FAQs

The problem may be related to the potentially incompatible changes introduced in OpenSSH 6.7  (included in Copssh 5 and higher) to remove unsafe algorithms.

If you run Copssh 5.8.1 or higher, you can update the configuration via GUI:

• Alternatively, you can add following line to the section of the configuration file control/bin/copsshcp.config before starting Copssh Control Panel:

Ciphers=+aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc

• Restart the service via Copssh Control Panel

The problem can be related to address changes of Windows DLLs after a Windows update operation. That behaviour may create collisions for more static Cygwin DLLs, especially in a 32-bit environment. We suggest to reboot the system as a first measure. You may need to install Copssh again by using our recipe which allows to keep an existing configuration intact. Consider to install the 64-bit version (available only in the product edition) if the problem still persists.

 In some situations, it may be necessary to make a clean install to make an upgrade work. You can do it by following steps below:

• Backup your host keys in etc directory (etc/ssh_host*)
• Uninstall the existing version of Copssh
• Remove remnants of the installation directory except home directories if they exist
• Make sure that the service account and the sshd account are removed if they exist
• Install new Copssh
• Restore host keys back to etc directory
• Start Copssh Control Panel and verify that the service is running
• Activate your users again and specify their existing home directories as the home directory during the activation

• Sometimes it may be necessary to see directly how the openssh daemon reacts to startup or connection requests, to be able to locate daemon-related problems. 

   

  • Stop Openssh SSHD (system name:OpenSSHServer) service
  • Right click Start a Unix Bash Shell from Copssh start menu (assuming that you have admin privileges)
  • Enter the following command from the bash prompt:

  /bin/sshd -p <listening port> -D -d -e

  This will start openssh daemon in standalone debug mode and messages will be displayed on the screen. You may specify up to three -d for increased output verbosity.

  • Try to initate a putty session and watch messages at the server side.

• Some recommendations (not all of them can be applicable in your case, no sorting by importance):
   

  Recommendation	Benefits/Side effects	How
  Change port 22 to something non-standard	Reduces your vulnerability surface dramatically by taking a well-known parameter out of equation, not applicable if you have a general purpose server. Security by obscurity ? Yes. However, there are many script kiddies out there bombing port 22 wherever they find.	Conf.file etc\sshd_config: port
  Reduce the maximum number of concurrent unauthenticated con- nections	Reduces your vulnerability surface by allowing a smaller number of potentialy dangerous attacks simultaneously.	Conf.file etc\sshd_config: MaxStartups (default 10)
  Turn off authentication by password. Use public key authentication instead.	Eliminates the most widely used technique of potential attacks: cracking passwords.	Conf.file etc\sshd_config: PasswordAuthentication no PubkeyAuthentication (default yes)
  Restrict access by host	Use your firewall setting to limit hosts authorized for access
  Restrict access by user/group		Conf.file etc\sshd_config: AllowUsers AllowGroups

• **UPDATED** Copssh Control Panel introduced in version 4 has solved that problem. Previous Copssh versions and copsshadm command line tool still have that problem.

  This is a known error related to the localized names of the groups administrators and users. There is no solution yet. However, You can use the workaround below:

  •  Rename localized equivalents of the groups administrators and users to something readable in latin (can be done via Administrative Tools->Computer Management->Local Users and Groups for example)
  • Run copssh installer
  • Rename the groups above back to their original values.

Activate a user and create a PKA key pair with empty passphrase via Copssh control panel:

• You can take your private key with you and initiate passwordless connections from other machines. An example to start ssh shell:

ssh -i my.key user@copssh_host

NB! Your private key is NOT protected by a passphrase and can be used by anyone. Keep it safe!

Copssh versions 7 and higher use local system account as the service account and no further adjustments are necessary.

However, you may still prefer to use a dedicated service account (domain account for example). Make sure that the service account is member of local  Administrators group and have following user rights:

SeCreateTokenPrivilege

SeAssignPrimaryTokenPrivilege

SeIncreaseQuotaPrivilege

SeServiceLogonRight

Tools to set user rights: Domain Group Policy Management for domain members, Local Security Policy (secpol.msc) for local computers