PowerShell/Win32-OpenSSH#1211PowerShell/Win32-OpenSSH#1082
Added support for posix_spawnp that executes the command directly instead of appending path. (SH_ASKPASS and proxy command use this). Refactored posix spawn commandline building logic to automatically account for Windows CRT escaping rules on all arguments.
- Removed #ifdef WINDOWS blocks in base code where the feature support can be conveyed by a failed POSIX API call
- Refactored password authentication code
- Other misc changes - Removed DebugBreak on Release Builds
- Updated code to dynamic load Lsa functions until RS5 SDK includes them
- Add conpty support in openssh
- Fixed Wierd characters (?25l) are seen, when logged in from ssh client
- Backspace doesn't work in powershell window
- Changes to support ssh-shellhost as an alternative shell
- Added support to have ssh-shellhost work as a standby shell (ssh-shellhost -c "cmdline") simply executes cmdline via CreateProcess
- Added E2E test cases and fixed unittests broken from prior changes
- Added PTY launch interface that supports both conpty and ssh-shellhost pty.
- Implemented PTY control channel in ssh-shellhost that supports Window resize events.
- Fixed regression with starting a PTY session with an explicit command
- modified ssh-shellhost pty argument to ---pty to remove ambiguity in cases when both -p and -c are present in commandline. Ex. ssh-shellhost.exe -c "myprogram -p -c argument"
- Logic to support conpty (currently disabled until validation is complete)
- fdopen() and fchmod() support for file handles
- support for auto updating known_hosts via ssh and ssh-keygen
- Support for dynamic Windows-size changes with PTY
- Changes to support OneCore SDK
- Test cases
Modified user principal name lookup to default to the implicit form (SamAccountName@DnsDomainName) if no explicit user principal name attribute is found on the account.
https://github.com/PowerShell/Win32-OpenSSH/issues/1213
Current group membership resolution though very effective, is very slow. In a typical domain joined enterprise machine, adding a simple entry like the following in sshd_config
AllowGroups administrators
will incur a long delay in remote session establishment as sshd tried to pull all groups associated with the domain user.
Changes in this PR optimize the general case scenarios where no wild cards are in use. Specifically rules like this are processed promptly:
AllowGroups group1, group2, group3 //with no wild cards
Match Group group1 //single group with no negation and wild cards
Optimization is done by resolve the groupname in rule immediately to SID and checking its membership against user token. Enumerating the entire group membership is done on a lazy on-demand basis.
Beyond the optimization, there are 2 functional changes
- removed domain prefix for builtin groups
- removed domain prefix'ed versions of local groups since we are strictly following the convention that local principals shouldn't have any domain qualification.
Added utility to build session process command line - this accounts for restrictions from various shells. With these changes, scp and sftp-server are expected to be machine wide PATH if a custom shell (other than cmd.exe) is defined. Added comprehensive test cases.
Fixed issue with USERNAME env variable containing domain prefix too.
PowerShell/Win32-OpenSSH#1165PowerShell/Win32-OpenSSH#1165PowerShell/Win32-OpenSSH#1171
Added support to run sshd as non-system. In this mode, sshd can authenticate only the user that sshd is running as, and only via public key authentication.
PowerShell/Win32-OpenSSH#1153
Changes include:
- Removing sid from pwd structure to comply with Unix structure
- Integrating default shell logic within pwd
- pwd placeholder to allow logins using usernames not associated with Windows account (possible via custom LSA authentication)
- Moving all nonPTY logic from shellhost to session.c.
- ssh-shellhost is now exclusively for implementing PTY
- Spawning all session processes from within a shell
- Validation checks in safely_chroot
- Added chroot implementation that simply stores the path in internal state and sets an environment variable
- Spawned processes pickup chroot from environment variable
- Core change in realpath and resolved_path_utf16 now take into account chroot path.
- Unit tests
- Other miscellaneous changes to account for chroot enabled logic in core code
PowerShell/Win32-OpenSSH#190PowerShell/Win32-OpenSSH#292
Modified getusergroups() to use s4u tokens to discover nested groups and return them in NetBiosName\GroupName format.
Modified get_passwd() to internally normalize names to NetBiosName\SamAccountName format and changed functions that use it to translate to UPN where necessary.
Removed unnecessary support functions used by previous version of getusergroups().
Various refactoring and function consolidation / simplification.
Addressed several buffer over-read issues.
PowerShell/Win32-OpenSSH#553
- Reworked resolved_path() into resolved_path_utf16() that combined utf16 conversion and path conditioning into a single function. This eliminated the previously non-threadsafe resolved_path() function.
- Adjusted functions to use resolved_path_utf16().
- Collapsed copy_file() function that was only used once.
- Corrected compilation errors when debug4() and debug5() are enabled.
- Added implementation of symlink() using native CreateSymbolicLink() function.
- Added unit tests for symlink behavior in readlink(), lstat, stat(), and symlink().
- Reworked readlink() to be more inline with POSIX readlink() behavior.
- Reworked symlink handling in stat/lstat due to revised readlink().
- Added additional error handling to readlink().
- Added symlink() Implementation - Memory Leak Fix
- Modified fileio_readlink() to properly free a temporary buffer it creates.
OpenSSh privilege separation model - http://www.citi.umich.edu/u/provos/ssh/privsep.html
Posix_spawn is implemented in POSIX adapter as an alternative to fork() that is heavily used in Privilege separation.
Additional state info is added to sshd to accommodate distinguishing the various modes (privileged monitor, unprivileged child, authenticated child).
Required service state (like config and host keys) is transmitted over pipes from monitor to child processes.
Changes to installation scripts and tests to accomodate new architectural changes
Support the unicode characters as input to the ssh client.
PowerShell/Win32-OpenSSH#711
Remove the bAnsi related code changes to the ssh-shellhost.c as that code never executes..
Fixed "long pressing key issue for the slow ssh connections"
PowerShell/Win32-OpenSSH#701
fixed warning message in the latestw_all recent commits.
Fixed the issue with ssh failures in the latestw_all recent commits.
docker ssh issue
PowerShell/Win32-OpenSSH#666
a) fdopen changes to accept the /dev/null device
b) fix the select (using same fdset as readfdset, exceptfdset) issue with the unix opensssh code.
changed keyscan pester test to refer to localhost (127.0.0.1) instead of GitHub.com
PowerShell/Win32-OpenSSH#731
Fix the ASSERT_HANDLE issue..
ASSERT_HANDLE should fail if handle is either NULL or INVALID_HANDLE.
Added new testcases for the null device.
#576 - fix the EVENT_CONSOLE_CARET issue.. Wrongly read the X, Y coordinates
#575 - when backspace key is pressed then screen is not refreshed correctly
#574 - when delete key is pressed then screen is not refreshed correctly (the last character is repeated in the end)
#573 - while using up/down arrows, screen is not refreshed correctly (there are some left over characters of bigger command)
#572 - clear screen is not clearing the whole console
#571 - Move the cursor to top of visible window so that nothing will be erased on the console.
#570 - code cleanup for console related logic
#569 - wrong implementation of TIOCGWINSZ. This is causing lot of issues when windows open ssh client is connecting to linux ssh server.
#568 - Scrolling issue when the cursor is at the last line of the visible window.
#567 - Logic to pass the raw buffer to console is wrong.
https://github.com/PowerShell/Win32-OpenSSH/issues/479https://github.com/PowerShell/Win32-OpenSSH/issues/476https://github.com/PowerShell/Win32-OpenSSH/issues/474https://github.com/PowerShell/Win32-OpenSSH/issues/467
bug #479 - "ls c:" is not working
sanitized_path() is modified to handle the edge case "\x:"
2.bug #476 - "cd c:" is not working
If "c:" is passed to _fullpath() then it is returning existing path but not "c:", so if we append "\" to "c:" then it is working fine.
3.bug #474 - code cleanup MAX_PATH
Using PATH_MAX variable instead of MAX_PATH
In dirent.h, used PATH_MAX instead of hardcoding 256 characters
In readdir(), changed the pdirentry to be a static variable. Before this, we are leaking the memory.
4.bug #467 - SFTP rename failed if the newpath already exists.
The _wrename throws error if the newpath exists.
To make it consistent with the linux behavrior,
a) if the newpath is a file and if it exists then delete it so that _wrename will succeed.
b) if the newpath is a directory and if it is empty then delete it so that _wrename will succeed.
Bryan Berns
Yanbing
Manoj Ampalam
bagajjal
Oleg S