Skip to content

Commit 92326c0

Browse files
tgauthtgauth
authored
Enable redirection guard during service setup (#808)
* add RedirectionGuard to installer * add RedirectionGuard to install script
1 parent 783c343 commit 92326c0

File tree

3 files changed

+56
-0
lines changed

3 files changed

+56
-0
lines changed

‎contrib/win32/install/server.wxs‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,10 @@
11
<Wix xmlns="http://schemas.microsoft.com/wix/2006/wi" xmlns:firewall="http://schemas.microsoft.com/wix/FirewallExtension" xmlns:util="http://schemas.microsoft.com/wix/UtilExtension">
22
<Fragment>
3+
<!-- Registry search to check if key for RedirectionGuard exists -->
4+
<Property Id="SSHDREGKEYEXISTS">
5+
<RegistrySearch Id="SearchSSHDRegKey" Root="HKLM" Key="SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sshd.exe" Name="MitigationOptions" Type="raw" />
6+
</Property>
7+
38
<!-- KeyPath is necessary for multi-file components to identify the key file - preferrably versioned. -->
49
<ComponentGroup Id="Server" Directory="INSTALLFOLDER">
510
<ComponentGroupRef Id="Shared" />
@@ -62,6 +67,13 @@
6267
<PermissionEx Sddl="O:BAG:SYD:PAI(A;;FA;;;SY)(A;;FA;;;BA)" />
6368
</File>
6469
</Component>
70+
<!-- Permanent registry component - will persist through uninstall -->
71+
<Component Id="SSHDInstallFlagComponent" Guid="*" Permanent="yes">
72+
<Condition><![CDATA[NOT SSHDREGKEYEXISTS]]></Condition>
73+
<RegistryKey Root="HKLM" Key="SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sshd.exe" ForceCreateOnInstall="yes">
74+
<RegistryValue Name="MitigationOptions" Type="binary" Value="00000000000000000000000000000000000010" KeyPath="yes" />
75+
</RegistryKey>
76+
</Component>
6577
</ComponentGroup>
6678

6779
<!-- Automatically add custom actions if referencing the Server component group. -->

‎contrib/win32/install/shared.wxs‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,10 @@
11
<Wix xmlns="http://schemas.microsoft.com/wix/2006/wi" xmlns:util="http://schemas.microsoft.com/wix/UtilExtension">
22
<Fragment>
3+
<!-- Registry search to check if key for RedirectionGuard exists -->
4+
<Property Id="AGENTREGKEYEXISTS">
5+
<RegistrySearch Id="SearchAgentRegKey" Root="HKLM" Key="SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ssh-agent.exe" Name="MitigationOptions" Type="raw" />
6+
</Property>
7+
38
<!-- KeyPath is necessary for multi-file components to identify the key file - preferrably versioned. -->
49
<ComponentGroup Id="Shared" Directory="INSTALLFOLDER">
510
<Component>
@@ -68,6 +73,13 @@
6873
Stop="both"
6974
Remove="uninstall" />
7075
</Component>
76+
<!-- Permanent registry component - will persist through uninstall -->
77+
<Component Id="AgentInstallFlagComponent" Guid="*" Permanent="yes">
78+
<Condition><![CDATA[NOT AGENTREGKEYEXISTS]]></Condition>
79+
<RegistryKey Root="HKLM" Key="SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ssh-agent.exe" ForceCreateOnInstall="yes">
80+
<RegistryValue Name="MitigationOptions" Type="binary" Value="00000000000000000000000000000000000010" KeyPath="yes" />
81+
</RegistryKey>
82+
</Component>
7183
</ComponentGroup>
7284

7385
<!-- Automatically add custom actions if referencing the Shared component group. -->

‎contrib/win32/openssh/install-sshd.ps1‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -89,6 +89,38 @@ if (Test-Path $sshAgentRegPath)
8989
Set-Acl $sshAgentRegPath $sshAgentAcl
9090
}
9191

92+
# Create MitigationOptions registry key if it doesn't exist for RedirectionGuard
93+
$sshdMitigationRegPath = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sshd.exe"
94+
if (-not (Test-Path $sshdMitigationRegPath)) {
95+
New-Item -Path $sshdMitigationRegPath -Force | Out-Null
96+
Write-Host "Created registry key: $sshdMitigationRegPath"
97+
}
98+
99+
# Check if MitigationOptions value exists
100+
$mitigationValue = Get-ItemProperty -Path $sshdMitigationRegPath -Name "MitigationOptions" -ErrorAction SilentlyContinue
101+
if (-not $mitigationValue) {
102+
# Create binary value: 19 bytes with 0x10 at the end (RedirectionGuard mitigation)
103+
$binaryData = [byte[]](0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x10)
104+
New-ItemProperty -Path $sshdMitigationRegPath -Name "MitigationOptions" -PropertyType Binary -Value $binaryData -Force | Out-Null
105+
Write-Host "Created registry value for sshd.exe to enable RedirectionGuard"
106+
}
107+
108+
# Create MitigationOptions registry key if it doesn't exist for RedirectionGuard
109+
$agentMitigationRegPath = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ssh-agent.exe"
110+
if (-not (Test-Path $agentMitigationRegPath)) {
111+
New-Item -Path $agentMitigationRegPath -Force | Out-Null
112+
Write-Host "Created registry key: $agentMitigationRegPath"
113+
}
114+
115+
# Check if MitigationOptions value exists
116+
$mitigationValue = Get-ItemProperty -Path $agentMitigationRegPath -Name "MitigationOptions" -ErrorAction SilentlyContinue
117+
if (-not $mitigationValue) {
118+
# Create binary value: 19 bytes with 0x10 at the end (RedirectionGuard mitigation)
119+
$binaryData = [byte[]](0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x10)
120+
New-ItemProperty -Path $agentMitigationRegPath -Name "MitigationOptions" -PropertyType Binary -Value $binaryData -Force | Out-Null
121+
Write-Host "Created registry value for ssh-agent.exe to enable RedirectionGuard"
122+
}
123+
92124
#Fix permissions for moduli file
93125
$moduliPath = Join-Path $PSScriptRoot "moduli"
94126
if (Test-Path $moduliPath -PathType Leaf)

0 commit comments

Comments
 (0)