RE: Using Key Pairs on OpenSSH on Win2k3
"Welsh, Armand" <[email protected]> Wed, 28 May 2008 17:07:37 -0700
| Newsgroups | gmane.network.ssh.windows |
|---|---|
| Message-ID | <078F02AD7EC1DF4FA30DC587C548679A01426DF2@INE000PB.IMSWEST.SSCIMS.com> |
This is a multi-part message in MIME format. ------_=_NextPart_001_01C8C120.00D79A6A Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable What you are doing here is changing the home directory, not the path. If you place the home directory into the default PATH then this sort of works, but but it is not a good idea to point a user's home directory to someplace other than a home directory, because the home directory often will contain files that are unique to the user. To change the path, you should nodify the login shell scripts to set the PATH. See my other email about how to change the default. =20 Note: The only real difference between copSSH and openSSH is that copSSH is the cygwin openSSH without the bloat of unnecessary GNU tools, and with the convenience of preconfiguring a workable system. OpenSSH for Windows (not to be confused with Cygwin's version) is out dated and full of security holes.. ________________________________ From: [email protected] [mailto:[email protected]] On Behalf Of Travis, Shane (GE Healthcare) Sent: Wednesday, May 28, 2008 4:20 PM To: [email protected] Subject: RE: Using Key Pairs on OpenSSH on Win2k3 OpenSSH allows you to change the path for a user. Open the file <openssh_install_dir>\etc\passwd and find the entry for the user you are using to log in, and change the path from=20 =20 /home/<user> to /cygdrive/<drive_letter>/<path> Example: If want to change the path to C:\rx then the home directory should be set to /cygdrive/c/rx =20 At one point when I investigated CopSSH, it was not capable of doing this, which is why our organization is still using OpenSSH. If users of CopSSH know for a fact that this has changed, and can explain the mechanism, I for two (OP is 'for one') would love to hear. =20 --=20 Shane Travis <[email protected]>=20 Lead Service System Designer=20 GE Healthcare IITS - Centricity Pharmacy=20 T: 306 667 7942 F: 306 933 0111=20 ________________________________ From: [email protected] [mailto:[email protected]] On Behalf Of Robert Denton Sent: Wednesday, May 28, 2008 4:57 PM To: [email protected] Subject: RE: Using Key Pairs on OpenSSH on Win2k3 =09 =09 Okay, let me see if I can explain my set up a little bit. And you might be right about there being no connection between openssh and the ssl used to connect to the https server, but here goes: =09 user@svnserver ---(ssh)---> admin@devserver ---(https)---> svnserver =09 Seems weird to do it that way, but in order to maintain a mirror of our code on the dev server we need to issue an 'update' command to the svn client on the dev server where we want the mirror, and this is triggered by a process on the svn server itself. The first part seems to be working with one weird exception: =09 If I log onto the devserver and launch a command prompt, the command 'svn' is known by virtue of path. Oddly, if I ssh to that server as the same user, the command 'ssh' is not known. Does Cygwin (or OpenSSH) maintain it's own path variable? If so, where is it kept? =09 Robert=20 =09 ________________________________ From: Welsh, Armand [mailto:[email protected]] To: [email protected] Sent: Wed, 28 May 2008 14:33:24 -0700 Subject: RE: Using Key Pairs on OpenSSH on Win2k3 =09 =09 I don't think the copSSH and the https based activities are related. Regarding the connection to the other server (via https), how is this connection established? I need more information to understand the issue. Are you connecting (via ssh) to the server, and then on the server using wget or other command line util to get something from a web server? If you are using an SSH tunnel to connect to the https server using the ssh server as a middle point then I would need to know what client libraries on your client computer are used to establish the https session. =20 Armand ________________________________ From: [email protected] [mailto:[email protected]] On Behalf Of Robert Denton Sent: Wednesday, May 28, 2008 12:49 PM To: [email protected] Subject: Re: Using Key Pairs on OpenSSH on Win2k3 =09 =09 So I took your advice and installed CopSSH instead and it is working as desired, with one minor snag. First, the application I am using this for is to connect to the copssh server and run some commands. One of the commands involves connection to a different server via https. When I do this I get prompted to accept the certificate. Choosing 'p' for permanent has no effect. =09 Advice I have gotten from other forums is that I need to download Comodo's Trusted Root Certificate and append it to the end of the ca-bundle.crt that is used by OpenSSH. Unfortunately a search of the system yields no such file. Where does CopSSH place this file? And do you agree that this is the recommended course of action? =09 Robert =09 ________________________________ From: Welsh, Armand [mailto:[email protected]] To: [email protected] Sent: Thu, 22 May 2008 09:17:19 -0700 Subject: Re: Using Key Pairs on OpenSSH on Win2k3 =09 Robert, =09 Before I look into potential causes, the first I would like to know is: are you using copSSH, the Cygwin installation with the openSSH package installed, or the "openSSH for Windows" project from source forge? =09 Why do I ask? Al three are openSSH from the cygwin project the following conditions: Cygwin is the thick install proding the option to turn you windows box into a GNU Linux like operating system (via the bash or other shell and some special mappers built into cygwin). The cygwin project installs a basic configuration of openSSH which works well on older windows systems, but requires specific things be done to get the SSH server to work 100% on windows 2003 and Vista. =09 CopSSH is a pre-packaged minimal installation of Cygwin with a couple minor enhancement patches that installs Cygwin, openSSH, configures you computer (even vista and win2k3) so that openSSH works without any tweaking at all. =09 "OpenSSH for Windows" is a dead sourceforge project that is almost identical to copSSH, except that development on the project has stopped a long time ago, and this package requires more tweaking of the ssh settings and the server that the other options, and is running very old ssh code that should not be used anymore in my opinion. =09 If you want the easy solution, install copSSH and everything will work. If you want to get what you have working and you did not install copSSH then we can offer assistance with making all the appropriate changes, but it will take more time to get SSH services up and running with public keys, but you will have the option of using any piece of the cygwin project easily. =09 Armand =09 =09 ------_=_NextPart_001_01C8C120.00D79A6A Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <HTML xmlns:o =3D "urn:schemas-microsoft-com:office:office"><HEAD> <META http-equiv=3DContent-Type content=3D"text/html; = charset=3Dus-ascii"> <STYLE>BODY { FONT: 10pt Tahoma, Verdana, sans-serif } </STYLE> <META content=3D"MSHTML 6.00.6000.16640" name=3DGENERATOR></HEAD> <BODY dir=3Dltr> <DIV dir=3Dltr align=3Dleft><SPAN class=3D648130300-29052008>What you = are doing here=20 is changing the home directory, not the path. If you place = the home=20 directory into the default PATH then this sort of works, but but it is = not a=20 good idea to point a user's home directory to someplace other than a = home=20 directory, because the home directory often will contain files that are = unique=20 to the user. To change the path, you should nodify the login shell = scripts=20 to set the PATH. See my other email about how to change the=20 default.</SPAN></DIV> <DIV dir=3Dltr align=3Dleft><SPAN = class=3D648130300-29052008></SPAN> </DIV> <DIV dir=3Dltr align=3Dleft><SPAN class=3D648130300-29052008>Note: = The only real=20 difference between copSSH and openSSH is that copSSH is the cygwin = openSSH=20 without the bloat of unnecessary GNU tools, and with the convenience of=20 preconfiguring a workable system. OpenSSH for Windows = (not to=20 be confused with Cygwin's version) is out dated and full of security=20 holes..</SPAN></DIV><BR> <DIV class=3DOutlookMessageHeader lang=3Den-us dir=3Dltr align=3Dleft> <HR tabIndex=3D-1> <B>From:</B> [email protected] [mailto:[email protected]] <B>On Behalf = Of=20 </B>Travis, Shane (GE Healthcare)<BR><B>Sent:</B> Wednesday, May 28, = 2008 4:20=20 PM<BR><B>To:</B> [email protected]<BR><B>Subject:</B> RE: Using Key = Pairs on=20 OpenSSH on Win2k3<BR><BR></DIV> <DIV></DIV> <DIV><FONT face=3DArial color=3D#0000ff><SPAN = class=3D290561423-28052008>OpenSSH=20 allows you to change the path for a user. Open the = file</SPAN></FONT></DIV> <DIV><FONT face=3DArial color=3D#0000ff><SPAN = class=3D290561423-28052008><FONT=20 color=3D#000000><SPAN lang=3DEN-CA=20 style=3D"FONT-SIZE: 11pt; FONT-FAMILY: 'Courier New'; = mso-fareast-font-family: 'Times New Roman'; mso-ansi-language: EN-CA; = mso-fareast-language: EN-US; mso-bidi-language: = AR-SA"><EM><openssh_install_dir></EM></SPAN><SPAN=20 lang=3DEN-CA=20 style=3D"FONT-SIZE: 11pt; FONT-FAMILY: 'Courier New'; = mso-fareast-font-family: 'Times New Roman'; mso-ansi-language: EN-CA; = mso-fareast-language: EN-US; mso-bidi-language: = AR-SA">\etc\passwd</SPAN></FONT></SPAN></FONT></DIV> <DIV><FONT face=3DArial color=3D#0000ff><SPAN = class=3D290561423-28052008>and find the=20 entry for the user you are using to log in, and change the path from=20 </SPAN></FONT></DIV> <DIV><FONT face=3DArial color=3D#0000ff><SPAN=20 class=3D290561423-28052008></SPAN></FONT> </DIV> <DIV><FONT face=3DArial color=3D#0000ff> <P class=3DMsoNormal=20 style=3D"MARGIN: 6pt 0in 6pt 1.25in; TEXT-INDENT: -1.25in; tab-stops: = list 1.25in; mso-text-indent-alt: -9.0pt; mso-list: l7 level3 = lfo50"><SPAN=20 lang=3DEN-CA=20 style=3D"FONT-SIZE: 11pt; FONT-FAMILY: 'Courier New'; mso-ansi-language: = EN-CA"><FONT=20 color=3D#000000>/home/<I><<SPAN=20 class=3D290561423-28052008>user</SPAN>></I></FONT></SPAN></P> <P class=3DMsoNormal=20 style=3D"MARGIN: 6pt 0in 6pt 1.25in; TEXT-INDENT: -1.25in; tab-stops: = list 1.25in; mso-text-indent-alt: -9.0pt; mso-list: l7 level3 = lfo50"><FONT=20 color=3D#000000><SPAN lang=3DEN-CA=20 style=3D"FONT-SIZE: 11pt; FONT-FAMILY: 'Courier New'; mso-ansi-language: = EN-CA"></SPAN></FONT><SPAN=20 lang=3DEN-CA=20 style=3D"FONT-FAMILY: 'GE Inspira'; mso-ansi-language: EN-CA; = mso-bidi-font-size: 11.0pt"><SPAN=20 class=3D290561423-28052008><FONT = face=3DArial>to</FONT></SPAN></SPAN></P> <P class=3DMsoNormal=20 style=3D"MARGIN: 6pt 0in 6pt 1.25in; TEXT-INDENT: -1.25in; tab-stops: = list 1.25in; mso-text-indent-alt: -9.0pt; mso-list: l7 level3 = lfo50"><SPAN=20 lang=3DEN-CA=20 style=3D"FONT-FAMILY: 'GE Inspira'; mso-ansi-language: EN-CA; = mso-bidi-font-size: 11.0pt"><SPAN=20 class=3D290561423-28052008></SPAN></SPAN><SPAN lang=3DEN-CA=20 style=3D"FONT-SIZE: 11pt; FONT-FAMILY: 'Courier New'; mso-ansi-language: = EN-CA"><FONT=20 color=3D#000000>/cygdrive/<drive_letter>/<path></FONT></SPAN>= <SPAN=20 lang=3DEN-CA=20 style=3D"FONT-FAMILY: 'GE Inspira'; mso-ansi-language: EN-CA; = mso-bidi-font-size: 11.0pt"><o:p></o:p></SPAN></P></FONT></DIV> <DIV><FONT face=3DArial><EM><SPAN lang=3DEN-CA=20 style=3D"FONT-SIZE: 12pt; FONT-FAMILY: 'GE Inspira'; = mso-fareast-font-family: 'Times New Roman'; mso-ansi-language: EN-CA; = mso-fareast-language: EN-US; mso-bidi-language: AR-SA; = mso-bidi-font-size: 11.0pt; mso-bidi-font-family: 'Times New = Roman'">Example:=20 If <SPAN class=3D290561423-28052008>want to change the path to<FONT = face=3D"Courier New"> </FONT></SPAN></SPAN><SPAN lang=3DEN-CA=20 style=3D"FONT-SIZE: 11pt; FONT-FAMILY: 'Courier New'; = mso-fareast-font-family: 'Times New Roman'; mso-ansi-language: EN-CA; = mso-fareast-language: EN-US; mso-bidi-language: AR-SA">C:\rx=20 </SPAN><SPAN lang=3DEN-CA=20 style=3D"FONT-SIZE: 12pt; FONT-FAMILY: 'GE Inspira'; = mso-fareast-font-family: 'Times New Roman'; mso-ansi-language: EN-CA; = mso-fareast-language: EN-US; mso-bidi-language: AR-SA; = mso-bidi-font-size: 11.0pt; mso-bidi-font-family: 'Times New = Roman'">then=20 the home directory should be set to</SPAN><SPAN lang=3DEN-CA=20 style=3D"FONT-SIZE: 11pt; FONT-FAMILY: 'Courier New'; = mso-fareast-font-family: 'Times New Roman'; mso-ansi-language: EN-CA; = mso-fareast-language: EN-US; mso-bidi-language: AR-SA">=20 /cygdrive/c/rx</SPAN></EM></FONT></DIV> <DIV><FONT face=3DArial color=3D#0000ff></FONT> </DIV> <DIV><SPAN class=3D290561423-28052008><FONT color=3D#000000><SPAN = lang=3DEN-CA=20 style=3D"FONT-SIZE: 11pt; FONT-FAMILY: 'Courier New'; = mso-fareast-font-family: 'Times New Roman'; mso-ansi-language: EN-CA; = mso-fareast-language: EN-US; mso-bidi-language: = AR-SA"></SPAN></FONT></SPAN><SPAN=20 class=3D290561423-28052008></SPAN><FONT face=3DArial><FONT = color=3D#0000ff>A<SPAN=20 class=3D290561423-28052008>t one point when I investigated CopSSH, it = was not=20 capable of doing this, which is why our organization is still using = OpenSSH. If=20 users of CopSSH know for a fact that this has changed, and can explain = the=20 mechanism, I for two (OP is 'for one'</SPAN></FONT></FONT><FONT = face=3DArial><FONT=20 color=3D#0000ff><SPAN class=3D290561423-28052008>) would love to=20 hear.</SPAN></FONT></FONT></DIV> <DIV><FONT face=3DArial><FONT color=3D#0000ff><SPAN = class=3D290561423-28052008><SPAN=20 lang=3Den-us><FONT face=3DArial=20 size=3D2></FONT></SPAN></SPAN></FONT></FONT> </DIV> <DIV><FONT face=3DArial><FONT color=3D#0000ff><SPAN = class=3D290561423-28052008><SPAN=20 lang=3Den-us><FONT face=3DArial size=3D2>-- </FONT></SPAN><BR><SPAN=20 lang=3Den-us><B><FONT face=3DArial size=3D2>Shane Travis = <</FONT></B><FONT=20 face=3DArial size=3D2>[email protected]></FONT><B></B></SPAN> = <BR><SPAN=20 lang=3Den-us><FONT face=3DArial size=3D2>Lead Service System = Designer</FONT></SPAN>=20 <BR><SPAN lang=3Den-us><FONT face=3DArial size=3D2>GE Healthcare IITS - = Centricity=20 Pharmacy</FONT></SPAN> <BR><SPAN lang=3Den-us><FONT face=3DArial = size=3D2>T: 306 667=20 7942 F: 306 933 0111</FONT></SPAN>=20 </DIV></SPAN></FONT></FONT> <DIV><BR></DIV> <BLOCKQUOTE dir=3Dltr=20 style=3D"PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #0000ff 2px = solid; MARGIN-RIGHT: 0px"> <DIV class=3DOutlookMessageHeader lang=3Den-us dir=3Dltr align=3Dleft> <HR tabIndex=3D-1> <FONT face=3DTahoma><B>From:</B> [email protected] = [mailto:[email protected]]=20 <B>On Behalf Of </B>Robert Denton<BR><B>Sent:</B> Wednesday, May 28, = 2008 4:57=20 PM<BR><B>To:</B> [email protected]<BR><B>Subject:</B> RE: Using Key = Pairs on=20 OpenSSH on Win2k3<BR></FONT><BR></DIV> <DIV></DIV>Okay, let me see if I can explain my set up a little = bit. And=20 you might be right about there being no connection between openssh and = the ssl=20 used to connect to the https server, but here = goes:<BR><BR>user@svnserver=20 ---(ssh)---> admin@devserver ---(https)---> = svnserver<BR><BR>Seems weird=20 to do it that way, but in order to maintain a mirror of our code = on the=20 dev server we need to issue an 'update' command to the svn client on = the dev=20 server where we want the mirror, and this is triggered by a process on = the svn=20 server itself. The first part seems to be working with one weird = exception:<BR><BR>If I log onto the devserver and launch a command = prompt, the=20 command 'svn' is known by virtue of path. Oddly, if I ssh to that = server as=20 the same user, the command 'ssh' is not known. Does Cygwin (or = OpenSSH)=20 maintain it's own path variable? If so, where is it = kept?<BR><BR>Robert=20 <BR> <BLOCKQUOTE=20 style=3D"PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: = rgb(0,0,255) 2px solid; MARGIN-RIGHT: 0px"> <HR> <B>From:</B> Welsh, Armand = [mailto:[email protected]]<BR><B>To:</B>=20 [email protected]<BR><B>Sent:</B> Wed, 28 May 2008 14:33:24=20 -0700<BR><B>Subject:</B> RE: Using Key Pairs on OpenSSH on = Win2k3<BR><BR> <DIV align=3Dleft><SPAN class=3D758572821-28052008>I don't think the = copSSH and=20 the https based activities are related. Regarding the = connection to=20 the other server (via https), how is this connection = established? I=20 need more information to understand the issue. Are you = connecting (via=20 ssh) to the server, and then on the server using wget or other = command line=20 util to get something from a web server? If you are using an = SSH=20 tunnel to connect to the https server using the ssh server as a = middle point=20 then I would need to know what client libraries on your client = computer are=20 used to establish the https session.</SPAN></DIV> <DIV align=3Dleft><SPAN = class=3D758572821-28052008></SPAN> </DIV> <DIV align=3Dleft><SPAN = class=3D758572821-28052008>Armand</SPAN></DIV><BR> <DIV class=3DOutlookMessageHeader align=3Dleft> <HR> <B>From:</B> <A = href=3D"mailto:[email protected]">[email protected]</A>=20 [mailto:<A href=3D"mailto:[email protected]">[email protected]</A>] = <B>On=20 Behalf Of </B>Robert Denton<BR><B>Sent:</B> Wednesday, May 28, 2008 = 12:49=20 PM<BR><B>To:</B> <A=20 = href=3D"mailto:[email protected]">[email protected]</A><BR><B>Subject:</B= > Re:=20 Using Key Pairs on OpenSSH on Win2k3<BR><BR></DIV> <DIV></DIV>So I took your advice and installed CopSSH instead and it = is=20 working as desired, with one minor snag. First, the = application I am=20 using this for is to connect to the copssh server and run some=20 commands. One of the commands involves connection to a = different=20 server via https. When I do this I get prompted to accept the=20 certificate. Choosing 'p' for permanent has no = effect.<BR><BR>Advice I=20 have gotten from other forums is that I need to download Comodo's = <SPAN=20 style=3D"MARGIN-TOP: 0px; FONT: 90% monospace; font-size-adjust: = none; font-stretch: normal">Trusted=20 Root Certificate and append it to the end of the ca-bundle.crt that = is used=20 by OpenSSH. Unfortunately a search of the system yields no = such=20 file. Where does CopSSH place this file? And do you = agree that=20 this is the recommended course of action?</SPAN><BR><BR>Robert<BR> <BLOCKQUOTE=20 style=3D"PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: = rgb(0,0,255) 2px solid; MARGIN-RIGHT: 0px"> <HR> <B>From:</B> Welsh, Armand [mailto:<A=20 = href=3D"mailto:[email protected]">[email protected]</A>]<BR><= B>To:</B>=20 <A = href=3D"mailto:[email protected]">[email protected]</A><BR><B>Sent:</B>=20 Thu, 22 May 2008 09:17:19 -0700<BR><B>Subject:</B> Re: Using Key = Pairs on=20 OpenSSH on Win2k3<BR><BR>Robert,<BR><BR>Before I look into = potential=20 causes, the first I would like to know is: are you using copSSH, = the=20 Cygwin installation with the openSSH package installed, or the = "openSSH=20 for Windows" project from source forge?<BR><BR>Why do I ask? Al = three are=20 openSSH from the cygwin project the following = conditions:<BR>Cygwin is the=20 thick install proding the option to turn you windows box into a = GNU Linux=20 like operating system (via the bash or other shell and some = special=20 mappers built into cygwin). The cygwin project installs a basic=20 configuration of openSSH which works well on older windows = systems, but=20 requires specific things be done to get the SSH server to work = 100% on=20 windows 2003 and Vista.<BR><BR>CopSSH is a pre-packaged minimal=20 installation of Cygwin with a couple minor enhancement patches = that=20 installs Cygwin, openSSH, configures you computer (even vista and = win2k3)=20 so that openSSH works without any tweaking at all.<BR><BR>"OpenSSH = for=20 Windows" is a dead sourceforge project that is almost identical to = copSSH,=20 except that development on the project has stopped a long time = ago, and=20 this package requires more tweaking of the ssh settings and the = server=20 that the other options, and is running very old ssh code that = should not=20 be used anymore in my opinion.<BR><BR>If you want the easy = solution,=20 install copSSH and everything will work. If you want to get what = you have=20 working and you did not install copSSH then we can offer = assistance with=20 making all the appropriate changes, but it will take more time to = get SSH=20 services up and running with public keys, but you will have the = option of=20 using any piece of the cygwin project=20 easily.<BR><BR>Armand<BR><BR></BLOCKQUOTE></BLOCKQUOTE></BLOCKQUOTE> <STYLE>BODY { FONT: 10pt Tahoma,Verdana,sans-serif } </STYLE> </BODY></HTML> ------_=_NextPart_001_01C8C120.00D79A6A-- -- List Info: http://erdelynet.com/ssh-l/ List Archives: http://erdelynet.com/archive/ssh-l/ To Unsubscribe: Mail mailto:[email protected] If you are having trouble unsubscribing, visit the List Info page for help.