OpenSSH for Windows update • Hacker News Board

Re: OpenSSH for Windows update

#91

Post by lukeh » Tue, Oct 20, 2015, 12:52 AM UTC

asdfaoeu wrote: post #60

guelo wrote: post #46

Earlier quoted context omitted.

Why would the OpenBSD team not accept the commits? It is just linking to a system library that will always be present on the platform. It's like saying Windows opensource should be forced to use some thrid party filesystem library.

My guess is they won't just write an openssl to schannel shim and instead sprinkle ifdefs throughout the code which would be a recipe for disaster. Looking at the new code I feel like the chances this ever makes it upstream to pretty close to 0.

Schannel implements SSL; crypto is in WinCNG these days. SSPI support for Kerberos and EAP would be nice.

Re: OpenSSH for Windows update

#92

Post by ams6110 » Tue, Oct 20, 2015, 1:15 AM UTC

I've been running OpenSSH on Windows servers for years, using Cygwin.

Re: OpenSSH for Windows update

#93

Post by PhantomGremlin » Tue, Oct 20, 2015, 1:20 AM UTC

nailer wrote: post #3

> Leverage Windows crypto api’s instead of OpenSSL/LibreSSL and run as Windows Service Was wondering about that. I'm surprised the OpenBSD team is accepting the commits - something so fundamental and Windows specific doesn't seem like their kind of thing - but great! PS. If you're coming from a Unix background and interested in learning posh: https://certsimple.com/rosetta-stone

I'm surprised the OpenBSD team is accepting the commits

Theo has come a long way since he lost beaucoup bucks by spitting in DARPA's face after taking their money.[1] Now Microsoft and OpenBSD are besties.[2]

There are a few companies that give money to OpenBSD. Far too few, but there are some: http://www.openbsdfoundation.org/contributors.html

The saddest thing to me is that Yandex is on there. Not because they shouldn't be, but because so many American and Western companies are willing to take, take, take, but are unwilling to give back even a little bit.

[1] http://www.computerworld.com/article/2580728/security0/darpa... [2] http://www.theregister.co.uk/2015/07/08/microsoft_donates_to...

Re: OpenSSH for Windows update

#94

Post by emmelaich » Tue, Oct 20, 2015, 1:42 AM UTC

nailer wrote: post #3

> Leverage Windows crypto api’s instead of OpenSSL/LibreSSL and run as Windows Service Was wondering about that. I'm surprised the OpenBSD team is accepting the commits - something so fundamental and Windows specific doesn't seem like their kind of thing - but great! PS. If you're coming from a Unix background and interested in learning posh: https://certsimple.com/rosetta-stone

I think that there is nothing to accept.

These patches are going to the portable version - which has always been a separately maintained branch of openssh. e.g. no PAM, no Kerberos ...

Re: OpenSSH for Windows update

#95

Post by lukeh » Tue, Oct 20, 2015, 2:11 AM UTC

Analemma_ wrote: post #20

daguava wrote: post #5

Earlier quoted context omitted.

Was just coming here to voice my concerns over this choice as well, wondering what their reasoning is for changing crypto systems.

I imagine it's nothing more complicated than "OpenSSL isn't the native crypto implementation on Windows, SChannel is". Microsoft's engineers are probably much more familiar with SChannel, and they don't want to have to test/validate two crypto systems in parallel. Besides, this should make OpenSSH better in the long run; it should be able to have any compatible crypto layer underneath.

SChannel implements SSL/TLS as a security support provider (SSP), native crypto interfaces are WinCNG (current) or CryptoAPI (legacy). A port of OpenSSH that used the native crypto library would likely use WinCNG.

An OpenSSL-like wrapper around WinCNG can be found in Heimdal's libhcrypto.

Re: OpenSSH for Windows update

#96

Post by geofft » Tue, Oct 20, 2015, 2:17 AM UTC

est wrote: post #90

geofft wrote: post #89

Earlier quoted context omitted.

There are these two interesting commits, "Add pty mode support code": https://github.com/PowerShell/Win32-OpenSSH/commit/55f2ec682... and "Add ANSI parsing engine and console draw support to SSH client": https://github.com/PowerShell/Win32-OpenSSH/commit/7aac59e52... Something about this reminds me of ANSI.SYS.

you could run ANSI.sys in modern cmd.exe, sadly there's no ANSI.sys in Win7 anymore. https://groups.google.com/forum/#!topic/alt.msdos.batch.nt/Y...

Cool. Looks like that is essentially listing DEVICE=ANSI.SYS in config.nt? Google results imply some things about 16-bit emulation here -- was that post about running actual DOS ANSI.SYS in a VDM running actual DOS COMMAND.COM, within a native Windows terminal?

Re: OpenSSH for Windows update

#97

Post by jamiesonbecker » Tue, Oct 20, 2015, 2:18 AM UTC

Cool. Looks like Userify.com (SSH Key management) will support yet another platform sometime next year.

(disclaimer: I work there.)

Re: OpenSSH for Windows update

#98

Post by roller » Tue, Oct 20, 2015, 2:24 AM UTC

daveloyall wrote: post #44

cakes wrote: post #39

I'm interested in how this is going to work in PowerShell with the way everything works now, if there happen to be any details about that (whether here, somewhere else, or a past link)?

I don't know anything about PowerShell, but I have a similar question, I think: how is this going to work? Will I be able to do something like this command line (from my *nix machine)? ssh user@windows.machine.local dir d: | less

This is a key thing I'm curious about. How is drive mapping handled? If I "net use d: \\host\share" from one session, it won't nessarily translate and mount D: to all sessions (or will it)?

Re: OpenSSH for Windows update

#99

Post by martin1975 » Tue, Oct 20, 2015, 2:30 AM UTC

Never was much of a windows fan, so a (slightly ignorant) question for someone who is a Win admin - can most administrative things nowadays be done via the command line on Windows (like we've been able to do in *nix land) or is there a gap between what can be done via the GUI vs the command line?

Re: OpenSSH for Windows update

#100

Post by detaro » Tue, Oct 20, 2015, 2:32 AM UTC

martin1975 wrote: post #99

Never was much of a windows fan, so a (slightly ignorant) question for someone who is a Win admin - can most administrative things nowadays be done via the command line on Windows (like we've been able to do in *nix land) or is there a gap between what can be done via the GUI vs the command line?

(From what I've heard from people using them) On the current server versions, PowerShell should allow to do all that the GUI can do. There is a GUI-less version and I think the GUI actually uses PowerShell underneath, so you can look up in a log how the commands look like for something you only knew how to do graphically before.