How to allow ssh access for a specific user in windows server 2016

[DS-Liu]

Prerequisites

• Write a descriptive title.
• Make sure you are able to repro it on the latest version
• Search the existing issues.

Steps to reproduce

I can log in to windows server 2016 as administrator through ssh. However, when logging in as other users, say dsliu, it shows this message "Permission denied, please try again", even if I add a line "AllowUsers dsliu" to the end of the file sshd_config_default.
The contents of the file sshd_config_default are as follows,

# This is the sshd server system-wide configuration file.  See
# sshd_config(5) for more information.

# The strategy used for options in the default sshd_config shipped with
# OpenSSH is to specify options with their default value where
# possible, but leave them commented.  Uncommented options override the
# default value.

#Port 22
#AddressFamily any
#ListenAddress 0.0.0.0
#ListenAddress ::

#HostKey __PROGRAMDATA__/ssh/ssh_host_rsa_key
#HostKey __PROGRAMDATA__/ssh/ssh_host_dsa_key
#HostKey __PROGRAMDATA__/ssh/ssh_host_ecdsa_key
#HostKey __PROGRAMDATA__/ssh/ssh_host_ed25519_key

# Ciphers and keying
#RekeyLimit default none

# Logging
#SyslogFacility AUTH
#LogLevel INFO

# Authentication:

#LoginGraceTime 2m
#PermitRootLogin prohibit-password
#StrictModes yes
#MaxAuthTries 6
#MaxSessions 10

#PubkeyAuthentication yes

# The default is to check both .ssh/authorized_keys and .ssh/authorized_keys2
# but this is overridden so installations will only check .ssh/authorized_keys
AuthorizedKeysFile	.ssh/authorized_keys

#AuthorizedPrincipalsFile none

# For this to work you will also need host keys in %programData%/ssh/ssh_known_hosts
#HostbasedAuthentication no
# Change to yes if you don't trust ~/.ssh/known_hosts for
# HostbasedAuthentication
#IgnoreUserKnownHosts no
# Don't read the user's ~/.rhosts and ~/.shosts files
#IgnoreRhosts yes

# To disable tunneled clear text passwords, change to no here!
#PasswordAuthentication yes
#PermitEmptyPasswords no

# GSSAPI options
#GSSAPIAuthentication no

#AllowAgentForwarding yes
#AllowTcpForwarding yes
#GatewayPorts no
#PermitTTY yes
#PrintMotd yes
#PrintLastLog yes
#TCPKeepAlive yes
#UseLogin no
#PermitUserEnvironment no
#ClientAliveInterval 0
#ClientAliveCountMax 3
#UseDNS no
#PidFile /var/run/sshd.pid
#MaxStartups 10:30:100
#PermitTunnel no
#ChrootDirectory none
#VersionAddendum none

# no default banner path
#Banner none

# override default of no subsystems
Subsystem	sftp	sftp-server.exe

# Example of overriding settings on a per-user basis
#Match User anoncvs
#	AllowTcpForwarding no
#	PermitTTY no
#	ForceCommand cvs server

Match Group administrators
       AuthorizedKeysFile __PROGRAMDATA__/ssh/administrators_authorized_keys

AllowUsers dsliu

Expected behavior

Log in as a specific user.

Actual behavior

dsliu@114.214.196.227's password:
Permission denied, please try again.

Error details

No response

Environment data

Name                           Value
----                           -----
PSVersion                      5.1.14393.1944
PSEdition                      Desktop
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0...}
BuildVersion                   10.0.14393.1944
CLRVersion                     4.0.30319.42000
WSManStackVersion              3.0
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1

Version

v8.9.1.0

Visuals

No response

[mgkuhn]

I'm not sure, but this might be doable via setting the membership of certain built-in groups. You could try to set e.g. the membership of the group BUILTIN\Users to just the people you want to be able to logon, reducing it from the default membership, which usually consists of the groups Authenticated Users and Domain Users.

https://ss64.com/nt/syntax-security_groups.html

I believe sshd performs a network logon for the user, so whatever group membership grants the user SeNetworkLogonRight should enable ssh access.

[mwtrigg]

Per the documenation (https://docs.microsoft.com/en-us/windows-server/administration/openssh/openssh_server_configuration#allowgroups-allowusers-denygroups-denyusers), your AllowUsers syntax is correct if dsliu is a local user. If you're looking to authenticate as a domain user, you should use the format domain_short_name\user_name in the AllowUsers field.

I believe sshd performs a network logon for the user, so whatever group membership grants the user SeNetworkLogonRight should enable ssh access.

ssh access is controlled directly by the sshd_config; there is no combination of user rights that will override what is defined in that file.

[DS-Liu]

I'm sorry that I wasted your time. I was so stupid that I entered the wrong passward. After entering the correct password, everything works just fine.