15. July 2012 17:22
My previous blog post on this subject is now out of date, mainly because the version of COPSSH that I used is no longer a free product. What follows is an updated guide, using bog-standard Cygwin to achieve the same results.
Note that this guide is largely given “by example”. The reader will very likely have to make changes to the names of paths and URLs to fit their own particular setup. It is also assumed that the reader is already familiar with Cygwin (or at least Unix) and of course, Windows Server 2008.
Setting up OpenSSH
Download and install Cygwin if you have not already done so. For our purposes, the only additional packages required are OpenSSH and Git. A text editor such as vim or mcedit is also useful. I installed mine to C:\cygwin.
Launch the Cygwin terminal (as administrator). Run the
ssh-host-config command to set up our SSH server. The following interactive dialog is then initiated. Be sure to answer ‘yes’ to use privilege separation, to create an sshd user, to install sshd as a service, and to create a privileged user cyg_server:
*** Info: Generating /etc/ssh_host_key
*** Info: Generating /etc/ssh_host_rsa_key
*** Info: Generating /etc/ssh_host_dsa_key
*** Info: Generating /etc/ssh_host_ecdsa_key
*** Info: Creating default /etc/ssh_config file
*** Info: Creating default /etc/sshd_config file
*** Info: Privilege separation is set to yes by default since OpenSSH 3.3.
*** Info: However, this requires a non-privileged account called 'sshd'.
*** Info: For more info on privilege separation read /usr/share/doc/openssh/README.privsep.
*** Query: Should privilege separation be used? (yes/no) yes
*** Info: Note that creating a new user requires that the current account have
*** Info: Administrator privileges. Should this script attempt to create a
*** Query: new local account 'sshd'? (yes/no) yes
*** Info: Updating /etc/sshd_config file
*** Query: Do you want to install sshd as a service?
*** Query: (Say "no" if it is already installed as a service) (yes/no) yes
*** Query: Enter the value of CYGWIN for the daemon: 
*** Info: On Windows Server 2003, Windows Vista, and above, the
*** Info: SYSTEM account cannot setuid to other users -- a capability
*** Info: sshd requires. You need to have or to create a privileged
*** Info: account. This script will help you do so.
*** Info: You appear to be running Windows XP 64bit, Windows 2003 Server,
*** Info: or later. On these systems, it's not possible to use the LocalSystem
*** Info: account for services that can change the user id without an
*** Info: explicit password (such as passwordless logins [e.g. public key
*** Info: authentication] via sshd).
*** Info: If you want to enable that functionality, it's required to create
*** Info: a new account with special privileges (unless a similar account
*** Info: already exists). This account is then used to run these special
*** Info: servers.
*** Info: Note that creating a new user requires that the current account
*** Info: have Administrator privileges itself.
*** Info: No privileged account could be found.
*** Info: This script plans to use 'cyg_server'.
*** Info: 'cyg_server' will only be used by registered services.
*** Query: Do you want to use a different name? (yes/no) no
*** Query: Create new privileged user account 'cyg_server'? (yes/no) yes
*** Info: Please enter a password for new user cyg_server. Please be sure
*** Info: that this password matches the password rules given on your system.
*** Info: Entering no password will exit the configuration.
*** Query: Please enter the password: XXXXX
*** Query: Reenter: XXXXX
*** Info: User 'cyg_server' has been created with password 'XXXXX'.
*** Info: If you change the password, please remember also to change the
*** Info: password for the installed services which use (or will soon use)
*** Info: the 'cyg_server' account.
*** Info: Also keep in mind that the user 'cyg_server' needs read permissions
*** Info: on all users' relevant files for the services running as 'cyg_server'.
*** Info: In particular, for the sshd server all users' .ssh/authorized_keys
*** Info: files must have appropriate permissions to allow public key
*** Info: authentication. (Re-)running ssh-user-config for each user will set
*** Info: these permissions correctly. [Similar restrictions apply, for
*** Info: instance, for .rhosts files if the rshd server is running, etc].
*** Info: The sshd service has been installed under the 'cyg_server'
*** Info: account. To start the service now, call `net start sshd' or
*** Info: `cygrunsrv -S sshd'. Otherwise, it will start automatically
*** Info: after the next reboot.
*** Info: Host configuration finished. Have fun!
(Optional) To disable root and password logins, add the following line to /etc/sshd_config:
(Optional) To allow only a specific user (or users) to connect, add the following line to /etc/sshd_config:
(Optional) To synchronize Windows user accounts with Cygwin, for example if a new Windows user was created:
mkpasswd -l > /etc/passwd
Start the service with
net start sshd.
Enabling public key authentication
It is advisable to use a standard Windows user account for SSH and Git access. For the rest of the guide I will assume we are using a user called ‘newuser’.
You may need to create a home and .ssh directory for newuser if they do not already exist:
mkdir -p /home/newuser/.ssh
chown -R newuser /home/newuser
Add your public key info to /home/newuser/.ssh/authorized_keys. If you need to create these and don’t know how, there are plenty of guides for using either PuTTYgen to achieve this.
Test that you can now log in via SSH. If not, make sure that the sshd service is running, your firewall is properly configured, and your user settings and keys are all correct.
Setting up Git
Log in to the remote server via SSH. If you can do this, most of the work is already done.
Create a new empty Git repository on the remote server. For example:
$ git init --bare ~/test.git
Initialized empty Git repository in /home/newuser/test.git/
If everything is set up correctly, cloning the remote repository should now work. For example, with my setup:
$ git clone ssh://firstname.lastname@example.org/home/newuser/test.git
Cloning into 'test'...
Enter passphrase for key '/home/Peter/.ssh/id_rsa':
warning: You appear to have cloned an empty repository.
Make a few additions and test pushing:
$ cd test/
$ echo hello > hello.txt
$ git add hello.txt
$ git commit -m "Test commit"
[master (root-commit) f465617] Test commit
1 files changed, 1 insertions(+), 0 deletions(-)
create mode 100644 hello.txt
$ git push origin master
Enter passphrase for key '/home/Peter/.ssh/id_rsa':
Counting objects: 3, done.
Writing objects: 100% (3/3), 223 bytes, done.
Total 3 (delta 0), reused 0 (delta 0)
* [new branch] master –> master
Auto-publishing a website
The idea is that we maintain a central bare Git repository and our website is a clone of this. We use the Git post-receive hook to automatically pull changes from the central repository to the website. Therefore, when we push changes from a remote client, these changes are automatically reflected in the website. In my setup, my bare Git repository is located in C:\inetpub\git\mysite.git and my wwwroot is located in C:\inetpub\wwwroot\mysite.peterdn.com.
Log in to the remote server via SSH. Create symbolic links to the git and wwwroot directories for convenience (remember we are in a cygwin environment here, and also make sure newuser has the required permissions on these directories):
ln -s /cygdrive/c/inetpub/git git
ln -s /cygdrive/c/inetpub/wwwroot wwwroot
The bare repository can now be accessed at ssh://email@example.com/home/newuser/git/mysite.git.
Ensure that your website clone has a remote that correctly points to the bare repository (cygwin path; the local remote is correct in this case):
$ cd ~/wwwroot/mysite.peterdn.com/
$ git remote -v
local /home/newuser/git/mysite.git (fetch)
local /home/newuser/git/mysite.git (push)
origin C:/inetpub/git/test.git (fetch)
origin C:/inetpub/git/test.git (push)
If not, add a new one. For example:
$ git remote add local /home/newuser/git/mysite.git
Add the following to the /home/newuser/git/mysite.git/hooks/post-receive script. This executes when a push is completed successfully. It is necessary to unset GIT_DIR so that git-pull uses the current working directory instead of the target git repository:
git pull local master