New Government-Furnished Equipment (GFE) users cannot use Git Bash to reach the AWS EC2 development instance via the localhost:2222 tunnel. This document describes the verified, PowerShell-only success path that reproduces the same working SSH connection using only tools present by default on a standard GFE Windows 11 image — no installs, no admin, no Git for Windows.

If you follow the four steps in Onboarding Steps you will end up with a working ssh AWS_EC2_tmcg_ps command from powershell.exe.

The established workflow uses a Git Bash alias:

ssh AWS_EC2_tmcg   # works reliably in Git Bash / MSYS OpenSSH 10.2p1

New GFE users do not have Git for Windows installed and are not permitted to install it. Their only shells are:

The only SSH client they have is the Windows-bundled OpenSSH:

C:\Windows\System32\OpenSSH\ssh.exe
OpenSSH_for_Windows_9.5p2, LibreSSL 3.8.2

This client differs from Git Bash's MSYS ssh in subtle ways (see Client Differences) that break the existing .ssh/config alias for some users.

The exact failure reported by affected users could not be reproduced on the reference machine used to author this guide. Rather than block on capturing the failure, we verified a known-good PowerShell path end-to-end so that new users have a deterministic recipe to follow. If a user still fails after completing every step here, they should capture the output of Diagnostic: capture full failure log and share it for triage.

Assumed present, no admin needed:

• C:\Windows\System32\OpenSSH\ssh.exe (SSH client)
• C:\Windows\System32\OpenSSH\ssh-keygen.exe (keypair generator)
• powershell.exe (Windows PowerShell 5.1)
• icacls.exe
• %USERPROFILE% writable (typically C:\Users\<username>)

Assumed already established out of band (not covered here):

• The localhost:2222 tunnel to the EC2 bastion is running on the user's machine (e.g., via AWS SSM start-session --document-name AWS-StartPortForwardingSession, or an equivalent mechanism). Verify with:

  Test-NetConnection -ComputerName localhost -Port 2222 -InformationLevel Detailed

  You need TcpTestSucceeded : True.

• The remote EC2 host is running OpenSSH and has a user account matching the User value used below (default in this guide: terry.mcguinness).

All commands are pasted into a powershell.exe window (Start Menu → "Windows PowerShell" — not ISE).

The private key is written to %USERPROFILE%\.ssh\id_ed25519_ec2test and locked down to the owner via NTFS ACL. If the file already exists, the script aborts to avoid overwriting.

Save the following as gen-ec2-test-key.ps1 (or paste it directly):

$ErrorActionPreference = 'Stop'

$sshDir  = Join-Path $env:USERPROFILE '.ssh'
$keyFile = Join-Path $sshDir 'id_ed25519_ec2test'

if (-not (Test-Path $sshDir)) {
    New-Item -ItemType Directory -Path $sshDir | Out-Null
    Write-Host "[created] $sshDir"
} else {
    Write-Host "[exists]  $sshDir"
}

if (Test-Path $keyFile) {
    Write-Host "[abort]   $keyFile already exists - remove it or pick another name"
    exit 1
}

Write-Host "---- generating Ed25519 keypair ----"
$comment = "ec2-test-$env:USERNAME"
& 'C:\Windows\System32\OpenSSH\ssh-keygen.exe' `
    -t ed25519 `
    -f $keyFile `
    -N '""' `
    -C $comment

if ($LASTEXITCODE -ne 0) {
    Write-Host "[error]   ssh-keygen exited with code $LASTEXITCODE"
    exit $LASTEXITCODE
}

Write-Host "`n---- locking down NTFS ACL (owner only) ----"
icacls $keyFile /inheritance:r | Out-Null
icacls $keyFile /grant:r "$($env:USERNAME):F" | Out-Null
icacls $keyFile

Write-Host "`n===== PUBLIC KEY (paste into remote ~/.ssh/authorized_keys) ====="
Get-Content "$keyFile.pub"
Write-Host "================================================================="
Write-Host "`nPrivate key: $keyFile"
Write-Host "Public key : $keyFile.pub"

Run it:

powershell.exe -NoProfile -ExecutionPolicy Bypass -File .\gen-ec2-test-key.ps1

Expected tail of output — the public key line to hand off:

===== PUBLIC KEY (paste into remote ~/.ssh/authorized_keys) =====
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5... ec2-test-<yourusername>
=================================================================

Note on the passphrase: this test key is intentionally passphrase-less. Windows OpenSSH's ssh-agent service is Disabled by default on GFE and cannot be started without admin, so a passphrase-protected key would require typing the passphrase on every connection. The NTFS ACL applied above restricts read access to the owner (plus SYSTEM and Administrators, which Windows OpenSSH tolerates), providing at-rest protection roughly equivalent to a Linux 600-perm key.

Send the single ssh-ed25519 AAAA... ec2-test-<username> line to whoever administers the remote EC2 account. They will append it to ~/.ssh/authorized_keys for the target Linux user (e.g., terry.mcguinness).

Do not send the private key (the file without the .pub extension) to anyone or paste it anywhere.

Open (or create) %USERPROFILE%\.ssh\config and append the following block. In PowerShell:

$cfg = Join-Path $env:USERPROFILE '.ssh\config'
$block = @"

Host AWS_EC2_tmcg_ps
    HostName localhost
    Port 2222
    User terry.mcguinness
    IdentityFile ~/.ssh/id_ed25519_ec2test
    IdentitiesOnly yes
    StrictHostKeyChecking no
    UserKnownHostsFile NUL
"@
Add-Content -Path $cfg -Value $block

Field-by-field rationale:

Non-interactive test (runs exit on the remote and comes back):

& 'C:\Windows\System32\OpenSSH\ssh.exe' -v AWS_EC2_tmcg_ps exit

Interactive test (drops you into a shell on the EC2 host):

ssh AWS_EC2_tmcg_ps

Expected success markers in the -v output:

OpenSSH_for_Windows_9.5p2, LibreSSL 3.8.2
debug1: Reading configuration data C:\Users\<user>/.ssh/config
debug1: C:\Users\<user>/.ssh/config line NN: Applying options for AWS_EC2_tmcg_ps
debug1: Connecting to localhost [::1] port 2222.
debug1: Connection established.
debug1: identity file C:\Users\<user>/.ssh/id_ed25519_ec2test type 3
...
debug1: Offering public key: ...id_ed25519_ec2test ED25519 SHA256:... explicit
debug1: Server accepts key: ...id_ed25519_ec2test ED25519 SHA256:... explicit
Authenticated to localhost ([::1]:2222) using "publickey".
...
debug1: Exit status 0

If you see Authenticated to localhost ([::1]:2222) using "publickey" and Exit status 0, you are done.

Understanding these avoids future confusion when copying ~/.ssh/config snippets between shells.

The two config directives in the legacy AWS_EC2_tmcg block that are Unix-isms (IdentityFile ~/.ssh/id_rsa and UserKnownHostsFile /dev/null) happen to work on the reference machine but are replaced here with cross-compatible equivalents (IdentitiesOnly yes for determinism, UserKnownHostsFile NUL for portability).

Run this in the user's PowerShell window and share the resulting file:

& 'C:\Windows\System32\OpenSSH\ssh.exe' -v AWS_EC2_tmcg_ps exit 2>&1 |
    Tee-Object -FilePath "$env:USERPROFILE\ssh-fail.log"

# 1. Which ssh will be used?
Get-Command ssh | Format-List Source, Version
ssh -V

# 2. Does the config file exist and contain the alias?
Test-Path "$env:USERPROFILE\.ssh\config"
Get-Content "$env:USERPROFILE\.ssh\config" |
    Select-String -Pattern 'AWS_EC2_tmcg_ps' -Context 0,7

# 3. Does the private key exist? What is its ACL?
$key = "$env:USERPROFILE\.ssh\id_ed25519_ec2test"
Test-Path $key
if (Test-Path $key) { icacls $key }

# 4. Is the local tunnel listening?
Test-NetConnection -ComputerName localhost -Port 2222 -InformationLevel Detailed

The legacy AWS_EC2_tmcg alias intentionally coexists with the new AWS_EC2_tmcg_ps alias so Git Bash users can continue using the RSA key while PowerShell-only users adopt the Ed25519 key. Neither interferes with the other. Once all users have migrated, the old block can be retired or updated to use the same portable directives.

The success path in this document was validated against: