![在 Windows OpenSSH 中使用多个匹配组](https://linux22.com/image/774166/%E5%9C%A8%20Windows%20OpenSSH%20%E4%B8%AD%E4%BD%BF%E7%94%A8%E5%A4%9A%E4%B8%AA%E5%8C%B9%E9%85%8D%E7%BB%84.png)
尝试配置 sshd_config 以根据您所属的 AD 组进行限制。目标是当您连接时,它会将 ChrootDirectory 设置为您有权访问的唯一目录。还要正确配置 Windows 中文件夹的权限。但是,如果我使用多个“匹配组”,则会收到“无效用户 user1 的密码失败”的信息。只要我注释掉其他“匹配组”,它就会起作用。
来自 sshd_config 的匹配组
AllowGroups "Domain\HBRobot-SFTP" "Domain\HBRobot-SFTP-FG" "Domain\HBRobot-SFTP-SF" "Domain\HBRobot-SFTP-Shared" "Domain\HBRobot-SFTP-MF"
#Main AD group to see all subfolders and files
Match Group Domain\HBRobot-SFTP
ChrootDirectory "D:\HB_RA_SFTPFileShare"
# AD group for FG reports folder
Match Group Domain\HBRobot-SFTP-FG
ChrootDirectory "D:\HB_RA_SFTPFileShare\FG"
#AD group for SF reports folder
Match Group Domain\HBRobot-SFTP-SF
ChrootDirectory "D:\HB_RA_SFTPFileShare\SF"
#AD group for Shared reports folder
Match Group Domain\HBRobot-SFTP-Shared
ChrootDirectory "D:\HB_RA_SFTPFileShare\Shared"
#AD group for MF reports folder
Match Group Domain\HBRobot-SFTP-MF
ChrootDirectory "D:\HB_RA_SFTPFileShare\MF"
这是我在日志中看到的内容:
1304 2022-01-19 14:09:21.010 debug1: userauth-request for user fuh0d9q service ssh-connection method none [preauth]
1304 2022-01-19 14:09:21.010 debug1: attempt 0 failures 0 [preauth]
1304 2022-01-19 14:09:21.057 debug1: user C:\\Users\\user1 matched group list Domain\\HBRobot-SFTP at line 37
1304 2022-01-19 14:09:21.073 debug1: get_passwd: LookupAccountName() failed: 1332.
1304 2022-01-19 14:09:21.073 debug1: Can't match group at line 41 because user n does not exist
1304 2022-01-19 14:09:21.183 debug1: get_passwd: LookupAccountName() failed: 1332.
1304 2022-01-19 14:09:21.183 debug1: Can't match group at line 45 because user n does not exist
1304 2022-01-19 14:09:21.417 debug1: get_passwd: LookupAccountName() failed: 1332.
1304 2022-01-19 14:09:21.417 debug1: Can't match group at line 49 because user n does not exist
1304 2022-01-19 14:09:21.605 debug1: get_passwd: LookupAccountName() failed: 1332.
1304 2022-01-19 14:09:21.605 debug1: Can't match group at line 53 because user n does not exist
1304 2022-01-19 14:09:21.636 debug1: userauth-request for user user1 service ssh-connection method keyboard-interactive [preauth]
1304 2022-01-19 14:09:21.636 debug1: attempt 1 failures 0 [preauth]
1304 2022-01-19 14:09:21.636 debug1: keyboard-interactive devs [preauth]
1304 2022-01-19 14:09:21.636 debug1: auth2_challenge: user=fuh0d9q devs= [preauth]
1304 2022-01-19 14:09:21.636 debug1: kbdint_alloc: devices '' [preauth]
1304 2022-01-19 14:09:26.699 debug1: userauth-request for user user1 service ssh-connection method password [preauth]
1304 2022-01-19 14:09:26.699 debug1: attempt 2 failures 1 [preauth]
1304 2022-01-19 14:09:26.699 debug1: Windows authentication failed for user: NOUSER domain: . error: 1326
1304 2022-01-19 14:09:26.699 Failed password for invalid user user1 from ***.**.***.** port 57106 ssh2
1304 2022-01-19 14:09:33.409 debug1: userauth-request for user user1 service ssh-connection method password [preauth]