|
548 | 548 |
|
549 | 549 | <h1>Setting up SSHd</h1> |
550 | 550 |
|
551 | | - <div class="highlight"><pre><span></span><code>#!/bin/sh |
552 | | -# |
553 | | -# msys2-sshd-setup.sh — configure sshd on MSYS2 and run it as a Windows service |
554 | | -# |
555 | | -# Replaces ssh-host-config <https://github.com/openssh/openssh-portable/blob/master/contrib/cygwin/ssh-host-config> |
556 | | -# Adapted from <https://ghc.haskell.org/trac/ghc/wiki/Building/Windows/SSHD> by Sam Hocevar <sam@hocevar.net> |
557 | | -# Adapted from <https://gist.github.com/samhocevar/00eec26d9e9988d080ac> by David Macek |
558 | | -# |
559 | | -# Prerequisites: |
560 | | -# — a 64-bit installation of MSYS2 itself: https://msys2.org |
561 | | -# — some packages: pacman -S openssh cygrunsrv mingw-w64-x86_64-editrights |
562 | | -# |
563 | | -# Gotchas: |
564 | | -# — the log file will be /var/log/msys2_sshd.log |
565 | | -# — if you get error “sshd: fatal: seteuid XXX : No such device or address” |
566 | | -# in the logs, try “passwd -R” (with admin privileges) |
567 | | -# — if you get error “chown(/dev/pty1, XXX, YYY) failed: Invalid argument” |
568 | | -# in the logs, make sure your account and group names are detectable (see |
569 | | -# `id`); issues are often caused by having /etc/{passwd,group} or having |
570 | | -# a modified /etc/nsswitch.conf |
571 | | -# |
572 | | -# Changelog: |
573 | | -# 16 Apr 2020 — remove additional privileged user |
574 | | -# — only touch /etc/{passwd,group} if they exist |
575 | | -# 27 Jun 2019 — rename service to msys2_sshd to avoid conflicts with Windows OpenSSH |
576 | | -# — use mkgroup.exe as suggested in the comments |
577 | | -# — fix a problem with CRLF and grep |
578 | | -# 24 Aug 2015 — run server with -e to redirect logs to /var/log/sshd.log |
579 | | -# |
580 | | - |
581 | | -set -e |
582 | | - |
583 | | -# |
584 | | -# Configuration |
585 | | -# |
586 | | - |
587 | | -PRIV_USER=SYSTEM |
588 | | -UNPRIV_USER=sshd # DO NOT CHANGE; this username is hardcoded in the openssh code |
589 | | -UNPRIV_NAME="Privilege separation user for sshd" |
590 | | - |
591 | | -EMPTY_DIR=/var/empty |
592 | | - |
593 | | - |
594 | | -# |
595 | | -# Check installation sanity |
596 | | -# |
597 | | - |
598 | | -if ! /mingw64/bin/editrights -h >/dev/null; then |
599 | | - echo "ERROR: Missing 'editrights'. Try: pacman -S mingw-w64-x86_64-editrights." |
600 | | - exit 1 |
601 | | -fi |
602 | | - |
603 | | -if ! cygrunsrv -v >/dev/null; then |
604 | | - echo "ERROR: Missing 'cygrunsrv'. Try: pacman -S cygrunsrv." |
605 | | - exit 1 |
606 | | -fi |
607 | | - |
608 | | -if ! ssh-keygen -A; then |
609 | | - echo "ERROR: Missing 'ssh-keygen'. Try: pacman -S openssh." |
610 | | - exit 1 |
611 | | -fi |
612 | | - |
613 | | - |
614 | | -# |
615 | | -# The unprivileged sshd user (for privilege separation) |
616 | | -# |
617 | | - |
618 | | -add="$(if ! net user "${UNPRIV_USER}" >/dev/null; then echo "//add"; fi)" |
619 | | -if ! net user "${UNPRIV_USER}" ${add} //fullname:"${UNPRIV_NAME}" \ |
620 | | - //homedir:"$(cygpath -w ${EMPTY_DIR})" //active:no; then |
621 | | - echo "ERROR: Unable to create Windows user ${PRIV_USER}" |
622 | | - exit 1 |
623 | | -fi |
624 | | - |
625 | | - |
626 | | -# |
627 | | -# Add or update /etc/passwd entries |
628 | | -# |
629 | | - |
630 | | -if test -f /etc/passwd; then |
631 | | - sed -i -e '/^'"${UNPRIV_USER}"':/d' /etc/passwd |
632 | | - SED='/^'"${UNPRIV_USER}"':/s?^\(\([^:]*:\)\{5\}\).*?\1'"${EMPTY_DIR}"':/bin/false?p' |
633 | | - mkpasswd -l -u "${UNPRIV_USER}" | sed -e 's/^[^:]*+//' | sed -ne "${SED}" \ |
| 551 | + <div class="highlight"><pre><span></span><code><span class="ch">#!/bin/sh</span> |
| 552 | +<span class="c1">#</span> |
| 553 | +<span class="c1"># msys2-sshd-setup.sh — configure sshd on MSYS2 and run it as a Windows service</span> |
| 554 | +<span class="c1">#</span> |
| 555 | +<span class="c1"># Replaces ssh-host-config <https://github.com/openssh/openssh-portable/blob/master/contrib/cygwin/ssh-host-config></span> |
| 556 | +<span class="c1"># Adapted from <https://ghc.haskell.org/trac/ghc/wiki/Building/Windows/SSHD> by Sam Hocevar <sam@hocevar.net></span> |
| 557 | +<span class="c1"># Adapted from <https://gist.github.com/samhocevar/00eec26d9e9988d080ac> by David Macek</span> |
| 558 | +<span class="c1">#</span> |
| 559 | +<span class="c1"># Prerequisites:</span> |
| 560 | +<span class="c1"># — a 64-bit installation of MSYS2 itself: https://msys2.org</span> |
| 561 | +<span class="c1"># — some packages: pacman -S openssh cygrunsrv mingw-w64-x86_64-editrights</span> |
| 562 | +<span class="c1">#</span> |
| 563 | +<span class="c1"># Gotchas:</span> |
| 564 | +<span class="c1"># — the log file will be /var/log/msys2_sshd.log</span> |
| 565 | +<span class="c1"># — if you get error “sshd: fatal: seteuid XXX : No such device or address”</span> |
| 566 | +<span class="c1"># in the logs, try “passwd -R” (with admin privileges)</span> |
| 567 | +<span class="c1"># — if you get error “chown(/dev/pty1, XXX, YYY) failed: Invalid argument”</span> |
| 568 | +<span class="c1"># in the logs, make sure your account and group names are detectable (see</span> |
| 569 | +<span class="c1"># `id`); issues are often caused by having /etc/{passwd,group} or having</span> |
| 570 | +<span class="c1"># a modified /etc/nsswitch.conf</span> |
| 571 | +<span class="c1">#</span> |
| 572 | +<span class="c1"># Changelog:</span> |
| 573 | +<span class="c1"># 16 Apr 2020 — remove additional privileged user</span> |
| 574 | +<span class="c1"># — only touch /etc/{passwd,group} if they exist</span> |
| 575 | +<span class="c1"># 27 Jun 2019 — rename service to msys2_sshd to avoid conflicts with Windows OpenSSH</span> |
| 576 | +<span class="c1"># — use mkgroup.exe as suggested in the comments</span> |
| 577 | +<span class="c1"># — fix a problem with CRLF and grep</span> |
| 578 | +<span class="c1"># 24 Aug 2015 — run server with -e to redirect logs to /var/log/sshd.log</span> |
| 579 | +<span class="c1">#</span> |
| 580 | + |
| 581 | +<span class="nb">set</span> -e |
| 582 | + |
| 583 | +<span class="c1">#</span> |
| 584 | +<span class="c1"># Configuration</span> |
| 585 | +<span class="c1">#</span> |
| 586 | + |
| 587 | +<span class="nv">PRIV_USER</span><span class="o">=</span>SYSTEM |
| 588 | +<span class="nv">UNPRIV_USER</span><span class="o">=</span>sshd <span class="c1"># DO NOT CHANGE; this username is hardcoded in the openssh code</span> |
| 589 | +<span class="nv">UNPRIV_NAME</span><span class="o">=</span><span class="s2">"Privilege separation user for sshd"</span> |
| 590 | + |
| 591 | +<span class="nv">EMPTY_DIR</span><span class="o">=</span>/var/empty |
| 592 | + |
| 593 | + |
| 594 | +<span class="c1">#</span> |
| 595 | +<span class="c1"># Check installation sanity</span> |
| 596 | +<span class="c1">#</span> |
| 597 | + |
| 598 | +<span class="k">if</span> ! /mingw64/bin/editrights -h >/dev/null<span class="p">;</span> <span class="k">then</span> |
| 599 | + <span class="nb">echo</span> <span class="s2">"ERROR: Missing 'editrights'. Try: pacman -S mingw-w64-x86_64-editrights."</span> |
| 600 | + <span class="nb">exit</span> <span class="m">1</span> |
| 601 | +<span class="k">fi</span> |
| 602 | + |
| 603 | +<span class="k">if</span> ! cygrunsrv -v >/dev/null<span class="p">;</span> <span class="k">then</span> |
| 604 | + <span class="nb">echo</span> <span class="s2">"ERROR: Missing 'cygrunsrv'. Try: pacman -S cygrunsrv."</span> |
| 605 | + <span class="nb">exit</span> <span class="m">1</span> |
| 606 | +<span class="k">fi</span> |
| 607 | + |
| 608 | +<span class="k">if</span> ! ssh-keygen -A<span class="p">;</span> <span class="k">then</span> |
| 609 | + <span class="nb">echo</span> <span class="s2">"ERROR: Missing 'ssh-keygen'. Try: pacman -S openssh."</span> |
| 610 | + <span class="nb">exit</span> <span class="m">1</span> |
| 611 | +<span class="k">fi</span> |
| 612 | + |
| 613 | + |
| 614 | +<span class="c1">#</span> |
| 615 | +<span class="c1"># The unprivileged sshd user (for privilege separation)</span> |
| 616 | +<span class="c1">#</span> |
| 617 | + |
| 618 | +<span class="nv">add</span><span class="o">=</span><span class="s2">"</span><span class="k">$(if</span> ! net user <span class="s2">"</span><span class="si">${</span><span class="nv">UNPRIV_USER</span><span class="si">}</span><span class="s2">"</span> >/dev/null<span class="p">;</span> <span class="k">then</span> <span class="nb">echo</span> <span class="s2">"//add"</span><span class="p">;</span> <span class="k">fi)</span><span class="s2">"</span> |
| 619 | +<span class="k">if</span> ! net user <span class="s2">"</span><span class="si">${</span><span class="nv">UNPRIV_USER</span><span class="si">}</span><span class="s2">"</span> <span class="si">${</span><span class="nv">add</span><span class="si">}</span> //fullname:<span class="s2">"</span><span class="si">${</span><span class="nv">UNPRIV_NAME</span><span class="si">}</span><span class="s2">"</span> <span class="se">\</span> |
| 620 | + //homedir:<span class="s2">"</span><span class="k">$(</span>cygpath -w <span class="si">${</span><span class="nv">EMPTY_DIR</span><span class="si">}</span><span class="k">)</span><span class="s2">"</span> //active:no<span class="p">;</span> <span class="k">then</span> |
| 621 | + <span class="nb">echo</span> <span class="s2">"ERROR: Unable to create Windows user </span><span class="si">${</span><span class="nv">PRIV_USER</span><span class="si">}</span><span class="s2">"</span> |
| 622 | + <span class="nb">exit</span> <span class="m">1</span> |
| 623 | +<span class="k">fi</span> |
| 624 | + |
| 625 | + |
| 626 | +<span class="c1">#</span> |
| 627 | +<span class="c1"># Add or update /etc/passwd entries</span> |
| 628 | +<span class="c1">#</span> |
| 629 | + |
| 630 | +<span class="k">if</span> <span class="nb">test</span> -f /etc/passwd<span class="p">;</span> <span class="k">then</span> |
| 631 | + sed -i -e <span class="s1">'/^'</span><span class="s2">"</span><span class="si">${</span><span class="nv">UNPRIV_USER</span><span class="si">}</span><span class="s2">"</span><span class="s1">':/d'</span> /etc/passwd |
| 632 | + <span class="nv">SED</span><span class="o">=</span><span class="s1">'/^'</span><span class="s2">"</span><span class="si">${</span><span class="nv">UNPRIV_USER</span><span class="si">}</span><span class="s2">"</span><span class="s1">':/s?^\(\([^:]*:\)\{5\}\).*?\1'</span><span class="s2">"</span><span class="si">${</span><span class="nv">EMPTY_DIR</span><span class="si">}</span><span class="s2">"</span><span class="s1">':/bin/false?p'</span> |
| 633 | + mkpasswd -l -u <span class="s2">"</span><span class="si">${</span><span class="nv">UNPRIV_USER</span><span class="si">}</span><span class="s2">"</span> <span class="p">|</span> sed -e <span class="s1">'s/^[^:]*+//'</span> <span class="p">|</span> sed -ne <span class="s2">"</span><span class="si">${</span><span class="nv">SED</span><span class="si">}</span><span class="s2">"</span> <span class="se">\</span> |
634 | 634 | >> /etc/passwd |
635 | 635 | mkgroup.exe -l > /etc/group |
636 | | -fi |
| 636 | +<span class="k">fi</span> |
637 | 637 |
|
638 | 638 |
|
639 | | -# |
640 | | -# Finally, register service with cygrunsrv and start it |
641 | | -# |
| 639 | +<span class="c1">#</span> |
| 640 | +<span class="c1"># Finally, register service with cygrunsrv and start it</span> |
| 641 | +<span class="c1">#</span> |
642 | 642 |
|
643 | | -cygrunsrv -R msys2_sshd || true |
644 | | -cygrunsrv -I msys2_sshd -d "MSYS2 sshd" -p \ |
645 | | - /usr/bin/sshd.exe -a "-D -e" -y tcpip -u "${PRIV_USER}" -w "${tmp_pass}" |
| 643 | +cygrunsrv -R msys2_sshd <span class="o">||</span> <span class="nb">true</span> |
| 644 | +cygrunsrv -I msys2_sshd -d <span class="s2">"MSYS2 sshd"</span> -p <span class="se">\</span> |
| 645 | + /usr/bin/sshd.exe -a <span class="s2">"-D -e"</span> -y tcpip -u <span class="s2">"</span><span class="si">${</span><span class="nv">PRIV_USER</span><span class="si">}</span><span class="s2">"</span> -w <span class="s2">"</span><span class="si">${</span><span class="nv">tmp_pass</span><span class="si">}</span><span class="s2">"</span> |
646 | 646 |
|
647 | | -# The SSH service should start automatically when Windows is rebooted. You can |
648 | | -# manually restart the service by running `net stop msys2_sshd` + `net start msys2_sshd` |
649 | | -if ! net start msys2_sshd; then |
650 | | - echo "ERROR: Unable to start msys2_sshd service" |
651 | | - exit 1 |
652 | | -fi |
| 647 | +<span class="c1"># The SSH service should start automatically when Windows is rebooted. You can</span> |
| 648 | +<span class="c1"># manually restart the service by running `net stop msys2_sshd` + `net start msys2_sshd`</span> |
| 649 | +<span class="k">if</span> ! net start msys2_sshd<span class="p">;</span> <span class="k">then</span> |
| 650 | + <span class="nb">echo</span> <span class="s2">"ERROR: Unable to start msys2_sshd service"</span> |
| 651 | + <span class="nb">exit</span> <span class="m">1</span> |
| 652 | +<span class="k">fi</span> |
653 | 653 | </code></pre></div> |
654 | 654 |
|
655 | 655 |
|
|
0 commit comments