Document administrators_authorized_keys

[fatso83]

I had tons of troubles trying to get public key authentication going, until I slapped on three -d for sshd that showed me that my authorized_keys was not even being used and that the real issue was with administrators_authorized_keys. Google does not show any results for docs on this and I cannot find it mentioned in the wiki either.

Can you please document this somewhere and link it from the public keys documentation? It took me 2 months to spot #1324, explaining some of the background.

[prynhart]

Hi @fatso83 - Point taken about it not being in the official doco, but I can find references to this file location online, such as this post from May 2019: https://www.concurrency.com/blog/may-2019/key-based-authentication-for-openssh-on-windows

[prynhart]

Also - I'm a Linux/Mac Guy and ran into this problem (that you've detailed on the superuser post - i.e. interop with a Windows Server 2016 box). Just wanted to add that another approach to "spy on what Windows is doing" is to make use of procmon from sys internals.

i.e. without needing to manually start sshd.exe with debug flags, I monitored during an ssh connection to see the following file access attempt (prior to the file administrators_authorised_keys being present)

[jkrejcha]

It's documented here and it is an option in the SSH configuration file itself.

[billdinger]

I put in a pr (#1465 6 or so months back to update the documentation to make the link that @jkrejcha refers to a bit more explicit in this wiki. I think if they merged that in it'd help make ita bit clearer

[TheBigBear]

But this is an English language installation only default which breaks in many other languages, where MS translated the text string used for 'administrators'.

This is definitely a buggy default setting.

!!! That fails in a multi language setup. !!!

I just lost nearly half a day to understand that on my German windows machines the group match rule needs to be
changed to something like this: ( note: administrators (English) -> administratoren (German) )

Match Group administratoren
    AuthorizedKeysFile __PROGRAMDATA__/ssh/administrators_authorized_keys

Like @jantari 's suggestion of:

Change the current Match rule to something like this:

Match Group *S-1-5-32-544
    AuthorizedKeysFile __PROGRAMDATA__/ssh/administrators_authorized_keys

This would be a much better and windows language install agnostic setting and should be the default, not a per language adapted string.
( also see #1324 (comment) )