mirror of
https://github.com/tailscale/tailscale.git
synced 2026-11-02 18:19:43 +09:00
Brad Fitzpatrick
547f371657
Add the Windows versions of the per-OS hooks and build the SSH server on Windows. As LocalSystem (the service), tailscaled logs the target user on with an S4U logon via util/winutil/s4u and runs the session process with that user's token, with pipes or, for PTYs, the s4u pseudoconsole relay. A non-LocalSystem tailscaled can only run sessions as itself. SFTP runs "tailscaled be-child sftp" as the user. The shell follows OpenSSH for Windows's DefaultShell registry value, else pwsh, Windows PowerShell, or cmd.exe. OpenSSH's host keys are reused when readable. Policy user names match Windows accounts case-insensitively; "=" treats LocalSystem and the built-in Administrator as root. Agent forwarding is not supported. TestTailscaleSSH in tstest/integration covers the same-user path on all platforms and, with --run-windows-service-tests, the S4U path. Updates #4697 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com> Change-Id: I9e3f1a7c5b2d4e6f8a0c2b4d6e8f1a3c5b7d9e2f
33 lines
785 B
Go
33 lines
785 B
Go
// Copyright (c) Tailscale Inc & contributors
|
|
// SPDX-License-Identifier: BSD-3-Clause
|
|
|
|
//go:build (linux && !android) || (darwin && !ios) || freebsd || openbsd || plan9 || windows
|
|
|
|
package tailssh
|
|
|
|
import (
|
|
"os/user"
|
|
|
|
"tailscale.com/util/osuser"
|
|
)
|
|
|
|
// userMeta is a wrapper around *user.User with extra fields.
|
|
type userMeta struct {
|
|
user.User
|
|
|
|
// loginShellCached is the user's login shell, if known
|
|
// at the time of userLookup.
|
|
loginShellCached string
|
|
}
|
|
|
|
// userLookup is like os/user.Lookup but it returns a *userMeta wrapper
|
|
// around a *user.User with extra fields.
|
|
func userLookup(username string) (*userMeta, error) {
|
|
u, s, err := osuser.LookupByUsernameWithShell(username)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
return &userMeta{User: *u, loginShellCached: s}, nil
|
|
}
|