With Microsoft OpenSSH server for Windows, how do we quote space characters in forced commands in the authorized_keys file?

Binarus

7/7/23, 9:40 AM

We have setup Microsoft's implementation of OpenSSH server on a Windows server 2019 (v1809) and have activated authentication based on public keys. We would like to deploy forced commands and are struggling with space characters in the path of such commands.

A minimal example:

User user1 has the following authorized_keys file:

command="C:\Program Files\SomePath\SomeProgram.exe" ssh-ed25519 AAAAC3N...

When we try to ssh into that machine as that user, the following happens:

$ ssh -i <user1_key_id> user1@server.example.com

'C:\Program' is not recognized as an internal or external command,
operable program or batch file.
Connection to server.example.com closed.

(Please note that we have an SSH agent running so that there is no passphrase query in the above terminal session snippet.)

IMHO, it's quite clear that the problem is due to the space character in the path of the program which should be executed. However, we are unsure why the double quotes around the command in the authorized_keys file don't prevent the problem. We have tried to add a further pair of double quotes using the well-known escaping methods:

command="\"C:\Program Files\SomePath\SomeProgram.exe\"" ...

command="^"C:\Program Files\SomePath\SomeProgram.exe^"" ...
command="""C:\Program Files\SomePath\SomeProgram.exe""" ...

The first one lead to the same error as described above. The second one and the third one lead to another error message:

user1@server.example.com: Permission denied (publickey).

Now we are stuck and have the following question:

How do we need to write the command above in the authorized_key files for Microsoft OpenSSH server for Windows?

0 + 0

ssh

windows-server-2019

Score:1

Server

Phill W.

7/7/23, 10:11 AM

The command to be executed is the whole line after the "command=" moniker.

Quotes are required to protect the spaces in your executable's path on the target server.
Quotes in the authorized_keys file need to be escaped with backslashes:

So, it should look something like this:

command=\"C:\Program Files\SomePath\SomeProgram.exe\" ssh-ed25519 AAAAC3N...

0 + 0

Binarus

7/7/23, 11:15 AM

Thank you very much, and +1. However, this leads to the `permission denied` error described in my original post ...

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: With Microsoft OpenSSH server for Windows, how do we quote space characters in forced commands in the authorized_keys file?

TH: ด้วยเซิร์ฟเวอร์ Microsoft OpenSSH สำหรับ Windows เราจะอ้างอิงอักขระช่องว่างในคำสั่งบังคับในไฟล์ Authorized_keys ได้อย่างไร

RO: Cu serverul Microsoft OpenSSH pentru Windows, cum cităm caracterele de spațiu în comenzile forțate din fișierul authorized_keys?

RU: С сервером Microsoft OpenSSH для Windows, как мы заключаем в кавычки символы пробела в принудительных командах в файле author_keys?

VI: Với máy chủ Microsoft OpenSSH dành cho Windows, làm cách nào để chúng tôi trích dẫn các ký tự khoảng trắng trong các lệnh bắt buộc trong tệp ủy quyền?

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.