mirror of
https://github.com/tailscale/tailscale.git
synced 2026-11-03 02:28:29 +09:00
Brad Fitzpatrick
547f371657
Add the Windows versions of the per-OS hooks and build the SSH server on Windows. As LocalSystem (the service), tailscaled logs the target user on with an S4U logon via util/winutil/s4u and runs the session process with that user's token, with pipes or, for PTYs, the s4u pseudoconsole relay. A non-LocalSystem tailscaled can only run sessions as itself. SFTP runs "tailscaled be-child sftp" as the user. The shell follows OpenSSH for Windows's DefaultShell registry value, else pwsh, Windows PowerShell, or cmd.exe. OpenSSH's host keys are reused when readable. Policy user names match Windows accounts case-insensitively; "=" treats LocalSystem and the built-in Administrator as root. Agent forwarding is not supported. TestTailscaleSSH in tstest/integration covers the same-user path on all platforms and, with --run-windows-service-tests, the S4U path. Updates #4697 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com> Change-Id: I9e3f1a7c5b2d4e6f8a0c2b4d6e8f1a3c5b7d9e2f