administrators_authorized_keys missing from FixHostFilePermissions

[fatso83]

On Google Compute Engine the user accounts are in the Administrators group by default, not the Users group. That means the normal way of adding your key to .ssh/authorized_keys does not work and you need to add it to the (undocumented, see #1581) administrator_authorized_keys file. I did this and thought things were peachy. Adding -d and -dd did not show any issues, but finally -ddd showed the issue: a permissions problem where a user (probably myself) had right to view the file. Since I had already run the FixHostFilePermissions script, this was a bit surprising, and it seems this is basically an omission.

I tried adding Repair-AuthorizedKeyPermission -FilePath 'C:\ProgramData\ssh\administrators_authorized_keys' to the script, but it seems the repair script assumes these files must live under the profile directory, so I stopped digging there.

"OpenSSH for Windows" version
8.1.0.0

Server OperatingSystem
Windows Server 2016 Datacenter

What is failing
The file C:\ProgramData\ssh\administrators_authorized_keys is not checked for file permissions and/or fixed when running the FixHostFilePermissions script.

Expected output
That the file would be looked at/reported if something was wrong.

Actual output
No errors are fixed or reported.

[mwanzenried]

Hi!

I'm using the /.ssh/authorized_keys file to validate the publickey access.

In order to do that I've commented the sshd_config line that references to the administrators_authorized_keys file.

After that, I repaired the permissions with the instructions from here: https://github.com/PowerShell/Win32-OpenSSH/wiki/OpenSSH-utility-scripts-to-fix-file-permissions

Then I restarted the sshd service.

It works for me in several implementations.

Hope it helps.

[fatso83]

@mwanzenried That is a hack, not an actual fix: you just disabled the feature 😄 This is a feature request for a missing part of the docs. I don't actually have a problem, as should be apparent from the issue. Thanks anyway.

[fbehrens]

@fatso83 Thanks for reporting this issue. It helped me to resolve it. After hours.

This was hard to debug and it would be helpful to improve the docs to help with this.

[maertendMSFT]

We are removing the FixHostFilePermissions
There is a bug in the code where it does not allow all the users to have read permissions on ADMINISTRATORS_AUTHORIZED_KEYS file, it will be fixed in the next release.

[bagajjal]

#1747

[bagajjal]

PR - PowerShell/openssh-portable#481