Documentation
¶
Overview ¶
Package gosshd is an SSH server for WinPE guests.
Win32-OpenSSH cannot serve a session there. Per connection it spawns a pre-auth child as a virtual account — LsaManageSidNameMapping, then LogonUserExExW with LOGON32_PROVIDER_VIRTUAL — and authenticates the user with an S4U logon. WinPE supports no user logons at all, so both stages fail and the connection closes before authentication. Privilege separation has been mandatory upstream since 7.5, so there is no configuration that avoids it.
This server answers with a password callback in its own process and starts children with a plain CreateProcess, so no part of a session touches the Windows logon subsystem. The guest is a throwaway PE behind a host-only NAT reached over a per-run forwarded port, which is what makes a fixed password acceptable here.
Index ¶
Constants ¶
const ( // DefaultAddr is the guest-side listen address. The host reaches it // through a per-run forwarded port, never directly. DefaultAddr = ":22" // DefaultUser and DefaultPassword are the credentials the guest is // built with. WinPE's Administrator has no password and no usable // account database, so these name nothing in Windows — they are only // this server's own shared secret with the harness. DefaultUser = "admin" DefaultPassword = "admin" )
Variables ¶
This section is empty.
Functions ¶
func SessionCommand ¶
SessionCommand is the argv for a session. An empty request means the client asked for a shell rather than a single command.
cmd.exe rather than pwsh: WinPE always has it, and the harness stages pwsh at a path that is not on PATH.
Types ¶
type Server ¶
type Server struct {
// Addr is the listen address, ":22" when empty.
Addr string
// User and Password are the only accepted credentials. Both empty
// means no credentials are accepted at all.
User, Password string
// Log receives connection events. Discarded when nil.
Log *log.Logger
// contains filtered or unexported fields
}
Server serves one WinPE guest.
func (Server) Authenticate ¶
Authenticate reports whether the offered credentials are the configured ones. A Server with no credentials configured accepts nothing, so a zero-value Server cannot be reached with an empty password.
func (Server) ListenAndServe ¶
ListenAndServe serves until the listener fails.
Source Files
Directories