Public key authentication using Cygwin
Overview
Enabling public key authentication allows us to seamlessly, without having to interactively enter credentials, perform the following tasks...
- scp files from one host to another
- Execute commands on remote host
- Log on to remote host
The Cygwin sshd server runs as a Windows service under the Local SYSTEM account created with special privileges to run the service. For a Windows 2003 Server, sshd runs under local account, sshd_server. The sshd server authenticates user logins using a public/private key-pair.
Configure Cygwin sshd
In this example, we configure password-less public key authentication to a remote
Worklight host. We will leverage a user named "WorklightAdmin"
- Install Cygwin.During installation, select the following packages...
- Admin --> cygrunsrv
- Net --> openssh
- After installation, edit...
...add the following line...
For example...
@echo off
C:
chdir C:\cygwin\bin
set CYGWIN=binmode ntsec
bash --login -i
- Start a Cygwin terminal using "Run as Administrator"
- Verify Cygwin is installed property...
All Cygwin help options should display on the screen.
- From a bash shell, configure SSH...
You are prompted to answer the following questions:
*** Query: Should privilege separation be used? : yes
*** Query: New local account 'sshd'? : yes
*** Query: Do you want to install sshd as a service?
*** Query: : yes
*** Query: Enter the value of CYGWIN for the deamon: [] binmode ntsec
*** Query: Do you want to use a different name? (yes/no) yes/no
At this point, for our example, we enter yes, and then plug in our WorklightAdmin user name and password...
*** Query: Enter the new user name: WorklightAdmin
*** Query: Reenter: WorklightAdmin
*** Query: Create new privileged user account 'WorklightAdmin'? (yes/no) yes
*** Query: Please enter the password:
*** Query: Reenter:
If the configuration is successful, you will see the following message:
Host configuration finished. Have fun!
- If you ever want to change the login ID of the Cygwin sshd service afterwards...
- Open the Services panel
Windows Start | Administrative Tools | Services
- Stop the sshd service.
Cygwin sshd (right-click) | Properties | General | Stop
- Next, select the Log on tab. Under the Log on as section or prompt, clear the Local System account radio button, and select This account.
- Type .\WorklightAdmin as the ID and type the password for the account. Click Apply.
- Grant additional rights to the WorklightAdmin account. Ensure that the account has the required privileges in addition to membership to the Administrators group.
- From the Windows Start menu, click...
Settings | Control Panel | Administrative Tools | Local Security Policy | Local Policies | User Rights Assignment
- Verify the WorklightAdmin account has the following four rights:
- Adjust memory quotas for a process
- Create a token object
- Log on as a service
- Replace a process level token
If not, add WorklightAdmin as a user with the four rights.
- Close the Local Security Settings window.
- From a Cygwin console panel, change ownership of the following directories and files to WorklightAdmin:
- chown WorklightAdmin /var/log/sshd.log
- chown -R WorklightAdmin /var/empty
- chown WorklightAdmin /etc/ssh*
- Restart the Cygwin sshd service.
Cygwin sshd service | Properties | General | Start
...or...
- To achieve a password-less login from HostA --> remoteWLhost
- Login to HostA as user WorklightAdmin
- Copy contents of...
If .ssh/id_rsa.pub does not exist, run..
$ ssh-keygen -t rsa
Generating public/private rsa key pair.
Enter file in which to save the key (/usr/local/wasuser/.ssh/id_rsa):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /usr/local/wasuser/.ssh/id_rsa
Your public key has been saved in /usr/local/wasuser/.ssh/id_rsa.pub
The key fingerprint is:
05:db:12:51:9f:48:dc:43:cd:8f:22:b0:a7:47:2d:17 wasuser@hostname
Leave passphrase blank.
- Log on to remote host (remoteWLhost) and paste the public key to...
$HOME/.ssh/authorized_keys
If the directory and/or file do not exist, create them.
- Set permissions...
chmod go-w $HOME $HOME/.ssh
chmod 600 $HOME/.ssh/authorized_keys
chown `whoami` $HOME/.ssh/authorized_keys
- You can now run commands such on HostA such as...
$ ssh -l WorklightAdmin remoteWLhost 'ls /cygdrive/c/path/to/Worklight/logs'
console.log
ffdc
messages.log
messages_13.02.28_13.37.37.0.log
status.log
$ ssh -l WorklightAdmin remoteWLhost 'tail /cygdrive/c/path/to/Worklight/logs/messages.log'
[2/28/13 13:38:16:747 EST] jdbc.internal.DataSourceService A J2CA8001I
[2/28/13 13:38:16:747 EST] jdbc.internal.DataSourceService A J2CA8001I
[2/28/13 13:38:16:762 EST] jdbc.internal.DataSourceService A J2CA8001I
[2/28/13 13:38:16:762 EST] jdbc.internal.JDBCDriverService A J2CA8001I
[2/28/13 13:38:16:778 EST] tcpchannel.internal.TCPChannel I CWWKO0220I
$ ssh WorklightAdmin@remoteWLhost
Last login: Fri Mar 15 17:40:10 2013 from pavftrptwrb.sonebiz.com
WorklightAdmin@remoteWLhost ~
$
scp WorklightAdmin@remoteWLhost:/cygdrive/c/path/to/Worklight/logs/messages.log messages.log.txt
Non-admin userID
If you try to connect to the Windows workstation using a non-administrator user ID, you might get error...
XCIM0010E: An error occurred while connecting to the remote target ip_address.
Cause: CTGRI0011E An error occurred when accessing the remote registry or service control manager.
...add the user account to the Administrators group...
- Go to...
My Computer (right-click) | Manage | Local Users and Groups Users | user account | Member Of
- Add the Administrators group to the list of groups that this account belongs to.
- From the admin console, click...
Change public location in sshd_Config
# The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2
# but this is overridden so installations will only check .ssh/authorized_keys
AuthorizedKeysFile /home/.ssh/authorized_keys