https://wiki-stadm.eri.ucsb.edu/api.php?action=feedcontributions&feedformat=atom&user=Mtc 2026-04-06T00:17:08Z User contributions MediaWiki 1.34.0 https://wiki-stadm.eri.ucsb.edu/index.php?title=Windows_Domain_SSH&diff=2806 2015-07-10T22:25:02Z

<p>Mtc: </p> <hr /> <div>[[Category:Windows]]<br /> <br /> *Install Cygwin, for openssh you only need the openssh package but a few other tools will probably help(vim,wget,shutdown,rsync)<br /> *Create a service domain account that we will used to be able to login through ssh from a domain joined computer<br /> <br /> *Making the passwd file for Domain users:<br /> mkpasswd -d &gt; /etc/passwd<br /> mkgroup -g &gt; /etc/group<br /> <br /> *Making the passwd file for local users:<br /> mkpasswd -cl &gt; /etc/passwd<br /> mkgroup -cl &gt; /etc/group<br /> <br /> *Now you'll need to edit the passwd file and remove the hostname and/or domain name from the beginning of each user you'd like to be able to ssh into the system with.<br /> <br /> *on the local computer we need to add the Domain service account to certain groups<br /> *Go to Administrative tools in the Control Panel and open the Local Security Policy<br /> *Navigate to<br /> Local Security Policy =&gt; Security Settings =&gt; Local Policies =&gt; User Rights Assignment <br /> *add domain user to these groups<br /> Act as part of the operating system<br /> Create a token object<br /> Deny log on through remote desktop services<br /> Log on as a service<br /> Replace a process level token<br /> <br /> *Setup sshd<br /> ssh-host-config<br /> *We are going to answer yes to most of the default configuration, Except we will replace the user which is the service account used to run cygwin<br /> *By default it creates this user under the name cyg_server, when asked if we would like to create this user we will say no and give the ssh-host-config script another user which has the appropriate permission to allow domain logins<br /> *In our domain the user created for this purpose is cyg_service<br /> *below shows a summary of what we will be saying yes and no too as long as with output from a setup<br /> Should privilege separation be used(yes/no)? Yes</div>

Mtc