Different result from ssh and powershell

[Santuz90]

"OpenSSH for Windows" version
OpenSSH_for_Windows_7.9p1, LibreSSL 2.6.5

Server OperatingSystem
Windows Server 2012 R2 Datacenter

Client OperatingSystem
Fedora 29 / Windows Server 2012 R2 Datacenter

What is failing
cmdlets Get-Hotfix

Expected output
Source Description HotFixID InstalledBy InstalledOn

---

SVRTMP Security Update KB3004365 NT AUTHORITY\SYSTEM
SVRTMP Hotfix KB3004545 NT AUTHORITY\SYSTEM
SVRTMP Update KB3012235 NT AUTHORITY\SYSTEM
SVRTMP Update KB3012702 NT AUTHORITY\SYSTEM

Actual output
get-hotfix : Access denied
At line:1 char:1

• get-hotfix

•   + CategoryInfo          : NotSpecified: (:) [Get-HotFix], ManagementExcept
   ion
    + FullyQualifiedErrorId : System.Management.ManagementException,Microsoft.
   PowerShell.Commands.GetHotFixCommand
  
  

The user is a domain user with standard user rigths (only remote desktop capability).
If i send the cmdlet from powershell connected in RDP it works without problem, when launched in ssh it respond with Access Denied.

It works in SSH only if the user was added to Local Administrators group on the remote machine (SVRTMP).

[NoMoreFood]

This is reproducible with just a standard local user (not domain user) and the problem can be seen with Get-WmiObject as well. I suspected might be using Get-HotFix might be using WMI which is why I tried Get-WmiObject; other technologies may have similar issues. You can also reproduce it by running wmic.exe ComputerSystem from a Command Prompt SSH session (i.e. not PowerShell as the shell).

@manojampalam I can trace this back to LOGON32_LOGON_NETWORK_CLEARTEXT as the logon type for LogonUserExExW(). If you use LOGON32_LOGON_INTERACTIVE, it works fine. In principal, I feel like we should be using LOGON32_LOGON_INTERACTIVE since that's arguably the sort of login this is, and it's probably the most flexible token. However, I know that comes with the added complication of the user requiring the "Allow log on locally" security policy privilege on the destination system to grant SeInteractiveLogonRight -- and they may not have that privilege in all cases. Maybe we should try LOGON32_LOGON_INTERACTIVE and fail over to LOGON32_LOGON_NETWORK_CLEARTEXT if the user doesn't have the requested logon type? We could also try to temporarily grant SeInteractiveLogonRight and then revoke it immediately after process creation, but that could raise some SIEM flags at some companies.

[simolev]

Yes, I believe Get-Hotfix uses WMI since calling Get-WmiObject -class Win32_QuickFixEngineering gives exactly the same result.

With a non-administrator user, the same thing happens over remote powershell as with SSH. Access Denied:

> Get-HotFix
Access denied
    + CategoryInfo          : NotSpecified: (:) [Get-HotFix], ManagementException
    + FullyQualifiedErrorId : System.Management.ManagementException,Microsoft.PowerShell.Commands.GetHotFixCommand

> Get-WmiObject -class Win32_QuickFixEngineering
Get-WmiObject : Access denied
    + CategoryInfo          : InvalidOperation: (:) [Get-WmiObject], ManagementException
    + FullyQualifiedErrorId : GetWMIManagementException,Microsoft.PowerShell.Commands.GetWmiObjectCommand

[manojampalam]

@NoMoreFood why would you see a logon over SSH "interactive" ? Even with Powershell remoting, you should be seeing the same behavior (remote powershell sessions run under "network logons".

[NoMoreFood]

@manojampalam It may be more of a WMI-specific issue. As I mentioned, running wmic
ComputerSystem from a normal command prompt also results in an access denied message.

[bnielsen1965]

I think I may be suffering from this issue on OpenSSH 8.6p1. When you authenticate is there a way to view the login type you recieved, i.e. LOGON32_LOGON_NETWORK_CLEARTEXT vs LOGON32_LOGON_INTERACTIVE?

I'm not certain but it seems as though the ssh login gets a different type depending on whether you are signing into a domain account or a local account.

I have a Windows 2016 1607 server with OpenSSH installed and I have domain logins and a local use login. So far so good, but I need the users to have permissions to start and stop a custom service so I modified the service sddl and this worked for the AD users authenticated over OpenSSH but the local user still does not have permission.

If the local user uses runas and re-enters credentials then it works. My plan was to eventually use key pairs to do automation so runas doesn't help my case.

I've tried various sid types in the sddl, BU, AU, IU, even blew it open with WD, and no luck at all. So now I'm wondering what the login type is when a local user authenticates.

[NoMoreFood]

Yeah, sounds like the same issue. The Security event log will likely tell you what kind of token was issued. I suspect the only permissions you can give would be to ANONYMOUS LOGON and you'd probably have to tweak some security policies to make that work (i.e., not something you should do). You could probably try to merge my old change, recompile, and see if that does the trick.

[bnielsen1965]

@NoMoreFood thanks for the suggestion.

I checked the security event log and sure enough the final Logon Type is 8 when I ssh with credentials, which translates to LOGON32_LOGON_NETWORK_CLEARTEXT, and type 3 when I ssh with a key, which translates to LOGON32_LOGON_NETWORK.

I thought I could use the type 3 with a custom SDDL ACE on a service but I obviously don't fully understand how Microsoft's access control works because I can only get an ACE to work with a type 2 logon, which is LOGON32_LOGON_INTERACTIVE.

May have to give in and setup a Jenkins agent as a Windows service and only use ssh on my linux agents.

Anyhow, thanks again.