1 This package is the actual port of OpenSSH to Cygwin 1.3.
3 ===========================================================================
4 Important change since 2.9p2:
6 Since Cygwin is able to switch user context without password beginning
7 with version 1.3.2, OpenSSH now allows to do so when it's running under
8 a version >= 1.3.2. Keep in mind that `ntsec' has to be activated to
10 ===========================================================================
12 ===========================================================================
13 Important change since 2.3.0p1:
15 When using `ntea' or `ntsec' you now have to care for the ownership
16 and permission bits of your host key files and your private key files.
17 The host key files have to be owned by the NT account which starts
18 sshd. The user key files have to be owned by the user. The permission
19 bits of the private key files (host and user) have to be at least
22 Note that this is forced under `ntsec' only if the files are on a NTFS
23 filesystem (which is recommended) due to the lack of any basic security
24 features of the FAT/FAT32 filesystems.
25 ===========================================================================
27 If you are installing OpenSSH the first time, you can generate global config
28 files and server keys by running
30 /usr/bin/ssh-host-config
32 Note that this binary archive doesn't contain default config files in /etc.
33 That files are only created if ssh-host-config is started.
35 If you are updating your installation you may run the above ssh-host-config
36 as well to move your configuration files to the new location and to
37 erase the files at the old location.
39 To support testing and unattended installation ssh-host-config got
42 usage: ssh-host-config [OPTION]...
44 --debug -d Enable shell's debug output.
45 --yes -y Answer all questions with "yes" automatically.
46 --no -n Answer all questions with "no" automatically.
47 --port -p <n> sshd listens on port n.
49 Additionally ssh-host-config now asks if it should install sshd as a
50 service when running under NT/W2K. This requires cygrunsrv installed.
52 You can create the private and public keys for a user now by running
54 /usr/bin/ssh-user-config
56 under the users account.
58 To support testing and unattended installation ssh-user-config got
61 usage: ssh-user-config [OPTION]...
63 --debug -d Enable shell's debug output.
64 --yes -y Answer all questions with "yes" automatically.
65 --no -n Answer all questions with "no" automatically.
66 --passphrase -p word Use "word" as passphrase automatically.
68 Install sshd as daemon via cygrunsrv.exe (recommended on NT/W2K), via inetd
69 (results in very slow deamon startup!) or from the command line (recommended
72 If you start sshd as deamon via cygrunsrv.exe you MUST give the
73 "-D" option to sshd. Otherwise the service can't get started at all.
75 If starting via inetd, copy sshd to eg. /usr/sbin/in.sshd and add the
76 following line to your inetd.conf file:
78 sshd stream tcp nowait root /usr/sbin/in.sshd sshd -i
80 Moreover you'll have to add the following line to your
81 ${SYSTEMROOT}/system32/drivers/etc/services file:
83 sshd 22/tcp #SSH daemon
85 ===========================================================================
86 The following restrictions only apply to Cygwin versions up to 1.3.1
87 ===========================================================================
89 Authentication to sshd is possible in one of two ways.
90 You'll have to decide before starting sshd!
92 - If you want to authenticate via RSA and you want to login to that
93 machine to exactly one user account you can do so by running sshd
94 under that user account. You must change /etc/sshd_config
95 to contain the following:
99 Moreover it's possible to use rhosts and/or rhosts with
100 RSA authentication by setting the following in sshd_config:
102 RhostsAuthentication yes
103 RhostsRSAAuthentication yes
105 - If you want to be able to login to different user accounts you'll
106 have to start sshd under system account or any other account that
107 is able to switch user context. Note that administrators are _not_
108 able to do that by default! You'll have to give the following
109 special user rights to the user:
110 "Act as part of the operating system"
111 "Replace process level token"
113 and if used via service manager
114 "Logon as a service".
116 The system account does of course own that user rights by default.
118 Unfortunately, if you choose that way, you can only logon with
119 NT password authentification and you should change
120 /etc/sshd_config to contain the following:
122 PasswordAuthentication yes
123 RhostsAuthentication no
124 RhostsRSAAuthentication no
127 However you can login to the user which has started sshd with
128 RSA authentication anyway. If you want that, change the RSA
129 authentication setting back to "yes":
131 RSAAuthentication yes
133 Please note that OpenSSH does never use the value of $HOME to
134 search for the users configuration files! It always uses the
135 value of the pw_dir field in /etc/passwd as the home directory.
136 If no home diretory is set in /etc/passwd, the root directory
139 You may use all features of the CYGWIN=ntsec setting the same
140 way as they are used by the `login' port on sources.redhat.com:
142 The pw_gecos field may contain an additional field, that begins
143 with (upper case!) "U-", followed by the domain and the username
144 separated by a backslash.
145 CAUTION: The SID _must_ remain the _last_ field in pw_gecos!
146 BTW: The field separator in pw_gecos is the comma.
147 The username in pw_name itself may be any nice name:
149 domuser::1104:513:John Doe,U-domain\user,S-1-5-21-...
151 Now you may use `domuser' as your login name with telnet!
152 This is possible additionally for local users, if you don't like
153 your NT login name ;-) You only have to leave out the domain:
155 locuser::1104:513:John Doe,U-user,S-1-5-21-...
157 SSH2 server and user keys are generated by the `ssh-*-config' scripts
160 If you want to build from source, the following options to
161 configure are used for the Cygwin binary distribution:
165 --libexecdir='${exec_prefix}/sbin \
168 You must have installed the zlib, openssl and regex packages to
169 be able to build OpenSSH! The `--with-pcre' option requires
170 the installation of the pcre package.
172 Please send requests, error reports etc. to cygwin@cygwin.com.
176 Corinna Vinschen <vinschen@redhat.com>