2022-01-20 10:08:03.418 debug2: channel 0: read failed
4660 2022-01-20 10:08:03.418 debug2: chan_shutdown_read: channel 0: (i0 o0 sock -1 wfd 13 efd -1 [closed])
4660 2022-01-20 10:08:03.418 debug2: channel 0: input open -> drain
4660 2022-01-20 10:08:03.418 debug2: channel 0: ibuf empty
4660 2022-01-20 10:08:03.418 debug2: channel 0: send eof
4660 2022-01-20 10:08:03.418 debug3: send packet: type 96
4660 2022-01-20 10:08:03.418 debug2: channel 0: input drain -> closed
4660 2022-01-20 10:08:03.418 debug1: Received SIGCHLD.
4660 2022-01-20 10:08:03.418 debug1: session_by_pid: pid 5044
4660 2022-01-20 10:08:03.418 debug1: session_exit_message: session 0 channel 0 pid 5044
4660 2022-01-20 10:08:03.418 debug2: channel 0: request exit-status confirm 0
4660 2022-01-20 10:08:03.418 debug3: send packet: type 98
4660 2022-01-20 10:08:03.418 debug1: session_exit_message: release channel 0
4660 2022-01-20 10:08:03.418 debug2: channel 0: write failed
4660 2022-01-20 10:08:03.418 debug2: chan_shutdown_write: channel 0: (i3 o0 sock -1 wfd 12 efd -1 [closed])
4660 2022-01-20 10:08:03.418 debug2: channel 0: send eow
4660 2022-01-20 10:08:03.418 debug3: send packet: type 98
4660 2022-01-20 10:08:03.418 debug2: channel 0: output open -> closed
4660 2022-01-20 10:08:03.418 debug2: channel 0: send close
4660 2022-01-20 10:08:03.418 debug3: send packet: type 97
4660 2022-01-20 10:08:03.418 debug3: channel 0: will not send data after close
4660 2022-01-20 10:08:03.418 debug2: notify_done: reading
4660 2022-01-20 10:08:03.418 debug3: channel 0: will not send data after close
4660 2022-01-20 10:08:03.481 debug3: receive packet: type 97
4660 2022-01-20 10:08:03.481 debug2: channel 0: rcvd close
4660 2022-01-20 10:08:03.481 debug3: channel 0: will not send data after close
4660 2022-01-20 10:08:03.481 debug2: channel 0: is dead
4660 2022-01-20 10:08:03.481 debug2: channel 0: gc: notify user
4660 2022-01-20 10:08:03.481 debug1: session_by_channel: session 0 channel 0
4660 2022-01-20 10:08:03.481 debug1: session_close_by_channel: channel 0 child 0
4660 2022-01-20 10:08:03.481 Close session: user domain\\username from 10.x.x.82 port 60642 id 0
4660 2022-01-20 10:08:03.481 debug3: session_unused: session id 0 unused
4660 2022-01-20 10:08:03.481 debug2: channel 0: gc: user detached
4660 2022-01-20 10:08:03.481 debug2: channel 0: is dead
4660 2022-01-20 10:08:03.481 debug2: channel 0: garbage collecting
4660 2022-01-20 10:08:03.481 debug1: channel 0: free: server-session, nchannels 1
4660 2022-01-20 10:08:03.481 debug3: channel 0: status: The following connections are open:\r\n  #0 server-session (t4 r0 i3/0 o3/0 e[closed]/0 fd -1/-1/-1 sock -1 cc -1)\r\n
4660 2022-01-20 10:08:03.481 debug3: receive packet: type 1
4660 2022-01-20 10:08:03.481 Received disconnect from 10.x.x.82 port 60642:11: disconnected by user
4660 2022-01-20 10:08:03.481 Disconnected from 10.x.x.82 port 60642
4660 2022-01-20 10:08:03.481 debug1: do_cleanup
4448 2022-01-20 10:08:03.481 debug3: mm_request_receive: entering
4448 2022-01-20 10:08:03.481 debug1: do_cleanup
5644 2022-01-20 10:08:07.013 debug3: fd 5 is not O_NONBLOCK
5644 2022-01-20 10:08:07.013 debug3: spawning "C:\\Program Files\\OpenSSH-Win64\\sshd.exe" -R as subprocess
5644 2022-01-20 10:08:07.013 debug3: send_rexec_state: entering fd = 8 config len 1500
5644 2022-01-20 10:08:07.013 debug3: ssh_msg_send: type 0
5644 2022-01-20 10:08:07.029 debug3: send_rexec_state: done
1488 2022-01-20 10:08:07.044 debug1: inetd sockets after dupping: 4, 4
1488 2022-01-20 10:08:07.044 Connection from 10.x.x.82 port 60626 on 10.x.x.34 port 22
1488 2022-01-20 10:08:07.044 debug1: Local version string SSH-2.0-OpenSSH_for_Windows_8.6
1488 2022-01-20 10:08:07.044 debug1: Remote protocol version 2.0, remote software version OpenSSH_8.2p1 Ubuntu-4ubuntu0.4
1488 2022-01-20 10:08:07.044 debug1: compat_banner: match: OpenSSH_8.2p1 Ubuntu-4ubuntu0.4 pat OpenSSH* compat 0x04000000
1488 2022-01-20 10:08:07.044 debug2: fd 4 setting O_NONBLOCK
1488 2022-01-20 10:08:07.076 debug3: spawning "C:\\Program Files\\OpenSSH-Win64\\sshd.exe" -y as user
1488 2022-01-20 10:08:07.076 debug2: Network child is on pid 4824
1488 2022-01-20 10:08:07.076 debug3: send_rexec_state: entering fd = 6 config len 1500
1488 2022-01-20 10:08:07.076 debug3: ssh_msg_send: type 0
1488 2022-01-20 10:08:07.076 debug3: send_rexec_state: done
1488 2022-01-20 10:08:07.076 debug3: ssh_msg_send: type 0
1488 2022-01-20 10:08:07.076 debug3: ssh_msg_send: type 0
1488 2022-01-20 10:08:07.076 debug3: preauth child monitor started
1488 2022-01-20 10:08:07.091 debug3: append_hostkey_type: rsa-sha2-512 key not permitted by HostkeyAlgorithms [preauth]
1488 2022-01-20 10:08:07.091 debug3: append_hostkey_type: rsa-sha2-256 key not permitted by HostkeyAlgorithms [preauth]
1488 2022-01-20 10:08:07.091 debug3: append_hostkey_type: ssh-rsa key not permitted by HostkeyAlgorithms [preauth]
1488 2022-01-20 10:08:07.091 debug1: list_hostkey_types: ecdsa-sha2-nistp256,ssh-ed25519 [preauth]
1488 2022-01-20 10:08:07.091 debug3: send packet: type 20 [preauth]
1488 2022-01-20 10:08:07.091 debug1: SSH2_MSG_KEXINIT sent [preauth]
1488 2022-01-20 10:08:07.091 debug3: receive packet: type 20 [preauth]
1488 2022-01-20 10:08:07.091 debug1: SSH2_MSG_KEXINIT received [preauth]
1488 2022-01-20 10:08:07.091 debug2: local server KEXINIT proposal [preauth]
1488 2022-01-20 10:08:07.091 debug2: KEX algorithms: curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256 [preauth]
1488 2022-01-20 10:08:07.091 debug2: host key algorithms: ecdsa-sha2-nistp256,ssh-ed25519 [preauth]
1488 2022-01-20 10:08:07.091 debug2: ciphers ctos: chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com [preauth]
1488 2022-01-20 10:08:07.091 debug2: ciphers stoc: chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com [preauth]
1488 2022-01-20 10:08:07.091 debug2: MACs ctos: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512 [preauth]
1488 2022-01-20 10:08:07.091 debug2: MACs stoc: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512 [preauth]
1488 2022-01-20 10:08:07.091 debug2: compression ctos: none,zlib@openssh.com [preauth]
1488 2022-01-20 10:08:07.091 debug2: compression stoc: none,zlib@openssh.com [preauth]
1488 2022-01-20 10:08:07.091 debug2: languages ctos:  [preauth]
1488 2022-01-20 10:08:07.091 debug2: languages stoc:  [preauth]
1488 2022-01-20 10:08:07.091 debug2: first_kex_follows 0  [preauth]
1488 2022-01-20 10:08:07.091 debug2: reserved 0  [preauth]
1488 2022-01-20 10:08:07.091 debug2: peer client KEXINIT proposal [preauth]
1488 2022-01-20 10:08:07.091 debug2: KEX algorithms: curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,ext-info-c [preauth]
1488 2022-01-20 10:08:07.091 debug2: host key algorithms: ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256@openssh.com,ssh-ed25519,sk-ssh-ed25519@openssh.com,rsa-sha2-512,rsa-sha2-256,ssh-rsa [preauth]
1488 2022-01-20 10:08:07.091 debug2: ciphers ctos: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com [preauth]
1488 2022-01-20 10:08:07.091 debug2: ciphers stoc: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com [preauth]
1488 2022-01-20 10:08:07.091 debug2: MACs ctos: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1 [preauth]
1488 2022-01-20 10:08:07.091 debug2: MACs stoc: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1 [preauth]
1488 2022-01-20 10:08:07.091 debug2: compression ctos: none,zlib@openssh.com,zlib [preauth]
1488 2022-01-20 10:08:07.091 debug2: compression stoc: none,zlib@openssh.com,zlib [preauth]
1488 2022-01-20 10:08:07.091 debug2: languages ctos:  [preauth]
1488 2022-01-20 10:08:07.091 debug2: languages stoc:  [preauth]
1488 2022-01-20 10:08:07.091 debug2: first_kex_follows 0  [preauth]
1488 2022-01-20 10:08:07.091 debug2: reserved 0  [preauth]
1488 2022-01-20 10:08:07.091 debug1: kex: algorithm: curve25519-sha256 [preauth]
1488 2022-01-20 10:08:07.091 debug1: kex: host key algorithm: ecdsa-sha2-nistp256 [preauth]
1488 2022-01-20 10:08:07.091 debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none [preauth]
1488 2022-01-20 10:08:07.091 debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none [preauth]
1488 2022-01-20 10:08:07.091 debug1: expecting SSH2_MSG_KEX_ECDH_INIT [preauth]
1488 2022-01-20 10:08:07.169 debug3: receive packet: type 30 [preauth]
1488 2022-01-20 10:08:07.169 debug1: SSH2_MSG_KEX_ECDH_INIT received [preauth]
1488 2022-01-20 10:08:07.169 debug3: mm_sshkey_sign: entering [preauth]
1488 2022-01-20 10:08:07.169 debug3: mm_request_send: entering, type 6 [preauth]
1488 2022-01-20 10:08:07.169 debug3: mm_sshkey_sign: waiting for MONITOR_ANS_SIGN [preauth]
1488 2022-01-20 10:08:07.169 debug3: mm_request_receive_expect: entering, type 7 [preauth]
1488 2022-01-20 10:08:07.169 debug3: mm_request_receive: entering [preauth]
1488 2022-01-20 10:08:07.169 debug3: mm_request_receive: entering
1488 2022-01-20 10:08:07.169 debug3: monitor_read: checking request 6
1488 2022-01-20 10:08:07.169 debug3: mm_answer_sign: entering
1488 2022-01-20 10:08:07.169 debug3: mm_answer_sign: KEX signature 000001B027B5F830(100)
1488 2022-01-20 10:08:07.169 debug3: mm_request_send: entering, type 7
1488 2022-01-20 10:08:07.169 debug2: monitor_read: 6 used once, disabling now
1488 2022-01-20 10:08:07.169 debug3: send packet: type 31 [preauth]
1488 2022-01-20 10:08:07.169 debug3: send packet: type 21 [preauth]
1488 2022-01-20 10:08:07.169 debug2: set_newkeys: mode 1 [preauth]
1488 2022-01-20 10:08:07.169 debug1: rekey out after 134217728 blocks [preauth]
1488 2022-01-20 10:08:07.169 debug1: SSH2_MSG_NEWKEYS sent [preauth]
1488 2022-01-20 10:08:07.169 debug1: Sending SSH2_MSG_EXT_INFO [preauth]
1488 2022-01-20 10:08:07.169 debug3: send packet: type 7 [preauth]
1488 2022-01-20 10:08:07.169 debug1: expecting SSH2_MSG_NEWKEYS [preauth]
1488 2022-01-20 10:08:07.232 debug3: receive packet: type 21 [preauth]
1488 2022-01-20 10:08:07.232 debug1: SSH2_MSG_NEWKEYS received [preauth]
1488 2022-01-20 10:08:07.232 debug2: set_newkeys: mode 0 [preauth]
1488 2022-01-20 10:08:07.232 debug1: rekey in after 134217728 blocks [preauth]
1488 2022-01-20 10:08:07.232 debug1: KEX done [preauth]
1488 2022-01-20 10:08:07.279 debug3: receive packet: type 5 [preauth]
1488 2022-01-20 10:08:07.279 debug3: send packet: type 6 [preauth]
1488 2022-01-20 10:08:07.294 debug3: receive packet: type 50 [preauth]
1488 2022-01-20 10:08:07.294 debug1: userauth-request for user username service ssh-connection method none [preauth]
1488 2022-01-20 10:08:07.294 debug1: attempt 0 failures 0 [preauth]
1488 2022-01-20 10:08:07.294 debug3: mm_getpwnamallow: entering [preauth]
1488 2022-01-20 10:08:07.294 debug3: mm_request_send: entering, type 8 [preauth]
1488 2022-01-20 10:08:07.294 debug3: mm_getpwnamallow: waiting for MONITOR_ANS_PWNAM [preauth]
1488 2022-01-20 10:08:07.294 debug3: mm_request_receive_expect: entering, type 9 [preauth]
1488 2022-01-20 10:08:07.294 debug3: mm_request_receive: entering [preauth]
1488 2022-01-20 10:08:07.294 debug3: mm_request_receive: entering
1488 2022-01-20 10:08:07.294 debug3: monitor_read: checking request 8
1488 2022-01-20 10:08:07.294 debug3: mm_answer_pwnamallow: entering
1488 2022-01-20 10:08:07.294 debug2: parse_server_config_depth: config reprocess config len 1500
1488 2022-01-20 10:08:07.294 debug3: checking match for 'Group administrators' user domain\\username host 10.x.x.82 addr 10.x.x.82 laddr 10.x.x.34 lport 22
1488 2022-01-20 10:08:07.294 debug3: lookup_principal_name: Successfully discovered explicit principal name: 'domain\\username'=>'username@domain.local'
1488 2022-01-20 10:08:07.310 debug3: LsaLogonUser Succeeded (Impersonation: 0)
1488 2022-01-20 10:08:07.310 debug1: user domain\\username matched group list administrators at line 109
1488 2022-01-20 10:08:07.310 debug3: match found
1488 2022-01-20 10:08:07.310 debug3: reprocess config:110 setting AuthorizedKeysFile __PROGRAMDATA__/ssh/administrators_authorized_keys
1488 2022-01-20 10:08:07.310 debug3: lookup_principal_name: Successfully discovered explicit principal name: 'domain\\username'=>'username@domain.local'
1488 2022-01-20 10:08:07.310 debug3: LsaLogonUser Succeeded (Impersonation: 0)
1488 2022-01-20 10:08:07.310 debug3: mm_answer_pwnamallow: sending MONITOR_ANS_PWNAM: 1
1488 2022-01-20 10:08:07.310 debug3: mm_request_send: entering, type 9
1488 2022-01-20 10:08:07.310 debug2: monitor_read: 8 used once, disabling now
1488 2022-01-20 10:08:07.310 debug2: input_userauth_request: setting up authctxt for username [preauth]
1488 2022-01-20 10:08:07.310 debug3: mm_inform_authserv: entering [preauth]
1488 2022-01-20 10:08:07.310 debug3: mm_request_send: entering, type 4 [preauth]
1488 2022-01-20 10:08:07.310 debug3: mm_auth2_read_banner: entering [preauth]
1488 2022-01-20 10:08:07.310 debug3: mm_request_send: entering, type 10 [preauth]
1488 2022-01-20 10:08:07.310 debug3: mm_request_receive_expect: entering, type 11 [preauth]
1488 2022-01-20 10:08:07.310 debug3: mm_request_receive: entering [preauth]
1488 2022-01-20 10:08:07.310 debug3: mm_request_receive: entering
1488 2022-01-20 10:08:07.310 debug3: monitor_read: checking request 4
1488 2022-01-20 10:08:07.310 debug3: mm_answer_authserv: service=ssh-connection, style=
1488 2022-01-20 10:08:07.310 debug2: monitor_read: 4 used once, disabling now
1488 2022-01-20 10:08:07.310 debug3: mm_request_receive: entering
1488 2022-01-20 10:08:07.310 debug3: monitor_read: checking request 10
1488 2022-01-20 10:08:07.310 debug3: mm_request_send: entering, type 11
1488 2022-01-20 10:08:07.310 debug2: monitor_read: 10 used once, disabling now
1488 2022-01-20 10:08:07.310 debug3: send packet: type 53 [preauth]
1488 2022-01-20 10:08:07.310 debug1: userauth_send_banner: sent [preauth]
1488 2022-01-20 10:08:07.310 debug2: input_userauth_request: try method none [preauth]
1488 2022-01-20 10:08:07.310 debug3: user_specific_delay: user specific delay 0.000ms [preauth]
1488 2022-01-20 10:08:07.310 debug3: ensure_minimum_time_since: elapsed 15.619ms, delaying 4.771ms (requested 5.098ms) [preauth]
1488 2022-01-20 10:08:07.326 debug3: userauth_finish: failure partial=0 next methods="publickey,keyboard-interactive" [preauth]
1488 2022-01-20 10:08:07.326 debug3: send packet: type 51 [preauth]
1488 2022-01-20 10:08:07.374 debug3: receive packet: type 50 [preauth]
1488 2022-01-20 10:08:07.374 debug1: userauth-request for user username service ssh-connection method publickey [preauth]
1488 2022-01-20 10:08:07.374 debug1: attempt 1 failures 0 [preauth]
1488 2022-01-20 10:08:07.374 debug2: input_userauth_request: try method publickey [preauth

Description

Contributor guide

First steps

Research direction

Assessment