OpenSSH Win2003 workaround

[Seth Kelly]

I've been having the same issues with "Authentication Failed" errors when tring to push PSP to servers with HP SIM as some others on this board have had. I have gone through all of the tinkering mentioned in the posts here to no avail. The only tactic I have not yet been able to implement successfully is the "Windows 2003 Workaround" from the readme file.

I have gone through all of the steps very carefully. However, when I try to restart the OpenSSH service I get a dialog that says "The OpenSSH service on local computer started and then stopped." The service starts just fine if I switchthe logon back to the "local account" radio button.

Any advice on this or any new advice about configuring SIM to remotely install PSP would be greatly appreciated.

Thanks,
Seth

[Carolyn_8]

Seth,
Not sure if this is the workaround you already tried but here is some info I found.
Carolyn

Problem: Windows 2003 does not allow the Local System account to have the privileges it needs to run the SSH service.

Solution: Configure the service to run as a â realâ administrative user.
1. Stop the OpenSSH Server service:

2. Go to Start Menu > Control Panel > Administrative Tools > Services to bring up the services window. Find the service labeled â OpenSSH Serverâ and stop it.

3. Change the â Log On Asâ user:
a. In the same window, right-click on the OpenSSH Server service and select Properties.
b. Select the Log On tab.
c. Click the This account radio button, and enter â .\Administratorâ . Enter Administratorâ s password and click OK.

4. Set file permissions:
a. Bring up a file explorer window by right-clicking the start menu button, and selecting Explore. Navigate to C:\Program Files\OpenSSH\var\log. Delete any files you find in that directory.
b. Navigate to C:\Program Files\OpenSSH\etc and select the files ssh_host_dsa_key, ssh_host_key, and ssh_host_rsa_key by holding down Ctrl and left-clicking on them. Then right-click on one of the files, select Properties, Security tab. Click the Advanced button. Select the Owner tab. Click Other Users or Groups and change the owner to â Administratorsâ .

5. Set user privileges: Go to Start Menu > Control Panel > Administrative Tools > Local Security Policy to bring up the security policy window. Find the Policies for Create a Token Object and Replace a Process Level Token. Add Administrator to this group by double-clicking the appropriate privilege, Click Add User or Group, enter Administrator in the Enter the Object Names to Select box, and click Check Names to verify the entry. Then click OK.

6. Start the OpenSSH Server service: Go to Start Menu > Control Panel > Administrative Tools > Services to bring up the services window. Find the service labeled â OpenSSH Serverâ and start it. At this point, the service Log On As user is set to Administrator, and Administrator has been granted Create a Token Object and Replace a Process Level Token privileges. Go back to the Services window and start the service.

7. Reinstall Systems Insight Manager SSH keys: Now OpenSSH is properly configured to work under Windows 2003. In order to get command line and custom tasks to work in HP Systems Insight Manager, youâ ll have to re-run mxagentconfig for Administrator if HP Systems Insight Manager was installed by someone other than Administrator. To do this, open a command window and run â mxagentconfig â a â u Administrator â p -n .â Alternately, run â mxagentconfigâ from th

[Carolyn_8]

sorry! Looked at my post and saw all the conversions to control characters. Hope you can read through it. Here is the rest of step number 7.

Alternately, run mxagentconfig from the command line with no parameters and enter the data into the GUI.

[Seth Kelly]

Right, this is the workaround that I have been trying to follow. The problem occurs in step 6. When I try to restart the OpenSSH service I get the error I mentioned above.

[Seth Kelly]

Well, I gave up on this workaround after determining it wasn't going to accomplish much. The test server I'd been trying to push the PSP to was just too far behind in updates (it's ancient and no longer used, hence test server) to authenticate properly. I remotely logged in to the box and manually ran the install of the tools downloaded from hp.com. Afterwards, SIM had no trouble communicating.

This weakness in SIM is really no trouble at all, since it's just as easy to remote login and run the install from a network share as it is to push it with Insight Manager.

Thanks anyways.

[Brian Harrison · Accepted solution]

Seth,

Can you run the Windows event viewer and look in the Application event log? This should give more details about the OpenSSH failure.
One possibility is that you need to delete the log file used by SSH, as the new user account does not have permission to open this file. This file is usually c:\Program Files\OpenSSH\var\log\OpenSSHd.log

Cheers,
Brian.

[Seth Kelly]

That did it. Thanks Brian. I haven't investigated into whether that workaround has made SIM run any better. However, my question was about applying the workaround, and your advice to delete the log made it work. Thanks again.

Seth