0

I installed an OpenSSH server on my Windows server. The new Windows "SSH server feature" did not appear at all (I tried it through the settings and the instructions form Microsoft to install it through the PowerShell), so I downloaded this one. I managed to set up public key authentication, so the local server user can log in using his key. This works well. I used the Process Explorer (sysinternals, see here) to set the permissions: The user is allowed to start and stop one specific service. When the user is logged in via SSH, calling "net start " returns "System error 5 has occurred. Access is denied."

What I tried: I found this error weird since I did set the permissions. So I logged in to the server with this same user via a Remote Desktop Connection. In the regular (non-admin) command prompt, I again called "net start " and it worked!

I also tried to temporarily add the local server user to the admin group of the server. UPDATE: When I do that, I can start the service via SSH. But when the user is not part of the admin group, I can still only start the service in the remote desktop connection session, not via ssh.

I don't know what the problem is, it might be connected to the SSH server not handling the permissions correctly. I'm pretty desperate already, so I'd be VERY grateful for some help! :D

Improve this question
8
  • 1
    Process Explorer is not the tool to setup permissions. If this is a system service, it should be allocated permissions via the Services applet and restarted.
    – harrymc
    Mar 16, 2020 at 8:35
  • @harrymc could you elaborate your approach? I don't see a way to edit permissions in the Services applet.
    – Philipp
    Mar 16, 2020 at 8:56
  • 1
    Permissions are allocated to the Log On account, rather than the service. Check what it is for your service.
    – harrymc
    Mar 16, 2020 at 8:59
  • @harrymc in the "Log On" tab, I ticked "Local System Account". However, my question is not about the permissions of the service, but about which user can start/stop the service. Is this what you can configure here?
    – Philipp
    Mar 16, 2020 at 9:06
  • 1
    The SSH server creates the session. Evidently the account used is not the same as for remote desktop. Check the account used, perhaps by the whoami command if it exists in Server 2016 or by Process Explorer. If required, there exist methods for a non-admin user to run specific commands as admin.
    – harrymc
    Mar 16, 2020 at 9:13

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .