Automated Cygwin installation on a Google VM

Automated Cygwin installation on a Google VM

[Nico Müller]

Hey everyone!

We are trying to set up an automated Cygwin install on a Windows
Server 2012 R2 VM in the Google cloud. The idea is to build a script
that makes sure Icinga is able to connect to the server via SSH, for
monitoring reasons.

Here is what we came up with:

---

# Cygwin installation + SSH setup
$file = "setup-x86_64.exe"
$url = "gs://cygwin/2.5.2/$($file)"
$output = "C:\Users\Public\Downloads\$($file)"

$localdir = "C:\cygwin_packages"
$rootdir = "C:\cygwin"
$mirror = "http://mirrors.kernel.org/sourceware/cygwin"
$packages = "openssh,vim,cygrunsrv"
$cyg_bash = "C:\cygwin\bin\bash.exe"

$cyg_pw_url = "xxx"
$cyg_password = Invoke-WebRequest -Uri $cyg_pw_url -UseBasicParsing
$cyg_password | Out-File "C:\Users\Public\cyg_server_password.txt"

$username = "icingaremote"
$ici_pw_url = "xxx"
$ici_password = Invoke-WebRequest -Uri $ici_pw_url -UseBasicParsing
$ici_password | Out-File "C:\Users\Public\icingaremote_password.txt"
$group = "Administrators"
$ssh_folder = "/home/$($username)/.ssh"
$key = "xxx"
$start_time = Get-Date

if (Test-Path $output) {
    Write-Output "Cygwin installer $($output) already exists"
}
else {
    gsutil cp $url $output
    Write-Output "Installing Cygwin..."
    Start-Process -FilePath $($output) -ArgumentList "-q -D -L -d -g
-o -s $($mirror) -l $($localdir) -R $($rootdir) -C Base -P
$($packages)" -Wait -PassThru

    Write-Host "Creating folders for SSH login..."
    Start-Process -FilePath $($cyg_bash) -ArgumentList "--login -c
'mkpasswd -l > /etc/passwd; mkdir -p $($ssh_folder); echo $($key) >
$($ssh_folder)/authorized_keys; chmod 700 $($ssh_folder); chmod 600
$($ssh_folder)/authorized_keys; chown -R $($username)
/home/$($username)/'" -Wait -PassThru

    Write-Output "Starting SSH configuration..."
    Start-Process -FilePath $($cyg_bash) -ArgumentList "--login -c
'ssh-host-config --yes --pwd $($cyg_password)'" -Wait

    $sshd_config_file = "C:\cygwin\etc\sshd_config"
    $acl = Get-Acl $sshd_config_file

    $rule = New-Object -TypeName
System.Security.AccessControl.FileSystemAccessRule("$($group)",
"Modify", "None", "None", "Allow")
    $acl.AddAccessRule($rule)
    Set-Acl $sshd_config_file $acl

    $sshd_config = Get-Content $sshd_config_file
    $sshd_config.Replace('#PasswordAuthentication yes',
'PasswordAuthentication no').Replace('#PubkeyAuthentication yes',
'PubkeyAuthentication yes') | Out-File -Encoding ascii -FilePath
$sshd_config_file -Force

    Start-Process -FilePath $($cyg_bash) -ArgumentList "--login -c
'cygrunsrv -S sshd'" -Wait

    Write-Output "Total time taken:
$((Get-Date).Subtract($start_time).Seconds) second(s)"
}

# Add Firewall exception for SSH
New-NetFirewallRule -Protocol TCP -LocalPort 22 -Direction Inbound
-Action Allow -DisplayName SSH -Program "C:\cygwin\usr\sbin\sshd.exe"

---

Which works fine, if you run it as a local administrator, but fails to
start the SSHD service properly, if you run it as a startup script,
because startup scripts are run as the local system user. The file
permissions end up in a very messed up state, if the script is run as
the local system user.

Seeing that the Google cloud and Icinga are nothing too exotic, is
there anyone, who tried the same setup and had success setting this up
or has some general hints on this matter?

Regards

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple