v9.4.0.0p1 and later enforce permissions on the logs folder, leading to undiagnosable crashes of the service after Windows Update #2282

Prerequisites

• Write a descriptive title.
• Make sure you are able to repro it on the latest version
• Search the existing issues.

Steps to reproduce

• Have OpenSSH working as a service
• Update OpenSSH via Windows Updates from something older than v9.4.0.0p1 to something newer
• Have the service fail to start because you had somehow created a logs folder at C:\ProgramData\ssh\logs without extremely locked down permissions (I'm unable to confirm this right now, but it could have even been created by running sshd.exe as a user, not as a service)

Expected behavior

• Service fails to start with a log message anywhere at all saying why
• Or service starts anyways
• Or this requirement for the logs folder to also have locked down permissions is documented somewhere, at least at https://github.com/PowerShell/Win32-OpenSSH/wiki/Security-protection-of-various-files-in-Win32-OpenSSH
  • To be fair I figured this out because of the patch notes for v9.4.0.0p1 say

    the sshd service will check the $env:ProgramData\ssh folder permissions upon startup to ensure only SYSTEM and Administrator accounts have write access to the folder; similar to the existing check upon install in contrib\win32\openssh\install-sshd.ps1.

  • And because of the PR add check for prog data folder permissions during sshd service startup openssh-portable#686

Actual behavior

• Service fails to start with error 1067: The process terminated unexpectedly
• No logs show up in Event Viewer indicating why
• Troubleshooting as per https://github.com/PowerShell/Win32-OpenSSH/wiki/Troubleshooting-Steps does not show any issues, sshd runs fine with psexec -s sshd.exe -d
• It only gets fixed by either running the full install-ssh.ps1 or by doing rm C:\ProgramData\ssh\logs (and thus depending on the parent folder to have proper permissions)

Solutions

• Validate that the issue is undiagnosable by running psexec -s sshd.exe -d successfully
• Run the full install-ssh.ps1
  or
• Run rm C:\ProgramData\ssh\logs (and thus depending on the parent folder to have proper permissions)

Error details

No response

Environment data

$PSVersionTable 

Name                           Value
----                           -----
PSVersion                      7.3.5
PSEdition                      Core
GitCommitId                    7.3.5
OS                             Microsoft Windows 10.0.20348
Platform                       Win32NT
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1
WSManStackVersion              3.0

Version

OpenSSH_for_Windows_9.5p1

Visuals

No response