Repository: PowerShell/Win32-OpenSSH

Issue #1543: AD user cannot be authenticated by Key when sshd server is running by system(Password works), but key auth is working for user if user starts openssh by himeself with  .\sshd.exe -d
Created: 2020-01-22T13:30:32Z
"OpenSSH for Windows" version
((Get-Item (Get-Command sshd).Source).VersionInfo.FileVersion)
PS C:\Program Files\OpenSSH> ((Get-Item (Get-Command ./sshd).Source).VersionInfo.FileVersion)
8.1.0.0
Server OperatingSystem
((Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows nt\CurrentVersion\" -Name ProductName).ProductName)
Windows Server 2016 Standard
Client OperatingSystem
Linux/Windows - same issue
What is failing
Public key authentication/unable to get security token for AD user (local user, working fine)
Similar issue #1053
Expected output
Successful logon
Actual output
Client output from Linux
~/.ssh$ ssh -vvv -o "IdentitiesOnly=yes" -i ./test_key p986_bfr228384_t@10.39.14.133
OpenSSH_7.4p1, OpenSSL 1.0.2k-fips  26 Jan 2017
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 58: Applying options for *
debug2: resolving "10.39.14.133" port 22
debug2: ssh_connect_direct: needpriv 0
debug1: Connecting to 10.39.14.133 [10.39.14.133] port 22.
debug1: Connection established.
debug1: key_load_public: No such file or directory
debug1: identity file ./test_key type -1
debug1: key_load_public: No such file or directory
debug1: identity file ./test_key-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_7.4
debug1: Remote protocol version 2.0, remote software version OpenSSH_for_Windows_8.1
debug1: match: OpenSSH_for_Windows_8.1 pat OpenSSH* compat 0x04000000
debug2: fd 3 setting O_NONBLOCK
debug1: Authenticating to 10.39.14.133:22 as 'p986_bfr228384_t'
debug3: hostkeys_foreach: reading file "/home/user/.ssh/known_hosts"
debug3: record_hostkey: found key type ECDSA in file /home/user/.ssh/known_hosts:1
debug3: load_hostkeys: loaded 1 keys from 10.39.14.133
debug3: hostkeys_foreach: reading file "/etc/ssh/ssh_known_hosts"
debug3: order_hostkeyalgs: prefer hostkeyalgs: ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521
debug3: send packet: type 20
debug1: SSH2_MSG_KEXINIT sent
debug3: receive packet: type 20
debug1: SSH2_MSG_KEXINIT received
debug2: local client KEXINIT proposal
debug2: KEX algorithms: curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c
debug2: host key algorithms: ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss
debug2: ciphers ctos: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc,aes192-cbc,aes256-cbc
debug2: ciphers stoc: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc,aes192-cbc,aes256-cbc
debug2: MACs ctos: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: MACs stoc: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: compression ctos: none,zlib@openssh.com,zlib
debug2: compression stoc: none,zlib@openssh.com,zlib
debug2: languages ctos:
debug2: languages stoc:
debug2: first_kex_follows 0
debug2: reserved 0
debug2: peer server KEXINIT proposal
debug2: KEX algorithms: curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1
debug2: host key algorithms: rsa-sha2-512,rsa-sha2-256,ssh-rsa,ecdsa-sha2-nistp256,ssh-ed25519
debug2: ciphers ctos: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com
debug2: ciphers stoc: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com
debug2: MACs ctos: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: MACs stoc: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
debug2: compression ctos: none,zlib@openssh.com
debug2: compression stoc: none,zlib@openssh.com
debug2: languages ctos:
debug2: languages stoc:
debug2: first_kex_follows 0
debug2: reserved 0
debug1: kex: algorithm: curve25519-sha256
debug1: kex: host key algorithm: ecdsa-sha2-nistp256
debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC:  compression: none
debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC:  compression: none
debug1: kex: curve25519-sha256 need=64 dh_need=64
debug1: kex: curve25519-sha256 need=64 dh_need=64
debug3: send packet: type 30
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug3: receive packet: type 31
debug1: Server host key: ecdsa-sha2-nistp256 SHA256:vDYx8dsScX3udfisVBrsouI4rXY+aeIFR1rGDJQXSYs
debug3: hostkeys_foreach: reading file "/home/user/.ssh/known_hosts"
debug3: record_hostkey: found key type ECDSA in file /home/user/.ssh/known_hosts:1
debug3: load_hostkeys: loaded 1 keys from 10.39.14.133
debug3: hostkeys_foreach: reading file "/etc/ssh/ssh_known_hosts"
debug1: Host '10.39.14.133' is known and matches the ECDSA host key.
debug1: Found key in /home/user/.ssh/known_hosts:1
debug3: send packet: type 21
debug2: set_newkeys: mode 1
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug3: receive packet: type 21
debug1: SSH2_MSG_NEWKEYS received
debug2: set_newkeys: mode 0
debug1: rekey after 134217728 blocks
debug2: key: ./test_key ((nil)), explicit
debug3: send packet: type 5
debug3: receive packet: type 7
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_input_ext_info: server-sig-algs=<ssh-ed25519,ssh-rsa,rsa-sha2-256,rsa-sha2-512,ssh-dss,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521>
debug3: receive packet: type 6
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug3: send packet: type 50
debug3: receive packet: type 51
debug1: Authentications that can continue: publickey,keyboard-interactive
debug3: start over, passed a different list publickey,keyboard-interactive
debug3: preferred gssapi-keyex,gssapi-with-mic,publickey,keyboard-interactive,password
debug3: authmethod_lookup publickey
debug3: remaining preferred: keyboard-interactive,password
debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
debug1: Trying private key: ./test_key
debug3: sign_and_send_pubkey: RSA SHA256:6P8yS+E6ak3VE1X+em/tc9lFCFgsvxrwHLNzzcvvWhw
debug3: send packet: type 50
debug2: we sent a publickey packet, wait for reply
debug3: receive packet: type 52
debug1: Authentication succeeded (publickey).
Authenticated to 10.39.14.133 ([10.39.14.133]:22).
debug1: channel 0: new [client-session]
debug3: ssh_session2_open: channel_new: 0
debug2: channel 0: send open
debug3: send packet: type 90
debug1: Requesting no-more-sessions@openssh.com
debug3: send packet: type 80
debug1: Entering interactive session.
debug1: pledge: network
debug3: send packet: type 1
packet_write_wait: Connection to 10.39.14.133 port 22: Broken pipe
Sshd log in windows server:
8836 2020-01-22 14:09:28.750 debug2: fd 3 setting O_NONBLOCK
8836 2020-01-22 14:09:28.750 debug1: Bind to port 22 on 0.0.0.0.
8836 2020-01-22 14:09:28.750 Server listening on 0.0.0.0 port 22.
8836 2020-01-22 14:09:34.280 debug3: fd 4 is not O_NONBLOCK
8836 2020-01-22 14:09:34.283 debug3: spawning "C:\Program Files\OpenSSH\sshd.exe" -R
8836 2020-01-22 14:09:34.292 debug3: send_rexec_state: entering fd = 7 config len 274
8836 2020-01-22 14:09:34.293 debug3: ssh_msg_send: type 0
8836 2020-01-22 14:09:34.293 debug3: send_rexec_state: done
9112 2020-01-22 14:09:34.331 debug1: inetd sockets after dupping: 4, 4
9112 2020-01-22 14:09:34.332 Connection from 10.39.34.155 port 33824 on 10.39.14.133 port 22
9112 2020-01-22 14:09:34.332 debug1: Local version string SSH-2.0-OpenSSH_for_Windows_8.1
9112 2020-01-22 14:09:34.332 debug1: Remote protocol version 2.0, remote software version OpenSSH_7.4
9112 2020-01-22 14:09:34.332 debug1: match: OpenSSH_7.4 pat OpenSSH_7.0*,OpenSSH_7.1*,OpenSSH_7.2*,OpenSSH_7.3*,OpenSSH_7.4*,OpenSSH_7.5*,OpenSSH_7.6*,OpenSSH_7.7* compat 0x04000002
9112 2020-01-22 14:09:34.332 debug2: fd 4 setting O_NONBLOCK
9112 2020-01-22 14:09:34.357 debug3: spawning "C:\Program Files\OpenSSH\sshd.exe" -y
9112 2020-01-22 14:09:34.367 debug2: Network child is on pid 4524
9112 2020-01-22 14:09:34.367 debug3: send_rexec_state: entering fd = 6 config len 274
9112 2020-01-22 14:09:34.367 debug3: ssh_msg_send: type 0
9112 2020-01-22 14:09:34.367 debug3: send_rexec_state: done
9112 2020-01-22 14:09:34.367 debug3: ssh_msg_send: type 0
9112 2020-01-22 14:09:34.367 debug3: ssh_msg_send: type 0
9112 2020-01-22 14:09:34.367 debug3: preauth child monitor started
9112 2020-01-22 14:09:34.406 debug1: list_hostkey_types: rsa-sha2-512,rsa-sha2-256,ssh-rsa,ecdsa-sha2-nistp256,ssh-ed25519 [preauth]
9112 2020-01-22 14:09:34.406 debug3: send packet: type 20 [preauth]
9112 2020-01-22 14:09:34.406 debug1: SSH2_MSG_KEXINIT sent [preauth]
9112 2020-01-22 14:09:34.406 debug3: receive packet: type 20 [preauth]
9112 2020-01-22 14:09:34.406 debug1: SSH2_MSG_KEXINIT received [preauth]
9112 2020-01-22 14:09:34.406 debug2: local server KEXINIT proposal [preauth]
9112 2020-01-22 14:09:34.406 debug2: KEX algorithms: curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1 [preauth]
9112 2020-01-22 14:09:34.406 debug2: host key algorithms: rsa-sha2-512,rsa-sha2-256,ssh-rsa,ecdsa-sha2-nistp256,ssh-ed25519 [preauth]
9112 2020-01-22 14:09:34.406 debug2: ciphers ctos: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com [preauth]
9112 2020-01-22 14:09:34.406 debug2: ciphers stoc: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com [preauth]
9112 2020-01-22 14:09:34.406 debug2: MACs ctos: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1 [preauth]
9112 2020-01-22 14:09:34.406 debug2: MACs stoc: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1 [preauth]
9112 2020-01-22 14:09:34.406 debug2: compression ctos: none,zlib@openssh.com [preauth]
9112 2020-01-22 14:09:34.406 debug2: compression stoc: none,zlib@openssh.com [preauth]
9112 2020-01-22 14:09:34.406 debug2: languages ctos:  [preauth]
9112 2020-01-22 14:09:34.406 debug2: languages stoc:  [preauth]
9112 2020-01-22 14:09:34.406 debug2: first_kex_follows 0  [preauth]
9112 2020-01-22 14:09:34.406 debug2: reserved 0  [preauth]
9112 2020-01-22 14:09:34.406 debug2: peer client KEXINIT proposal [preauth]
9112 2020-01-22 14:09:34.406 debug2: KEX algorithms: curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,ext-info-c [preauth]
9112 2020-01-22 14:09:34.406 debug2: host key algorithms: ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss [preauth]
9112 2020-01-22 14:09:34.406 debug2: ciphers ctos: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc,aes192-cbc,aes256-cbc [preauth]
9112 2020-01-22 14:09:34.407 debug2: ciphers stoc: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc,aes192-cbc,aes256-cbc [preauth]
9112 2020-01-22 14:09:34.407 debug2: MACs ctos: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1 [preauth]
9112 2020-01-22 14:09:34.407 debug2: MACs stoc: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1 [preauth]
9112 2020-01-22 14:09:34.407 debug2: compression ctos: none,zlib@openssh.com,zlib [preauth]
9112 2020-01-22 14:09:34.407 debug2: compression stoc: none,zlib@openssh.com,zlib [preauth]
9112 2020-01-22 14:09:34.407 debug2: languages ctos:  [preauth]
9112 2020-01-22 14:09:34.407 debug2: languages stoc:  [preauth]
9112 2020-01-22 14:09:34.407 debug2: first_kex_follows 0  [preauth]
9112 2020-01-22 14:09:34.407 debug2: reserved 0  [preauth]
9112 2020-01-22 14:09:34.407 debug1: kex: algorithm: curve25519-sha256 [preauth]
9112 2020-01-22 14:09:34.407 debug1: kex: host key algorithm: ecdsa-sha2-nistp256 [preauth]
9112 2020-01-22 14:09:34.407 debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC:  compression: none [preauth]
9112 2020-01-22 14:09:34.407 debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC:  compression: none [preauth]
9112 2020-01-22 14:09:34.407 debug1: expecting SSH2_MSG_KEX_ECDH_INIT [preauth]
9112 2020-01-22 14:09:34.409 debug3: receive packet: type 30 [preauth]
9112 2020-01-22 14:09:34.412 debug3: mm_sshkey_sign entering [preauth]
9112 2020-01-22 14:09:34.412 debug3: mm_request_send entering: type 6 [preauth]
9112 2020-01-22 14:09:34.412 debug3: mm_sshkey_sign: waiting for MONITOR_ANS_SIGN [preauth]
9112 2020-01-22 14:09:34.412 debug3: mm_request_receive_expect entering: type 7 [preauth]
9112 2020-01-22 14:09:34.412 debug3: mm_request_receive entering [preauth]
9112 2020-01-22 14:09:34.412 debug3: mm_request_receive entering
9112 2020-01-22 14:09:34.412 debug3: monitor_read: checking request 6
9112 2020-01-22 14:09:34.412 debug3: mm_answer_sign
9112 2020-01-22 14:09:34.414 debug3: mm_answer_sign: KEX signature 000002059233A450(100)
9112 2020-01-22 14:09:34.414 debug3: mm_request_send entering: type 7
9112 2020-01-22 14:09:34.414 debug2: monitor_read: 6 used once, disabling now
9112 2020-01-22 14:09:34.415 debug3: send packet: type 31 [preauth]
9112 2020-01-22 14:09:34.415 debug3: send packet: type 21 [preauth]
9112 2020-01-22 14:09:34.415 debug2: set_newkeys: mode 1 [preauth]
9112 2020-01-22 14:09:34.415 debug1: rekey out after 134217728 blocks [preauth]
9112 2020-01-22 14:09:34.415 debug1: SSH2_MSG_NEWKEYS sent [preauth]
9112 2020-01-22 14:09:34.415 debug1: Sending SSH2_MSG_EXT_INFO [preauth]
9112 2020-01-22 14:09:34.415 debug3: send packet: type 7 [preauth]
9112 2020-01-22 14:09:34.415 debug1: expecting SSH2_MSG_NEWKEYS [preauth]
9112 2020-01-22 14:09:34.418 debug3: receive packet: type 21 [preauth]
9112 2020-01-22 14:09:34.418 debug1: SSH2_MSG_NEWKEYS received [preauth]
9112 2020-01-22 14:09:34.418 debug2: set_newkeys: mode 0 [preauth]
9112 2020-01-22 14:09:34.418 debug1: rekey in after 134217728 blocks [preauth]
9112 2020-01-22 14:09:34.418 debug1: KEX done [preauth]
9112 2020-01-22 14:09:34.469 debug3: receive packet: type 5 [preauth]
9112 2020-01-22 14:09:34.469 debug3: send packet: type 6 [preauth]
9112 2020-01-22 14:09:34.470 debug3: receive packet: type 50 [preauth]
9112 2020-01-22 14:09:34.470 debug1: userauth-request for user p986_bfr228384_t service ssh-connection method none [preauth]
9112 2020-01-22 14:09:34.470 debug1: attempt 0 failures 0 [preauth]
9112 2020-01-22 14:09:34.470 debug3: mm_getpwnamallow entering [preauth]
9112 2020-01-22 14:09:34.470 debug3: mm_request_send entering: type 8 [preauth]
9112 2020-01-22 14:09:34.470 debug3: mm_getpwnamallow: waiting for MONITOR_ANS_PWNAM [preauth]
9112 2020-01-22 14:09:34.470 debug3: mm_request_receive_expect entering: type 9 [preauth]
9112 2020-01-22 14:09:34.470 debug3: mm_request_receive entering [preauth]
9112 2020-01-22 14:09:34.470 debug3: mm_request_receive entering
9112 2020-01-22 14:09:34.470 debug3: monitor_read: checking request 8
9112 2020-01-22 14:09:34.470 debug3: mm_answer_pwnamallow
9112 2020-01-22 14:09:34.471 debug2: parse_server_config: config reprocess config len 274
9112 2020-01-22 14:09:34.472 debug3: mm_answer_pwnamallow: sending MONITOR_ANS_PWNAM: 1
9112 2020-01-22 14:09:34.472 debug3: mm_request_send entering: type 9
9112 2020-01-22 14:09:34.472 debug2: monitor_read: 8 used once, disabling now
9112 2020-01-22 14:09:34.473 debug2: input_userauth_request: setting up authctxt for p986_bfr228384_t [preauth]
9112 2020-01-22 14:09:34.473 debug3: mm_inform_authserv entering [preauth]
9112 2020-01-22 14:09:34.473 debug3: mm_request_send entering: type 4 [preauth]
9112 2020-01-22 14:09:34.473 debug2: input_userauth_request: try method none [preauth]
9112 2020-01-22 14:09:34.473 debug3: mm_request_receive entering
9112 2020-01-22 14:09:34.473 debug3: monitor_read: checking request 4
9112 2020-01-22 14:09:34.473 debug3: mm_answer_authserv: service=ssh-connection, style=
9112 2020-01-22 14:09:34.473 debug2: monitor_read: 4 used once, disabling now
9112 2020-01-22 14:09:34.473 debug3: user_specific_delay: user specific delay 0.000ms [preauth]
9112 2020-01-22 14:09:34.473 debug3: ensure_minimum_time_since: elapsed 2.994ms, delaying 5.730ms (requested 8.724ms) [preauth]
9112 2020-01-22 14:09:34.479 debug3: userauth_finish: failure partial=0 next methods="publickey,keyboard-interactive" [preauth]
9112 2020-01-22 14:09:34.479 debug3: send packet: type 51 [preauth]
9112 2020-01-22 14:09:34.483 debug3: receive packet: type 50 [preauth]
9112 2020-01-22 14:09:34.483 debug1: userauth-request for user p986_bfr228384_t service ssh-connection method publickey [preauth]
9112 2020-01-22 14:09:34.483 debug1: attempt 1 failures 0 [preauth]
9112 2020-01-22 14:09:34.483 debug2: input_userauth_request: try method publickey [preauth]
9112 2020-01-22 14:09:34.483 debug2: userauth_pubkey: valid user p986_bfr228384_t attempting public key rsa-sha2-512 AAAAB3NzaC1yc2EAAAADAQABAAABgQDNvi2KZKqBzzKPeOj/tId5gtEancCFISa2LUYvEiF7AiPUX670WfEY1CjwNfacbDmF8YqlmUoEhOIkAo6rOnkQb3427KcW3uInnNG1KR3UH3Hy2vppcU23YyCmfoQT4yZwjzc4lZHR8t5u6jSxm51BTWbli2qXI65VFg+I/i5guiwGa8jBBrqfMjTOolEU2yxccb0gliavcg/yE6fa+ZYhBke3rwo6Y/I3Ao8H8WdMn23u0hXTJWw7mKRnUtKQGd4e0+g5PIS10w9l7ZHnq1txEKjBcwlcHWMJUxUVrxoPrjbbXoT2B22SbR7ijpYW5VvgXiS8pIvy2pbytGP4e1acElDiTTJF72veDdwFkD12MFiUkFZvDR7ifLHE2BWh0AhKyy2uY6lCl+qOFTRmzJxWpsQqk0G8mk9ocq9hP2IebXaRQEsKedrvnMe5gwOiknID91naL87tl71ELEfp+zNnQ28iEQLRqgf9PtGH3Wc4U9zuIO/+bhZiIPuOFdJda8U= [preauth]
9112 2020-01-22 14:09:34.483 debug3: userauth_pubkey: have rsa-sha2-512 signature for RSA SHA256:6P8yS+E6ak3VE1X+em/tc9lFCFgsvxrwHLNzzcvvWhw [preauth]
9112 2020-01-22 14:09:34.483 debug3: mm_key_allowed entering [preauth]
9112 2020-01-22 14:09:34.483 debug3: mm_request_send entering: type 22 [preauth]
9112 2020-01-22 14:09:34.483 debug3: mm_key_allowed: waiting for MONITOR_ANS_KEYALLOWED [preauth]
9112 2020-01-22 14:09:34.483 debug3: mm_request_receive_expect entering: type 23 [preauth]
9112 2020-01-22 14:09:34.483 debug3: mm_request_receive entering [preauth]
9112 2020-01-22 14:09:34.483 debug3: mm_request_receive entering
9112 2020-01-22 14:09:34.483 debug3: monitor_read: checking request 22
9112 2020-01-22 14:09:34.483 debug3: mm_answer_keyallowed entering
9112 2020-01-22 14:09:34.483 debug3: mm_answer_keyallowed: key_from_blob: 00000205922B7E10
9112 2020-01-22 14:09:34.483 debug1: trying public key file C:\Users\p986_bfr228384_t\.ssh/authorized_keys
9112 2020-01-22 14:09:34.485 debug1: C:\Users\p986_bfr228384_t\.ssh/authorized_keys:1: matching key found: RSA SHA256:6P8yS+E6ak3VE1X+em/tc9lFCFgsvxrwHLNzzcvvWhw
9112 2020-01-22 14:09:34.485 debug1: C:\Users\p986_bfr228384_t\.ssh/authorized_keys:1: key options: agent-forwarding port-forwarding pty user-rc x11-forwarding
9112 2020-01-22 14:09:34.485 Accepted key RSA SHA256:6P8yS+E6ak3VE1X+em/tc9lFCFgsvxrwHLNzzcvvWhw found at C:\Users\p986_bfr228384_t\.ssh/authorized_keys:1
9112 2020-01-22 14:09:34.485 debug3: mm_answer_keyallowed: publickey authentication: RSA key is allowed
9112 2020-01-22 14:09:34.485 debug3: mm_request_send entering: type 23
9112 2020-01-22 14:09:34.485 debug3: mm_sshkey_verify entering [preauth]
9112 2020-01-22 14:09:34.485 debug3: mm_request_send entering: type 24 [preauth]
9112 2020-01-22 14:09:34.485 debug3: mm_request_receive entering
9112 2020-01-22 14:09:34.485 debug3: monitor_read: checking request 24
9112 2020-01-22 14:09:34.485 debug3: mm_answer_keyverify: publickey 0000020592325720 signature verified
9112 2020-01-22 14:09:34.485 debug1: auth_activate_options: setting new authentication options
9112 2020-01-22 14:09:34.485 debug3: mm_request_send entering: type 25
9112 2020-01-22 14:09:34.486 Accepted publickey for p986_bfr228384_t from 10.39.34.155 port 33824 ssh2: RSA SHA256:6P8yS+E6ak3VE1X+em/tc9lFCFgsvxrwHLNzzcvvWhw
9112 2020-01-22 14:09:34.486 debug1: monitor_child_preauth: p986_bfr228384_t has been authenticated by privileged process
9112 2020-01-22 14:09:34.486 debug3: mm_get_keystate: Waiting for new keys
9112 2020-01-22 14:09:34.486 debug3: mm_request_receive_expect entering: type 26
9112 2020-01-22 14:09:34.486 debug3: mm_request_receive entering
9112 2020-01-22 14:09:34.492 debug3: mm_get_keystate: GOT new keys
9112 2020-01-22 14:09:34.492 debug3: mm_sshkey_verify: waiting for MONITOR_ANS_KEYVERIF [preauth]
9112 2020-01-22 14:09:34.492 debug3: mm_request_receive_expect entering: type 25 [preauth]
9112 2020-01-22 14:09:34.492 debug3: mm_request_receive entering [preauth]
9112 2020-01-22 14:09:34.492 debug1: auth_activate_options: setting new authentication options [preauth]
9112 2020-01-22 14:09:34.492 debug2: userauth_pubkey: authenticated 1 pkalg rsa-sha2-512 [preauth]
9112 2020-01-22 14:09:34.492 debug3: user_specific_delay: user specific delay 0.000ms [preauth]
9112 2020-01-22 14:09:34.492 debug3: ensure_minimum_time_since: elapsed 2.994ms, delaying 5.730ms (requested 8.724ms) [preauth]
9112 2020-01-22 14:09:34.492 debug3: send packet: type 52 [preauth]
9112 2020-01-22 14:09:34.492 debug3: mm_request_send entering: type 26 [preauth]
9112 2020-01-22 14:09:34.492 debug3: mm_send_keystate: Finished sending state [preauth]
9112 2020-01-22 14:09:34.495 debug1: monitor_read_log: child log fd closed
9112 2020-01-22 14:09:34.577 debug3: lookup_principal_name: Successfully discovered explicit principal name: 'domain\p986_bfr228384_t'=>'p986_bfr228384_t@domain'
9112 2020-01-22 14:09:34.595 debug1: generate_s4u_user_token: LsaLogonUser() failed. User 'domain\p986_bfr228384_t' Status: 0xC000006D SubStatus 0.
9112 2020-01-22 14:09:34.595 debug3: get_user_token - unable to generate token for user domain\p986_bfr228384_t
9112 2020-01-22 14:09:39.135 debug3: lookup_principal_name: Successfully discovered explicit principal name: 'domain\p986_bfr228384_t'=>'p986_bfr228384_t@domain'
9112 2020-01-22 14:09:39.145 debug1: generate_s4u_user_token: LsaLogonUser() failed. User 'domain\p986_bfr228384_t' Status: 0xC000006D SubStatus 0.
9112 2020-01-22 14:09:39.145 error: get_user_token - unable to generate token on 2nd attempt for user domain\p986_bfr228384_t
9112 2020-01-22 14:09:39.145 error: unable to get security token for user domain\p986_bfr228384_t
9112 2020-01-22 14:09:39.145 fatal: fork of unprivileged child failed
9112 2020-01-22 14:09:39.145 debug1: do_cleanup
Log when running with user .\sshd.exe -d
debug1: sshd version OpenSSH_for_Windows_8.1, LibreSSL 2.9.2
debug1: get_passwd: LookupAccountName() failed: 1332.
debug1: private host key #0: ssh-rsa SHA256:jHHFr8IYn3RXO6cfngtaQLKmm0Sf6gDZzM4dVbp6LHQ
debug1: private host key #1: ecdsa-sha2-nistp256 SHA256:vDYx8dsScX3udfisVBrsouI4rXY+aeIFR1rGDJQXSYs
debug1: private host key #2: ssh-ed25519 SHA256:nP1DtEduD42OqXY+6drE3bsv9yrWmlo96hPIx2kI4eQ
debug1: rexec_argv[0]='C:\Program Files\OpenSSH\sshd.exe'
debug1: rexec_argv[1]='-d'
debug1: Bind to port 22 on 0.0.0.0.
Server listening on 0.0.0.0 port 22.
debug1: Server will not fork when running in debugging mode.
Connection from 10.39.34.155 port 34412 on 10.39.14.133 port 22
debug1: Local version string SSH-2.0-OpenSSH_for_Windows_8.1
debug1: Remote protocol version 2.0, remote software version OpenSSH_7.4
debug1: match: OpenSSH_7.4 pat OpenSSH_7.0*,OpenSSH_7.1*,OpenSSH_7.2*,OpenSSH_7.3*,OpenSSH_7.4*,OpenSSH_7.5*,OpenSSH_7.6*,OpenSSH_7.7* compat 0x04000002
debug1: list_hostkey_types: rsa-sha2-512,rsa-sha2-256,ssh-rsa,ecdsa-sha2-nistp256,ssh-ed25519 [preauth]
debug1: SSH2_MSG_KEXINIT sent [preauth]
debug1: SSH2_MSG_KEXINIT received [preauth]
debug1: kex: algorithm: curve25519-sha256 [preauth]
debug1: kex: host key algorithm: ecdsa-sha2-nistp256 [preauth]
debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC:  compression: none [preauth]
debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC:  compression: none [preauth]
debug1: expecting SSH2_MSG_KEX_ECDH_INIT [preauth]
debug1: rekey out after 134217728 blocks [preauth]
debug1: SSH2_MSG_NEWKEYS sent [preauth]
debug1: Sending SSH2_MSG_EXT_INFO [preauth]
debug1: expecting SSH2_MSG_NEWKEYS [preauth]
debug1: SSH2_MSG_NEWKEYS received [preauth]
debug1: rekey in after 134217728 blocks [preauth]
debug1: KEX done [preauth]
debug1: userauth-request for user p986_bfr228384_t service ssh-connection method none [preauth]
debug1: attempt 0 failures 0 [preauth]
debug1: userauth-request for user p986_bfr228384_t service ssh-connection method publickey [preauth]
debug1: attempt 1 failures 0 [preauth]
debug1: trying public key file C:\Users\p986_bfr228384_t\.ssh/authorized_keys
debug1: C:\Users\p986_bfr228384_t\.ssh/authorized_keys:1: matching key found: RSA SHA256:6P8yS+E6ak3VE1X+em/tc9lFCFgsvxrwHLNzzcvvWhw
debug1: C:\Users\p986_bfr228384_t\.ssh/authorized_keys:1: key options: agent-forwarding port-forwarding pty user-rc x11-forwarding
Accepted key RSA SHA256:6P8yS+E6ak3VE1X+em/tc9lFCFgsvxrwHLNzzcvvWhw found at C:\Users\p986_bfr228384_t\.ssh/authorized_keys:1
debug1: auth_activate_options: setting new authentication options
Accepted publickey for p986_bfr228384_t from 10.39.34.155 port 34412 ssh2: RSA SHA256:6P8yS+E6ak3VE1X+em/tc9lFCFgsvxrwHLNzzcvvWhw
debug1: monitor_child_preauth: p986_bfr228384_t has been authenticated by privileged process
debug1: auth_activate_options: setting new authentication options [preauth]
debug1: monitor_read_log: child log fd closed
debug1: Not running as SYSTEM: skipping loading user profile
User child is on pid 12444

Duplicate issue #1476: get_passwd: LookupAccountName() failed: 1332.
Created: 2019-10-06T19:52:48Z
"OpenSSH for Windows" version
((Get-Item (Get-Command sshd).Source).VersionInfo.FileVersion)
7.7.2.2
Server OperatingSystem
((Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows nt\CurrentVersion\" -Name ProductName).ProductName)
Windows 10 Enterprise
Client OperatingSystem
Windows 10 build 1903
What is failing
I cannot ssh into my machine. I've set this up before, but this time my laptop is not domain-joined, but instead AAD-joined (Intune managed), which seems to be part of the problem from what information I could find about LookupAccountName and error 1332.
My sshd_config is nearly default. I set PasswordAuthentication to no, but apart from that (and temporarily logging DEBUG3 server output), nothing else is different.
From the debug log, I see:
10276 2019-10-06 12:32:39.152 debug1: get_passwd: LookupAccountName() failed: 1332.
10276 2019-10-06 12:32:39.152 debug2: parse_server_config: config reprocess config len 336
10276 2019-10-06 12:32:39.152 debug3: checking match for 'Group administrators' user heaths host fe80::6c5d:4766:1774:b485%16 addr fe80::6c5d:4766:1774:b485%16 laddr fe80::6c5d:4766:1774:b485%16 lport 22
10276 2019-10-06 12:32:39.152 debug1: get_passwd: LookupAccountName() failed: 1332.
10276 2019-10-06 12:32:39.152 debug1: Can't match group at line 84 because user heaths does not exist
10276 2019-10-06 12:32:39.152 debug3: match not found

My $ProgramData\ssh\administrators_authorized_keys contains my public key, as does my ~.ssh\authorized_keys. icacls shows appropriate ownership and DACLs.
Basically, everything is set up as I've done before except that I'm not domain joined (normally do, but was having some unrelated problems setting up a new machine).
Expected output
I can log in via ssh.
Actual output
I'm denied access.

Closing comment (2021-03-29T22:21:17Z): Related to
#1543