PowerShell / PowerShell/Win32-OpenSSH
Cannot connect as "NT authority\system" account
Nobody has claimed this yet.
- Dominant language
- No language data
- Stars
- 8.3k
- Forks
- 819
- PR merge metrics
- No merged PRs in 30d
Description
Prerequisites
- Write a descriptive title.
- Make sure you are able to repro it on the latest version
- Search the existing issues.
Steps to reproduce
I am using OpenSSH 8.6.0p1 on Windows 11 (client) and on Windows Server Essentials 2019 (server)
I can connect from client to server with any account except "NT authority\server"
Normal user accounts do work perfectly.
Open a powershell terminal as System account :
Start-Process -FilePath cmd.exe -Verb Runas -ArgumentList '/k C:\Local\Sysinternals\PsExec.exe -i -s powershell.exe'
(using psexec from SysInternals)
then try to connect to the server:
sftp 192.168.0.36
Expected behavior
The connection should be working. Or it should state that it is not possible to connect as SYSTEM.
Actual behavior
The connection is closed :
PS C:\WINDOWS\system32\config\systemprofile> sftp 192.168.0.36
Connection reset by 192.168.0.36 port 22
Connection closed
### Error details
```console
The log file for sshd reports:
8392 2023-04-11 00:06:19.468 debug3: checking match for 'Group Administrateurs' user système host 192.168.0.35 addr 192.168.0.35 laddr 192.168.0.36 lport 22
8392 2023-04-11 00:06:19.469 debug1: generate_s4u_user_token: LsaLogonUser() failed. User 'syst�me' Status: 0xC000006D SubStatus 0.
8392 2023-04-11 00:06:19.469 debug3: get_user_token - unable to generate token for user syst�me
8392 2023-04-11 00:06:24.216 debug1: generate_s4u_user_token: LsaLogonUser() failed. User 'syst�me' Status: 0xC000006D SubStatus 0.
8392 2023-04-11 00:06:24.216 error: get_user_token - unable to generate token on 2nd attempt for user syst�me
8392 2023-04-11 00:06:24.216 fatal: ga_init, unable to resolve user système
8392 2023-04-11 00:06:24.216 debug1: do_cleanup
8392 2023-04-11 00:06:24.216 debug1: Killing privsep child 1560
Environment data
Name Value
---- -----
PSVersion 5.1.22621.1037
PSEdition Desktop
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0...}
BuildVersion 10.0.22621.1037
CLRVersion 4.0.30319.42000
WSManStackVersion 3.0
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1
Version
8.6.0p1
Visuals
No response
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the Windows 11 to Windows Server 2019 connection as the SYSTEM account using the provided PsExec and sftp commands. Start with the sshd log entries for generate_s4u_user_token, get_user_token, and ga_init, then determine whether SYSTEM authentication should work or should fail with a clear error. Done means the behavior is corrected or the unsupported case is reported explicitly.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- authentication, operating-systems
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100