PowerShell / PowerShell/Win32-OpenSSH

stored credentionals (e.g. cmdkey) with password authentication doesn't work

Open
#2,273 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Waiting on Author
Dominant language
No language data
Stars
8.3k
Forks
819
PR merge metrics
No merged PRs in 30d

Description

Prerequisites
  • Write a descriptive title.
  • Make sure you are able to repro it on the latest version
  • Search the existing issues.
Steps to reproduce

This issue is very similar to #1950, #452, #996, except that password authentication also does not seem to work (any more?). I understand the limitations of accessing the Windows credential manager when using public/private key authentication with OpenSSH. However, there are numerous comments that suggest password authentication should still work, since the password is available to decrypt the DPAPI store.

But, the problem is that cmdkey and other tools still seem to be unable to use stored credentials when using password authentication. In my case, I am trying to use SMB shares that were set up by Vagrant inside of a Windows guest, which is also running sshd. Vagrant uses cmdkey to store credentials for the SMB shares, and this works fine when logging in interactively into the guest, but does not work when logging in over ssh, even when using password authentication.

sshd_config, inside the Vagrant virtual machine:

Port 22
Subsystem	sftp	sftp-server.exe

ssh_config:

Host default
  HostName 172.21.202.90
  User vagrant
  Port 22
  UserKnownHostsFile /dev/null
  StrictHostKeyChecking no

Trying to use cmdkey, note that I used password authentication and I still can't access the credential store:

C:\Users\JohnstonJ\Documents\Projects>ssh default "cmdkey /add:blah /user:blah /pass:blah"
Warning: Permanently added '172.21.202.90' (ECDSA) to the list of known hosts.
vagrant@172.21.202.90's password: <type "vagrant" for password>

CMDKEY: Credentials cannot be saved from this logon session.
Expected behavior
I should be able to access DPAPI / Credential Manager over SSH when using password authentication.
Actual behavior
I cannot use commands based on Credential Manager, such as CMDKEY, when using password authentication.
Error details
See steps to reproduce, above.
Environment data
From the sshd server:


PS C:\Users\vagrant> $PSVersionTable

Name                           Value
----                           -----
PSVersion                      7.4.5
PSEdition                      Core
GitCommitId                    7.4.5
OS                             Microsoft Windows 10.0.22631
Platform                       Win32NT
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1
WSManStackVersion              3.0


### Version

OpenSSH_for_Windows_9.5p1, LibreSSL 3.8.2 (downloaded from "releases" of this GitHub project)

### Visuals

_No response_

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the behavior using the shown sshd_config, ssh_config, password authentication, and cmdkey command in the Windows 10 environment described. Read the related issues #1950, #452, and #996 first, then trace how the SSH logon session interacts with DPAPI and Credential Manager. Done means stored credentials can be accessed over SSH without the reported cmdkey error.

Written by the indexing model from the issue text.

Assessment

Tech stack
powershell
Domain
authentication, operating-systems, security
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.