%u is expand to domain\User

[Lebowski4273]

"OpenSSH for Windows" version
8.1

Server OperatingSystem
Windows Server 2016

I want to use chroot. While %h is not expand to the homedir configured in the AD i use something like D:\homes%u. But unfortunately %u is expand to domain\username. I would expect, %u will be expand to the username.

I think to expand %u the Windows-NT/Prä Windows 2000 Username ist used.

Example:
I tried to use D:\homes\sub%u for chroot-directory. But this will redirect the user to D:\homes\sub<domainname><username>, and of course, this folder doesn't exist.

[Lebowski4273]

still exists

[jaymzh]

This is especially problematic for authorized_keys. I wanted to do:

authorized_keys 'c:\ssh\authorized_keys\%u'

translates to a thing that doesn't exist which is frustrating.

[mgkuhn]

Does always occur, or only on a computer with two accounts that have same user name, but each in a different domain (e.g., one machine local and one in Active Directory)? In the latter case, the domain prefix is needed to disambiguate between these two users.

[jaymzh]

Always. Even if you're not in a domain you get COMPUTERNAME\user. My AD-ified machines only have a single domain.

[Toretu]

I bypassed this by changing my file structure to
\sftproot\<domain>\<username>\ as in
d:\sftproo\consonto\john\

[jaymzh]

@Toretu interesting, that doesn't seem to work for authorized_keys paths.

[Toretu]

@jaymzh migth be, i was actually working on chroot when i discovered int the log that it was looking in /sftpDir/<domain>/<username> but i cant see why it would noe extract \%u the same way in keys... try enabling logs SyslogFacility LOCAL0 and see where its looking for the keys

[jaymzh]

I did. Given authorized_keys 'c:\ssh\authorized_keys\%u' it looks like it should work, the logs show C:\ssh\authorized_keys\DOMAIN\user but creating files in that directory don't actually work, it says they're not there.

[Toretu]

what does the log way? also do ssh/user have read to the folder?

[Lebowski4273]

Hi,
i think the easiest way is to get the username when using %u. Is there any easy way to delete the domain name form there result of %u.
And at all: Does it make any sense to expand %u to domainname/username an not to username?

[yoke88]

8.6p1 %u expand to domainname\username..

[mtkraai]

I used:

AuthorizedKeysFile	__PROGRAMDATA__/ssh/authorized_keys/%u .ssh/authorized_keys

I put the public keys in C:\ProgramData\ssh\authorized_keys\domain\username. Note that it's all lower case. I made sure these files and directories have the same permissions as required for C:\ProgramData\ssh\administrators_authorized_keys in the documentation.

It works.

[jaymzh]

So to be clear @mtkraai - the "domain\user" gets translated into a directory for the domain and then the users are files in that directory? That's what I would expect, but it did not work back in 8.6 or whatever. It was looking for a file called "domain\user" which isn't allowed.... so it sounds like you're saying that's fixed and it properly parses that as a directory?

[Side note I no longer work at the company I was at when I ran into this bug, so I have not tried newer versions, but if you're saying that behavior is sorted, then we can probably just figure out what version that changed in, note it here, and close the bug.]