Windows SSH Server - kamack38/Essentials GitHub Wiki

Install OpenSSH Server and Client

Using PowerShell

Add-WindowsCapability -Online -Name OpenSSH.Client~~~~0.0.1.0
Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0

OR using Chocolatey

choco install openssh --pre

Setup server

# Start service
Start-Service *sshd*

# OPTIONAL but recommended:
Set-Service -Name sshd -StartupType 'Automatic'

# Confirm the firewall rule is configured. It should be created automatically by setup.
Get-NetFirewallRule -Name *ssh*

# There should be a firewall rule named "OpenSSH-Server-In-TCP", which should be enabled
# If the firewall does not exist, create one
New-NetFirewallRule -Name sshd -DisplayName 'OpenSSH Server (sshd)' -Enabled True -Direction Inbound -Protocol TCP -Action Allow -LocalPort 22

Connecting to your server

ssh user@your_ipv4

You can get your IPV4 by using ipconfig command or use this :

(Get-NetIPAddress | Where-Object {$_.AddressFamily -eq 'IPv4' -and $_.PrefixOrigin -eq 'Dhcp' }).IPAddress

Notice: It may not work for you

Setup key-based authentication

Generating an SSH Key

ssh-keygen -b 2048 -t rsa

Deploying the public key

Standard user

If ssh host is standard user place your Public Key in ~\.ssh\authorized_keys You can also do this with a command :

scp C:\Users\username\.ssh\id_rsa.pub user1@domain1:C:\Users\username\.ssh\authorized_keys

Administrative user

The contents of your public key ~\.ssh\id_rsa.pub) needs to be placed on the server into a text file called administrators_authorized_keys in C:\ProgramData\ssh\. The ACL on this file needs to be configured to only allow access to administrators and System.

Add line to C:\ProgramData\ssh\sshd_config :

Match Group administratorzy
  AuthorizedKeysFile __PROGRAMDATA__/ssh/administrators_authorized_keys

Place your Public Key into C:\ProgramData\ssh\administrators_authorized_keys. Then setup permissions.

icacls.exe "C:\ProgramData\ssh\administrators_authorized_keys" /inheritance:r /grant "Administratorzy:F" /grant "SYSTEM:F"
Restart-Service *sshd*