Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OpenSSH for Windows update

blogs.msdn.com

Post reply on HN
Print view View original

81–90 of 146 posts

Re: OpenSSH for Windows update

#81

Post by antod »

switch007 wrote: post #37
gionn wrote: post #7

I am waiting the moment when I can throw away WinRM and SSH to all the servers.

You have to create a god damn scheduled task to do Windows Updates over WinRM. And it takes ages for Powershell to realise the task is running, and polling the status of the job is a PITA. Took me days to automate Windows 2012 with Packer. Ugh

> You have to create a god damn scheduled task to do Windows Updates over WinRM.

Aha. That must be why I could never get updates working with Packer/WinRM. It would take a very long time to do a huge amount of work then end up never quite finishing properly.

> And it takes ages for Powershell to realise the task is running, and polling the status of the job is a PITA.

OK, so not really a proper solution then. Oh well.

Re: OpenSSH for Windows update

#82

Post by lelandbatey »

antics wrote: post #56
kasabali wrote: post #9

> Address POSIX compatibility concerns Best way to address POSIX compatibility concerns is implementing a proper POSIX layer in Windows (and not in a half-baked manner like the now deprecated SUA). I can't imagine how it would hurt anybody.

SUA was not half-baked, this is a very, very hard problem. There is a very serious difference in the way POSIX and Windows model a lot of really important OS primitives, from asynchronicity model in signals, to the semantics of syscalls like `fork`. Every process using these primitives on POSIX has specific behavior defined under those primitives, and if you don't choose _exactly_ the right behavior on the POSIX subs…

Indeed. The Cygwin project has done an amazing job working to act as a compatibility layer between Windows and POSIX, but even Cygwin, with all the time and energy that's gone into it, still has some rough edges. Not to say that using it isn't awesome, but it's not perfect.

Re: OpenSSH for Windows update

#83

Post by ryanprichard »

Will this OpenSSH server be able to run interactive console programs (like cmd.exe or python.exe), or will it be limited to (say) PowerShell?

Windows doesn't have a good API for hosting a console--it's not like Unix, where a pty has a master end and a slave end. Trying to run a console program in mintty.exe (https://github.com/mintty/mintty/issues/56) or Cygwin SSHD fails for this reason. I wrote a tool, winpty, that makes a best-effort attempt to emulate a Unix pty master by scraping the console buffer, but it has some limitations, so I'm not sure Microsoft would want to use it. Maybe they would expand the console API?

Re: OpenSSH for Windows update

#85

Post by toyg »

bad_user wrote: post #68
togusa wrote: post #31

Earlier quoted context omitted.

It does but as you say due to the emperor's new clothes every few years, the loyalty isn't there now. I know of no companies doing greenfield desktop dev that are using any of their tech. It's all Qt, CEF, python/wx and JavaFX. Even the financial companies we deal with who were pretty heavy with the WPF are canning it next cycle. Incumbent MFC, Winforms and WPF stuff will live as long as VB6 did (and still does) thou…

> Edit as HN won't let me reply But it does, it just hides the link. All you have to do is to go to the child's comment by clicking the time link, then you'll get a reply box. In your case the comment you probably want to reply to is this: https://news.ycombinator.com/item?id=10416018

ssssh! There is a reason the system is as it is...

Re: OpenSSH for Windows update

#86

Post by toyg »

ryanprichard wrote: post #83

Will this OpenSSH server be able to run interactive console programs (like cmd.exe or python.exe), or will it be limited to (say) PowerShell? Windows doesn't have a good API for hosting a console--it's not like Unix, where a pty has a master end and a slave end. Trying to run a console program in mintty.exe ( https://github.com/mintty/mintty/issues/56 ) or Cygwin SSHD fails for this reason. I wrote a tool, winpty, th…

> Will this OpenSSH server be able to run interactive console programs

I would think so. Anything less would not be a real SSH server.

Re: OpenSSH for Windows update

#87

Post by asveikau »

ryanprichard wrote: post #83

Will this OpenSSH server be able to run interactive console programs (like cmd.exe or python.exe), or will it be limited to (say) PowerShell? Windows doesn't have a good API for hosting a console--it's not like Unix, where a pty has a master end and a slave end. Trying to run a console program in mintty.exe ( https://github.com/mintty/mintty/issues/56 ) or Cygwin SSHD fails for this reason. I wrote a tool, winpty, th…

I too was very skeptical. Something about posts from "The Powershell Team" about porting sshd makes me deeply cynical that they would get the integration right from a layering perspective, i.e. as if they would make it support powershell and nothing else.

Fortunately this example shows it going straight into cmd and then they invoke powershell as a next step:

    C:\Master>ssh.exe -l user@127.0.0.1
    user@127.0.0.1's password: **********
    Microsoft Windows [Version 10.0.10566]
    (c) 2016 Microsoft Corporation. All rights reserved.
    user@DEV-10566-829 C:\Users\user>powershell -File -
- https://github.com/PowerShell/Win32-OpenSSH/wiki/ssh.exe-exa...

That gives me some hope that it's being done right.

Re: OpenSSH for Windows update

#88

Post by geofft »

DonnyV wrote: post #27
daguava wrote: post #5

Earlier quoted context omitted.

Was just coming here to voice my concerns over this choice as well, wondering what their reasoning is for changing crypto systems.

I really don't like that there replacing an open source crypto with a closed source one. Putting on my tin foil hat but didn't Microsoft hand over a back door to the NSA already.

> Putting on my tin foil hat but didn't Microsoft hand over a back door to the NSA already.

What incident are you referring to? I can think of a couple of possible ones:

1. PRISM, which is still a big question mark, and if it's in your threat model, then running Windows, let alone running Windows with an SSH server of any form, is not something you want to be doing, regardless of whether a particular library in it is open-source.

2. _NSAKEY, which MS had a decently convicing explanation of: it was a signing key used to indicate NSA-approved cryptographic providers (for FIPS-ish auditing), not anything that could be used to break into a user's account remotely.

3. The removal of the Elephant diffuser from BitLocker. My personal opinion is that all "diffusers", custom block cipher modes, etc. for full-disk encryption are pseudoscience; if you really want integrity protection, change your filesystem so it uses 4064-byte sectors, a 16-byte IV, and a 16-byte authentication tag. In any case, it still requires physical access to the disk to attack, so it's not particularly useful as an NSA back door (unless your threat model is one of the "then you have bigger problems" ones).

But maybe I'm forgetting something else?

Re: OpenSSH for Windows update

#89

Post by geofft »

asveikau wrote: post #87
ryanprichard wrote: post #83

Will this OpenSSH server be able to run interactive console programs (like cmd.exe or python.exe), or will it be limited to (say) PowerShell? Windows doesn't have a good API for hosting a console--it's not like Unix, where a pty has a master end and a slave end. Trying to run a console program in mintty.exe ( https://github.com/mintty/mintty/issues/56 ) or Cygwin SSHD fails for this reason. I wrote a tool, winpty, th…

I too was very skeptical. Something about posts from "The Powershell Team" about porting sshd makes me deeply cynical that they would get the integration right from a layering perspective, i.e. as if they would make it support powershell and nothing else. Fortunately this example shows it going straight into cmd and then they invoke powershell as a next step: C:\Master>ssh.exe -l user@127.0.0.1 user@127.0.0.1's passw…

There are these two interesting commits, "Add pty mode support code":

https://github.com/PowerShell/Win32-OpenSSH/commit/55f2ec682...

and "Add ANSI parsing engine and console draw support to SSH client":

https://github.com/PowerShell/Win32-OpenSSH/commit/7aac59e52...

Something about this reminds me of ANSI.SYS.

Re: OpenSSH for Windows update

#90

Post by est »

geofft wrote: post #89
asveikau wrote: post #87

Earlier quoted context omitted.

I too was very skeptical. Something about posts from "The Powershell Team" about porting sshd makes me deeply cynical that they would get the integration right from a layering perspective, i.e. as if they would make it support powershell and nothing else. Fortunately this example shows it going straight into cmd and then they invoke powershell as a next step: C:\Master>ssh.exe -l user@127.0.0.1 user@127.0.0.1's passw…

There are these two interesting commits, "Add pty mode support code": https://github.com/PowerShell/Win32-OpenSSH/commit/55f2ec682... and "Add ANSI parsing engine and console draw support to SSH client": https://github.com/PowerShell/Win32-OpenSSH/commit/7aac59e52... Something about this reminds me of ANSI.SYS.

you could run ANSI.sys in modern cmd.exe, sadly there's no ANSI.sys in Win7 anymore.

https://groups.google.com/forum/#!topic/alt.msdos.batch.nt/Y...

Post reply on HN