Compat issues on Nano Server

[teyan2222]

Issue list:

• ntrights.exe in OpenSSH-Win64.zip is a 32bit binary. It cannot run on Nano Server, which is a 64-bit Only Windows OS. This is needed to assign certain privileges to SSHDservice running in restricted mode.
• psexec.exe is needed to store host private keys in ssh-agent.
• SSHD service is unable to start in restricted mode

Work around:

• Run SSHD as local system
  sc.exe config sshd obj= LocalSystem

[DarwinJS]

ntrights is no longer used in the latest version (still in moderation: https://chocolatey.org/packages/win32-openssh/2016.05.30).

This was done for nano compatibility.

However, I am still working on eliminating psexec.exe which is also not compatible with nano.

Both ntrights.exe and psexec.exe were introduced as part of the official installation process with version 2015_05_15.

I will keep driving toward nano compat.

[volviq]

Is there any instructions page which describes how to deploy openssh on Nano Server? Ideally without compiling it by myself?

[Nomad1]

How I did it:

1. Downloaded x64 zip to local PC, unzipped it and pushed with PS to Nano Server to folder C:\Program Files\OpenSSH
2. Edited install script to contain above path, copied whole script to clipboard and pasted to PS command prompt
3. Ran 'sc.exe config sshd obj= LocalSystem'
4. Ran Set-Service and Start-Service commands from main instruction https://github.com/PowerShell/Win32-OpenSSH/wiki/Install-Win32-OpenSSH

SSH and SFTP works out of the box. Arrows, TAB and colors don't. Running powershell from ssh gives strange results and no error output, but it is still usable.

[volviq]

@Nomad1 Great, that solved it within a running Nano server instance.

Has anyone tried to deploy this onto an offline vhd/vhdx image with DISM or other tools, so that I can already have it running on a newly created VM? This would be very useful.

[DarwinJS]

FYI I am working on making the chocolateyinstall scripts compatible with Nano and will include a jump start script that calls it without chocolatey being installed.

[v4virus4u]

I was able to deploy OpenSSH on nano server. Able to ssh also to the nano server. But is there any way or link where I can understand whether ssh can work without password? I have tried modifying the sshd/ssh configuration files but every time I get a password prompt.
How can we avoid password using SSH?

[rob-scheepens]

On psexec: I copied psexec64 to Nano's %SYSTEMROOT%\System32 folder. Then I started to a local cmd on Nano by running "start cmd" from the remote PowerShell connection I had open to Nano. I then switched to the Nano vm's console, and ran "psexec64 -s cmd", which worked. This allowed me to carry out the key registrations under step 6 in the installation instructions on https://github.com/PowerShell/Win32-OpenSSH/wiki/Install-Win32-OpenSSH. Testing an ssh connection from my Mac to the Nano vm worked ok.

[DarwinJS]

I believe this bit of code does the key registration on nano without psexec.exe. Would be great to get confirmation of it by anyone who has a nano setup to test with (including testing the resultant server install:

https://github.com/DarwinJS/ChocoPackages/blob/master/win32-openssh/2016.05.30.20160902/tools/chocolateyinstall.ps1#L279-L286

And this code does the rights assignment without ntrights.exe:

https://github.com/DarwinJS/ChocoPackages/blob/master/win32-openssh/2016.05.30.20160902/tools/AddAccountToAssignPrimaryToken.ps1

[rob-scheepens]

@DarwinJS : just ran chocolateyinsall on a Nano server and it breaks because Invoke-WebRequest is not available in Nano (https://technet.microsoft.com/en-us/windows-server-docs/compute/nano-server/powershell-on-nano-server).

"[10.60.5.178]: PS C:\temp> .\chocolateyinstall.ps1
The term 'Invoke-WebRequest' is not recognized as the name of a cmdlet, function, script file, or operable program."

[DarwinJS]

Sorry - it is a known issue that chocolatey itself cannot run on Nano.

I meant for someone to run those two code segments independently to see if they work.

I am working on a wrapper script around ChocolateyInstall.ps1 that would allow it to run in Nano and create the same install - but without Chocolatey being present - this will be a gradual process.

[DarwinJS]

I believe I have a working install script for Nano - at least it worked in my testing.

It uses the same code as I put together for the chocolatey package - but does not require chocolatey nor wow64 nor does it require adding .NET Core to a bare Nano instance.

To use it, you download the chocolatey package, extract it and copy the \tools folder to your nano instance. (using "Copy-Item -ToSession")

Then run ..\tools\barebonesinstaller.ps1 -SSHServerFeature

Calling this code does not require chocolatey to be installed and it does not use any 32-bit EXEs.

Uninstall is: ..\tools\barebonesinstaller.ps1 -SSHServerFeature -Uninstall

Use "get-help ..\tools\barebonesinstaller.ps1" for a few more details.

Here is the code - it calls chocolateyinstall.ps1 which contains logic to run standalone outside of chocolatey: https://github.com/DarwinJS/ChocoPackages/blob/master/win32-openssh/2016.05.30.20160908/tools/barebonesinstaller.ps1

[rob-scheepens]

@DarwinJS : works like a charm, thanks! :)

[rob-scheepens]

@DarwinJS: when trying to use ssh-copy-id from my Mac to setup key-based authentication, I'm getting:

PS /> ssh-copy-id [email protected]                                                                                                   
[email protected]'s password: 
packet_write_wait: Connection to 10.61.16.126: Broken pipe

Can you help enabling key-based authentication on Nano?

[DarwinJS]

I am still trying to understand what would be involved through questions in this thread: #341 - specifically concerned about the possible challenge of getting this workflow to enter "system" context on the remote machine if that is necessary.

[DarwinJS]

FYI to all - Chocolatey package and it's built-in barebonesinstaller.ps1 are tested and working on Nano RTM. https://github.com/DarwinJS/ChocoPackages/blob/master/openssh/readme.md

[joeyaiello]

Thanks so much for all the help @DarwinJS. Just got 0.0.0.9 working on a Nano box with your process and installer script. We're currently working through some of the problems introduced with 0.0.1.0 (which, heads up to everyone, doesn't currently work with Nano).

[DarwinJS]

Glad it is helpful - I am curious which offline install method you chose and why.

[joeyaiello]

which offline method

I'm not sure I understand...I just followed your intstructions here because I had an RTM Nano build without Invoke-WebRequest. If you're asking how I fetched the nupkg, I have the Chocolatey repo registered as a PackageManagement repository, and I just used Save-Package. Then I pushed that thing to Nano with Copy-Item -ToSession

[DarwinJS]

Yes that is what I was asking.

Cool. You can now do it over the wire in a Nano remote session without doing the save and file copy first by using the method under "Installing on Nano Over the Wire w/out Chocolatey Nor .NET Core Installed (should work for Server 2016 as well)" in this document: https://github.com/DarwinJS/ChocoPackages/blob/master/openssh/readme.md

[manojampalam]

install-sshd.ps1 should work on Nano with March End release