cloudflare / cloudflare/cloudflared
Access SSH with short-lived-cert doesn't work on Windows
- Dominant language
- Go
- Stars
- 15.6k
- Forks
- 1.4k
- PR merge metrics
- No merged PRs in 30d
Description
Hi,
I've been following the [short-lived-cert documentation](https://developers.cloudflare.com/cloudflare-one/identity/users/short-lived-certificates), and I had no trouble setting things up on the server-side and on my Mac and Linux clients. But I haven't been able to get things working on Windows clients.
The issue appears to be with the ssh config generated by the cloudflared daemon. For example, running `cloudflared access ssh-config --hostname mysever.mydomain.com --short-lived-cert` as recommended in the docs generates the following ssh config entries:
```
Host mysever.mydomain.com
ProxyCommand bash -c 'cloudflared access ssh-gen --hostname %h; ssh -tt %r@cfpipe-mysever.mydomain.com >&2 <&1'
Host cfpipe-vm.example.com
HostName mysever.mydomain.com
ProxyCommand cloudflared access ssh --hostname %h
IdentityFile ~/.cloudflared/mysever.mydomain.com-cf_key
CertificateFile ~/.cloudflared/mysever.mydomain.com-cf_key-cert.pub
```
Copying these to the ssh config file and trying to run `ssh user@mysever.mydomain.com` returns this error on Windows (typical error when a command in ProxyCommand does not exist):
```
> ssh user@mysever.mydomain.com
CreateProcessW failed error:2
posix_spawnp: No such file or directory
```
I think I've narrowed this down to 2 issues in the generated `ProxyCommand` entry:
1. The ProxyCommand relys on bash which is not installed on Windows
2. Windows requires a full path to cloudflared.exe which is not present in the generated config.
I've tried a bit to resolve this by editing the ProxyCommand, but I haven't gotten things fully working yet. Here's what I've tried so far:
- Replacing cloudflared and ssh with full paths to the respective .exe files
- Re-writing the `ProxyCommand` to use cmd instead of bash
```
Host mysever.mydomain.com
ProxyCommand /path/to/cloudflared.exe access ssh-gen --hostname %h && /path/to/ssh.exe -tt %r@cfpipe-mysever.mydomain.com >&2 <&1
Host cfpipe-vm.example.com
HostName mysever.mydomain.com
ProxyCommand /path/to/cloudflared.exe access ssh --hostname %h
IdentityFile ~/.cloudflared/mysever.mydomain.com-cf_key
CertificateFile ~/.cloudflared/mysever.mydomain.com-cf_key-cert.pub
```
Running the ssh command with this change **does** open a browser window for Access authentication (and generates the short-lived-certs), but it **doesn't** redirect me to my remote terminal. Instead I get the following error:
```
> ssh user@myserver.mydomain.com
kex_exchange_identification: Connection closed by remote host
```
Additionally, running just the 2nd half of the ProxyCommand manually (`/path/to/ssh.exe -tt user@cfpipe-mysever.mydomain.com`) works as expected and directs me to the remote terminal.
However, the issue with this command alone is that the short-lived-certs aren't generated automatically so I won't be able to log in again after the certs expire.
Any recommendations on how to configure the SSH Config file for use on Windows?
Contributor guide
Assessment
This issue has not been assessed yet.