copssh restart security problem

5 posts / 0 new
Topic locked
Last post
Thu, 26/01/2006 - 10:04
#1
itefix
Offline
Last seen: 8 hours 57 min ago
Joined: 01.05.2008 - 21:33
copssh restart security problem

I am running copSSH on a 2003 server. It install and worked perfectly however I have a security problem. As it installs SVCcopssh as a local account it clashes with the global security policy which requires it to be a domain account to run a service. Is there anyway to change the account which runs the service ?

Top
Thu, 26/01/2006 - 12:14
itefix
Offline
Last seen: 8 hours 57 min ago
Joined: 01.05.2008 - 21:33
Re: copssh restart security problem

Unfortunately there is no a straightforward solution for that. However, you may try the procedure below:

  1. Stop the Open SSHD service.

  2. Change the service account from SvcCOPSSH to domain\user

  3. Update setperms.cmd by replacing SvcCOPSSH by domain\user

  4. Transfer user rights from SvcCOPSSH to domain\user  by Local Security Policy MMC -> User Rights Assignment

  5. Run setperms.cmd

  6. Start the Open SSHD service.

  7. Update the Registry (HKLM/Software/Itefix/Copssh/ServiceAccount = domain\user)

Hope it helps. The next major copSSH release will have a more configurable setup including service account customization. When ? I don't know :-)

Top
Thu, 10/05/2007 - 21:06
itefix
Offline
Last seen: 8 hours 57 min ago
Joined: 01.05.2008 - 21:33
Re: copssh restart security problem

This is not directly supported in 1.4.2 yet.

Top
Thu, 09/08/2007 - 16:25
tobysimmons
Re: copssh restart security problem

Is it possible to run the OpenSSH service under a domain account? I tried changing the service "Log on As" and the registry entry, but the service would fail to start (and not give any reason.) Since my server is a domain member, the service must be a domain account instead of a local one.

Thanks!

Top
Fri, 10/08/2007 - 05:08
itefix
Offline
Last seen: 8 hours 57 min ago
Joined: 01.05.2008 - 21:33
Re: copssh restart security problem

You can use the recipe above for copSSH versions 1.3.x and lower. Direct support for domain accounts will be introduced in the next release (no time schedule yet!).

Top
Topic locked

Release announcements

more