Match Group administrators is silently skipped for Entra ID administrators (keys read from per-user authorized_keys)
まだ誰も着手していません。
評価
- 難易度
- 4/5
- 見積もり時間
- 3〜5日
- 初心者へのやさしさ
- 48/100
- issue の種類
- バグ
- 明瞭さ
- おおむね明確
- 活発さ
- 活発
調査の方向性
Reproduce the issue with the supplied Windows, sshd_config, SYSTEM-task, and debug-log steps, then trace ga_init(), generate_s4u_user_token(), and get_user_token() during Match Group evaluation. Compare the administrator’s expected group membership with the reported empty group set; done means membership rules are evaluated correctly or the failure is clearly surfaced without silently using per-user keys.
索引モデルが issue の本文から書いたものです。
説明
Prerequisites
- Write a descriptive title.
- Make sure you are able to repro it on the latest version
- Search the existing issues.
Related: #1787 (SSH with AAD/Entra ID credentials). The behaviour below comes from PowerShell/openssh-portable#744, which made ga_init() non-fatal when no user token can be generated.
Steps to reproduce
- Entra ID–joined Windows 11 device; an Entra ID user (SID
S-1-12-1-…) who is a member of the local Administrators group. - Default
%ProgramData%\ssh\sshd_config, which contains:Match Group administrators AuthorizedKeysFile __PROGRAMDATA__/ssh/administrators_authorized_keys - Run
sshd.exe10.0.0.0p2 as SYSTEM (as the service does). For the logs below:sshd.exe -ddd -p 2223 -E log.txtfrom a SYSTEM scheduled task. - Put the user's public key in
C:\Users\<user>\.ssh\authorized_keys. ssh -p 2223 -l 'azuread\<user>' <host>
Expected behavior
The Match Group administrators block applies to an administrator, so their keys are looked up only in administrators_authorized_keys, as documented in OpenSSH key management. If group membership can't be determined, sshd should say so clearly rather than silently treating the user as a non-administrator.
Actual behavior
sshd can't create an S4U token for the Entra ID user (see #1787), so since #744 ga_init() reports the user as being in no groups. The Match Group administrators block is skipped for an Entra ID administrator, and the key is read from the per-user authorized_keys:
checking match for 'Group administrators' user azuread\\<user> host <client> ... lport 2223 on line 87
lookup_principal_name: User principal name lookup failed for user 'azuread\\<user>' (explicit: 1355, implicit: 1355)
debug1: generate_s4u_user_token: LsaLogonUser() failed. User 'azuread\\<user>' Status: 0xC0000062 SubStatus 0.
get_user_token - unable to generate token on 2nd attempt for user azuread\\<user>
ga_init, unable to resolve user azuread\\<user>
debug1: Can't Match group because user azuread\\<user> not in any group at line 87
debug3: match not found on line 87
Accepted key ED25519 SHA256:... found at C:/Users/<user>/.ssh/authorized_keys:1
Accepted publickey for azuread\\<user> from <client> port ... ssh2: ED25519 SHA256:...
(The session then fails with fork of unprivileged child failed, the S4U limitation tracked in #1787.)
Any other Match Group block an admin relies on (e.g. ForceCommand, ChrootDirectory, AllowTcpForwarding) is silently skipped for Entra ID users in the same way, because their membership always reads as "no groups".
Suggestion: when the token can't be generated, resolve membership another way (e.g. the account SID against the local group, including Entra role SIDs nested in Administrators), or at least log a warning that Match Group rules could not be evaluated for that user.
Environment data
Windows 11 Pro 25H2, build 10.0.26200, Entra ID–joined (AzureAdJoined: YES, DomainJoined: NO)
Windows PowerShell 5.1.26100
Version
OpenSSH_for_Windows_10.0p2 Win32-OpenSSH-GitHub, LibreSSL 4.2.0 (GitHub release 10.0.0.0p2-Preview, zip, run as SYSTEM)
Inbox OpenSSH_for_Windows_9.5 (sshd.exe 9.5.6.2) on the same machine fails earlier: ga_init() still calls fatal() there (pre-#744).
- 主要言語
- 言語のデータがありません
- スター
- 8.3k
- フォーク
- 821
- 平均マージ
- 12分
- マージ済み PR（30日）
- 1
環境構築
- Dockerfile・Docker Compose ファイルなし
- プルリクエストのテンプレートなし
- コントリビューションガイドを読む
はじめの一歩
- issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
- 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
- リポジトリをフォークし、ブランチを切って変更します。
- issue 番号を参照したプルリクエストを送ります。
PowerShell/Win32-OpenSSH のほかの issue
-
Area-ssh-agent Issue-Upstream Parity
難易度 2/5 1〜3時間 初心者へのやさしさ 74/100
PowerShell/Win32-OpenSSH#2458 · リアクション 1 件 ·
-
0 - Backlog Area-sshd Area-Terminal Investigate Issue-Bug
難易度 4/5 3〜5日 初心者へのやさしさ 48/100
PowerShell/Win32-OpenSSH#2468 · コメント 4 件 · リアクション 1 件 ·
-
Area-sshd Area-Terminal Investigate Issue-Regression
難易度 4/5 3〜5日 初心者へのやさしさ 48/100
PowerShell/Win32-OpenSSH#2465 · コメント 1 件 · リアクション 1 件 ·
-
Area-ssh-agent Issue-Enhancement
難易度 5/5 1週間以上 初心者へのやさしさ 25/100
PowerShell/Win32-OpenSSH#2462 · コメント 1 件 · リアクション 1 件 ·
-
Area-ssh-agent Investigate
難易度 5/5 1週間以上 初心者へのやさしさ 25/100
PowerShell/Win32-OpenSSH#2460 · リアクション 1 件 ·
PowerShell/Win32-OpenSSH の issue をすべて見る
似ている issue
-
難易度 2/5 1〜3時間 初心者へのやさしさ 82/100
-
難易度 2/5 1〜3時間 初心者へのやさしさ 78/100
メンテナーはふだん 1 日以内に返信
-
scope:security type:aquasec
難易度 2/5 1〜3時間 初心者へのやさしさ 76/100
AbsaOSS/atum-service#494 ·
-
[Bug] ComponentType classifies 0x8A8A-0xEAEA as GREASE; mls-extensions §7.5 makes them private useオープン
難易度 2/5 1〜3時間 初心者へのやさしさ 85/100
メンテナーはふだん 1 日以内に返信
-
auth: agent-bearer --manager-call is told to use the MCP instance argument on an ambiguous managerオープン
難易度 2/5 1〜3時間 初心者へのやさしさ 80/100
メンテナーはふだん 1 日以内に返信