Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OpenSSH for Windows update

blogs.msdn.com

Post reply on HN
Print view View original

111–120 of 146 posts

Re: OpenSSH for Windows update

#111

Post by rodgerd »

martin1975 wrote: post #99

Never was much of a windows fan, so a (slightly ignorant) question for someone who is a Win admin - can most administrative things nowadays be done via the command line on Windows (like we've been able to do in *nix land) or is there a gap between what can be done via the GUI vs the command line?

Microsoft are pushing the command line to the point that:

a) Many operations in newer bits of Windows have simple-mode available in the GUI, but more sophisticated options must be scripted. StorageSpaces has a few examples of this, where some of the options around tiered storage, SSD caching, and the layout of pools can only be accessed via posh.

b) Microsoft are pushing completely headless versions of Windows Server for 2016.

Re: OpenSSH for Windows update

#112

Post by unexistance »

kasabali wrote: post #9

> Address POSIX compatibility concerns Best way to address POSIX compatibility concerns is implementing a proper POSIX layer in Windows (and not in a half-baked manner like the now deprecated SUA). I can't imagine how it would hurt anybody.

and I'm just here still using UnxUtils :D no installation needed too

Re: OpenSSH for Windows update

#113

Post by MichaelGG »

jen20 wrote: post #105
MichaelGG wrote: post #18

Earlier quoted context omitted.

It really is surprisingly bad, isn't it? I recently was involved in a continuous deployment system targeting Windows. We simply couldn't get WinRM to reliably upload fast and ended up installing SSH everywhere.

Having worked on that code (in Packer) - the WinRM protocol is completely unsuitable for use as an SCP replacement. It's amazing it works at all even for small files! The actual "winrmcp" implementation is here https://github.com/packer-community/winrmcp if you're interested in the inner workings.

OK, but that code (cp.go) uploads base64 chunks of 8K and echo's them to a file and decodes when done. That surely isn't the real WinRM file copy implementation right?

Well... I just went looking for how it's implemented and holy shit I don't think they considered this case. Top results say "use a file share". Wow. I feel less inadequate.

Re: OpenSSH for Windows update

#114

Post by dogma1138 »

nailer wrote: post #42
thristian wrote: post #17

Earlier quoted context omitted.

A crypto system is a big and complex thing, subtle and quick to anger, and I can't blame Microsoft for wanting to concentrate on the one they're already supporting, instead of having to support two. On the other hand, for the exact same reason, I expect OpenSSH probably isn't interested in supporting anything besides LibreSSL and maybe OpenSSL, at least while they're so closely related.

So you think it'll remain a fork, rather than a platform for OpenSSH? If they implemented a good openssl to cryptoAPI shim it could be usable by other projects linked against OpenSSL.

You can already configure OpenSSL to delegate the engine to CAPI which means that OpenSSL mostly works as a "shim".

[engine_section] capi = capi_config

[capi_config] engine_id = capi dynamic_path = c:\\openssl-win32\\bin\\capi.dll init=1

Re: OpenSSH for Windows update

#116

Post by e12e »

The more things change..., from:

https://github.com/PowerShell/Win32-OpenSSH/wiki/Deploy-Win3...

"If you need key-based authentication:

Install key-auth package

run setup-ssh-lsa.cmd

reboot"

Reboot?

And this gem: "SSH daemon needs to run as System to support key-based authentication".

Which means, either use weak authentication, or run the daemon as system. I don't even understand why, it's not like the public keys are particularly sensitive (certainly much less sensitive than being able to check passwords for validity)?

Re: OpenSSH for Windows update

#117

Post by lukeh »

int_handler wrote: post #66

This is exciting to hear. I might be overly nitpicky, but holy inconsistent coding styles Batman: compare https://github.com/PowerShell/Win32-OpenSSH/blob/bafc1df7c5c... to the other source files.

Ugh. And calling strcpy() with user-supplied data inside a SSP of all places... :-(

Re: OpenSSH for Windows update

#118

Post by rasz_pl »

nailer wrote: post #3

> Leverage Windows crypto api’s instead of OpenSSL/LibreSSL and run as Windows Service Was wondering about that. I'm surprised the OpenBSD team is accepting the commits - something so fundamental and Windows specific doesn't seem like their kind of thing - but great! PS. If you're coming from a Unix background and interested in learning posh: https://certsimple.com/rosetta-stone

>I'm surprised the OpenBSD team is accepting the commits

What commits? From the comments you will learn there were no commits and this is a classic embrace and extend. They are hijacking OpenSSL name, and rewriting it to use Microsoft crypto and APIs.

Re: OpenSSH for Windows update

#119

Post by voltagex_ »

rasz_pl wrote: post #118
nailer wrote: post #3

> Leverage Windows crypto api’s instead of OpenSSL/LibreSSL and run as Windows Service Was wondering about that. I'm surprised the OpenBSD team is accepting the commits - something so fundamental and Windows specific doesn't seem like their kind of thing - but great! PS. If you're coming from a Unix background and interested in learning posh: https://certsimple.com/rosetta-stone

>I'm surprised the OpenBSD team is accepting the commits What commits? From the comments you will learn there were no commits and this is a classic embrace and extend. They are hijacking OpenSSL name, and rewriting it to use Microsoft crypto and APIs.

...what? It's there on the repo. It's not upstreamed yet, no.

I think this is a fantastic step forward. If you've never been subjected to WinRM you may not understand why this is such a big deal.

Re: OpenSSH for Windows update

#120

Post by 885895 »

ThatGeoGuy wrote: post #78
modeless wrote: post #52

Earlier quoted context omitted.

midipix looks awesome, but seems to be GPL (not LGPL). Does that mean anything using it must be GPL too? I think that would be unacceptable for such a low layer of the stack.

I don't know why you're being downvoted, but this is a legitimate concern for some businesses (well, legitimate may be too strong, but it is a concern a lot of legal departments will have). After discussing this issue on #midipix on freenode, they had mentioned they will explore dual-licensing or some variant of such once the software is more stable and can be reliably deployed. In any case, the project is far too ea…

I don't understand the point of dual-licensing. Anything licensed under a BSD-style license such as ISC or MIT can to my understanding be redistributed under GPL anyway. IANAL, TINLA.
Post reply on HN