It should be:
SeAssignPrimaryTokenPrivilege -> UR:Replace a process level token

(UR:Impersonate a client after auth -> SeImpersonatePrivilege)

Sorry about that.

Had to map these permissions over to Group Policy, and figured others might need to know the mappings.
All setting are in Local Security Settings -> Local Policies -> User Rights (UR):

SeTcbPrivilege -> UR:Act as part of OS
SeAssignPrimaryTokenPrivilege -> UR:Impersonate a client after auth
SeCreateTokenPrivilege -> UR:Create a token object
SeDenyInteractiveLogonRight -> UR:Deny log on locally
SeDenyNetworkLogonRight -> UR:Deny Access to this computer from the network
SeDenyRemoteInteractiveLogonRight -> Deny login through TS
SeIncreaseQuotaPrivilege -> UR:Adjust memory quotas for a process
SeServiceLogonRight -> UR:Log on as a service

Cheers,
Phil

After running ssh-host-config , i had to open up Computer Manager / local user and groups and select properties for the sshd user and untick “disabled” and tick “password never expires”

After all that, i was getting the /bin/bash: Permission denied problem and found your page and run the following and then it all worked !!

editrights -a SeTcbPrivilege -u sshd
editrights -a SeAssignPrimaryTokenPrivilege -u sshd
editrights -a SeCreateTokenPrivilege -u sshd
editrights -a SeDenyInteractiveLogonRight -u sshd
editrights -a SeDenyNetworkLogonRight -u sshd
editrights -a SeDenyRemoteInteractiveLogonRight -u sshd
editrights -a SeIncreaseQuotaPrivilege -u sshd
editrights -a SeServiceLogonRight -u sshd

I would have never figured that out!

@Nicholas Fone: YES – the privileges may be overwritten by group policies pushed from the each Domain Controller. This mustn’t be caused by auditing software. Just check back with the Microsoft Infrastructure Admins of your company – they could even setup a domain user account to be used with the local sshd-installs for you (easier managemen: only one user for all sshd-installs instead of one local account on each sshd-enabled machine).

A privileged user is created by ssh-host-config, regardless of whether the answer to the “privilege separation” question is “yes” or “no”.

Cheers,
Nick

Cheers,
Nick

Btw, the list of privileges that the sshd_server user needs is defined in:
/usr/share/csih/cygwin-service-installation-helper.sh

The above script is called by the install script for sshd: ssh-host-config

I believe the privileges are only required if sshd is configured to use “privilege separation”, though it is most likely less secure to run sshd without “privilege separation”.

In our case, we suspect that some of the required privileges on the sshd_server user were being deleted periodically, perhaps by some “helpful” security auditing software, which is quite likely as we’re in a large corporate environment

Cheers,
Nick

clean. I’m very lucky to get this information from you.