Install OpenSSH

Applies to Windows Server 2019, Windows 10

OpenSSH is a connectivity tool for remote login that uses the SSH protocol. It encrypts all traffic between client and server to eliminate eavesdropping, connection hijacking, and other attacks.

OpenSSH can be used to connect Window 10 clients to Windows Server 2019. OpenSSH Client is available to install on Windows 10 build 1809 and later, while OpenSSH Server is available to install on Windows Server 2019 and later.

If you downloaded OpenSSH from the GitHub repo at PowerShell/openssh-portable, follow the instructions listed there, not the ones in this article.

Install OpenSSH using Windows Settings

Both OpenSSH components can be installed using Windows Settings. OpenSSH Server is installed on Windows Server and OpenSSH Client is installed on Windows 10 devices.

To install the OpenSSH components:

Open Settings, select Apps > Apps & Features, then select Optional Features.

Scan the list to see if the OpenSSH is already installed. If not, at the top of the page, select Add a feature, then:

• On Windows 10, find OpenSSH Client, then click Install
• On Windows Server 2019, find OpenSSH Server, then click Install

Once setup completes, return to Apps > Apps & Features and Optional Features and you should see OpenSSH listed.

Installing OpenSSH Server will create and enable a firewall rule named OpenSSH-Server-In-TCP . This allows inbound SSH traffic on port 22. If this rule is not enabled and this port is not open, connections will be refused or reset.

Install OpenSSH using PowerShell

To install OpenSSH using PowerShell, run PowerShell as an Administrator. To make sure that OpenSSH is available, run the following cmdlet:

This should return the following output:

Then, install the server or client components as needed:

Both of these should return the following output:

Start and configure SSH Server

To start and configure OpenSSH server for initial use, open PowerShell as an administrator, then run the following commands to start the SSHD service :

Connect to SSH Server

Once installed, you can connect to OpenSSH Server from a Windows 10 device with the SSH client installed using PowerShell as follows. Be sure to run PowerShell as an administrator:

Once connected, you get a message similar to the following:

Selecting yes adds that server to the list of known ssh hosts on your Windows client.

You are prompted for the password at this point. As a security precaution, your password will not be displayed as you type.

Once connected, you will see the Windows command shell prompt:

Uninstall OpenSSH using Windows Settings

To uninstall OpenSSH using Windows Settings:

1. Open Settings, then go to Apps > Apps & Features.
2. Go to Optional Features.
3. In the list, select OpenSSH Client or OpenSSH Server.
4. Select Uninstall.

Uninstall OpenSSH using PowerShell

To uninstall the OpenSSH components using PowerShell, use the following commands:

You may need to restart Windows afterwards if the service was in use at the time it was uninstalled.

Руководство: SSH в Терминале Windows Tutorial: SSH in Windows Terminal

В Windows 10 встроен клиент SSH, который можно использовать в Терминале Windows. Windows 10 has a built-in SSH client that you can use in Windows Terminal.

В этом руководстве содержатся сведения о настройке профиля в Терминале Windows, использующем SSH. In this tutorial, you’ll learn how to set up a profile in Windows Terminal that uses SSH.

Создание профиля Create a profile

Вы можете запустить сеанс SSH в командной строке, выполнив ssh user@machine . После этого вам будет предложено ввести пароль. You can start an SSH session in your command prompt by executing ssh user@machine and you will be prompted to enter your password. Вы можете создать профиль Терминала Windows, выполняющий этот процесс при запуске, добавив параметр commandline в профиль в файле settings.json file. You can create a Windows Terminal profile that does this on startup by adding the commandline setting to a profile in your settings.json file.

Указание начального каталога Specify starting directory

Чтобы указать начальный каталог для сеанса SSH, вызываемого с помощью Терминала Windows, можно использовать следующую команду: To specify the starting directory for a ssh session invoked by Windows Terminal, you can use this command:

Флаг -t приводит к выделению псевдотерминала. The -t flag forces pseudo-terminal allocation. Эту возможность можно использовать для выполнения произвольных интерактивных программ на удаленном компьютере, например при реализации служб меню. This can be used to execute arbitrary screen-based programs on a remote machine, e.g. when implementing menu services. Вам потребуется использовать экранированные двойные кавычки, так как производные оболочки Bourne shell не выполняют дополнительную обработку строки в одинарных кавычках. You will need to use escaped double quotes as bourne shell derivatives don’t do any additional parsing for a string in single quotes.

Дополнительная информация: For more information, see:

How to use SSH keys with Windows on Azure

This article is for Windows users who want to create and use secure shell (SSH) keys to connect to Linux virtual machines (VMs) in Azure. You can also generate and store SSH keys in the Azure portal to use when creating VMs in the portal.

To use SSH keys from a Linux or macOS client, see the quick steps. For a more detailed overview of SSH, see Detailed steps: Create and manage SSH keys for authentication to a Linux VM in Azure.

Overview of SSH and keys

SSH is an encrypted connection protocol that allows secure sign-ins over unsecured connections. SSH is the default connection protocol for Linux VMs hosted in Azure. Although SSH itself provides an encrypted connection, using passwords with SSH still leaves the VM vulnerable to brute-force attacks. We recommend connecting to a VM over SSH using a public-private key pair, also known as SSH keys.

The public-private key pair is like the lock on your front door. The lock is exposed to the public, anyone with the right key can open the door. The key is private, and only given to people you trust because it can be used to unlock the door.

The public key is placed on your Linux VM when you create the VM.

The private key remains on your local system. Protect this private key. Do not share it.

When you connect to your Linux VM, the VM tests the SSH client to make sure it has the correct private key. If the client has the private key, it’s granted access to the VM.

Depending on your organization’s security policies, you can reuse a single key pair to access multiple Azure VMs and services. You do not need a separate pair of keys for each VM.

Your public key can be shared with anyone, but only you (or your local security infrastructure) should have access to your private key.

Supported SSH key formats

Azure currently supports SSH protocol 2 (SSH-2) RSA public-private key pairs with a minimum length of 2048 bits. Other key formats such as ED25519 and ECDSA are not supported.

SSH clients

Recent versions of Windows 10 include OpenSSH client commands to create and use SSH keys and make SSH connections from PowerShell or a command prompt. This is the easiest way to create an SSH connection to your Linux VM, from a Windows computer.

You can also use Bash in the Azure Cloud Shell to connect to your VM. You can use Cloud Shell in a web browser, from the Azure portal, or as a terminal in Visual Studio Code using the Azure Account extension.

You can also install the Windows Subsystem for Linux to connect to your VM over SSH and use other native Linux tools within a Bash shell.

Create an SSH key pair

Create an SSH key pair using the ssh-keygen command. Enter a filename, or use the default shown in parenthesis (for example C:\Users\username/.ssh/id_rsa ). Enter a passphrase for the file, or leave the passphrase blank if you do not want to use a passphrase.

Create a VM using your key

To create a Linux VM that uses SSH keys for authentication, provide your SSH public key when creating the VM.

Using the Azure CLI, you specify the path and filename for the public key using az vm create and the —ssh-key-value parameter.

With PowerShell, use New-AzVM and add the SSH key to the VM configuration using`. For an example, see Quickstart: Create a Linux virtual machine in Azure with PowerShell.

If you do a lot of deployments using the portal, you might want to upload your public key to Azure, where it can be easily selected when creating a VM from the portal. For more information, see Upload an SSH key.

Connect to your VM

With the public key deployed on your Azure VM, and the private key on your local system, SSH to your VM using the IP address or DNS name of your VM. Replace azureuser and 10.111.12.123 in the following command with the administrator user name, the IP address (or fully qualified domain name), and the path to your private key:

If you configured a passphrase when you created your key pair, enter the passphrase when prompted.

If the VM is using the just-in-time access policy, you need to request access before you can connect to the VM. For more information about the just-in-time policy, see Manage virtual machine access using the just in time policy.

Next steps

For information about SSH keys in the Azure portal, see Generate and store SSH keys in the Azure portal to use when creating VMs in the portal.

For detailed steps, options, and advanced examples of working with SSH keys, see Detailed steps to create SSH key pairs.

You can also use PowerShell in Azure Cloud Shell to generate SSH keys and make SSH connections to Linux VMs. See the PowerShell quickstart.

If you have difficulty using SSH to connect to your Linux VMs, see Troubleshoot SSH connections to an Azure Linux VM.

How To Use SSH Keys on Windows Clients (with PuTTY)

Using encrypted keys for authentication offers two main benefits. Firstly, it is convenient as you no longer need to enter a password (unless you encrypt your keys with password protection) if you use public/private keys. Secondly, once public/private key pair authentication has been set up on the server, you can disable password authentication completely meaning that without an authorized key you can’t gain access — so no more password cracking attempts.

It’s a relatively simple process to create a public/private key pair and install them for use on your ssh server.

Step 1: Download and Install PuTTY, PuTTYgen and Pageant

To get started, we’ll need to download and install both PuTTY (putty.exe), PuTTYgen (puttygen.exe) and Pageant (pageant.exe). You can find links to each of these at the project’s website. However, the easiest way to get both of the necessary programs is by downloading and installing the full .msi package, as pictured below:

Step 2: Generate the OpenSSH-compatible Keys with PuTTYgen

1. Start the PuTTYgen utility, by double-clicking on its .exe file or pressing the Windows key and searching for PuTTYgen
2. For Type of key to generate, select SSH-2 RSA
3. In the Number of bits in a generated key field, specify either 2048 or 4096 (increasing the bits makes it harder to crack the key by brute-force methods)
4. Click the Generate button
5. Move your mouse pointer around in the blank area of the Key section, below the progress bar (to generate some randomness) until the progress bar is full
6. A private/ public key pair has now been generated
7. In the Key comment field, enter any comment you’d like, to help you identify this key pair, later (e.g. your e-mail address; home; office; etc.) — the key comment is particularly useful in the event you end up creating more than one key pair
8. Optional: Type a passphrase in the Key passphrase field & re-type the same passphrase in the Confirm passphrase field (if you would like to use your keys for automated processes, however, you should notcreate a passphrase)
9. Click the Save public key button & choose whatever filename you’d like (some users create a folder in their computer named my_keys)
10. Click the Save private key button & choose whatever filename you’d like (you can save it in the same location as the public key, but it should be a location that only you can access and that you will NOT lose! If you lose your keys and have disabled username/password logins, you will no longer be able log in!)
11. Right-click in the text field labeled Public key for pasting into OpenSSH authorized_keys file and choose Select All
12. Right-click again in the same text field and choose Copy

NOTE: PuTTY and OpenSSH use different formats for public SSH keys. If the SSH Key you copied starts with «—- BEGIN SSH2 PUBLIC KEY . «, it is in the wrong format. Be sure to follow the instructions carefully. Your key should start with «ssh-rsa AAAA . «

Step 3: Save The Public Key On The Server

Now, you need log into your server via SSH as you normally would using PuTTY and paste the copied public key in the file

/.ssh/authorized_keys on your server.

If your SSH folder does not yet exist, create it manually:

Paste the SSH public key into your

/.ssh/authorized_keys file using the command-line text editor of your choice and save it.

Step 4: Create a PuTTY Profile to Save Your Server’s Settings

In PuTTY, you can create (and save) profiles for connections to your various SSH servers, so you don’t have to remember, and continually re-type, redundant information.

1. Start PuTTY by double-clicking its executable file or pressing the Windows key and searching for PuTTY
2. PuTTY’s initial window is the Session Category (navigate PuTTY’s various categories, along the left-hand side of the window)
3. In the Host Name field, enter the IP address of your server
4. Enter the port number in the Port field
5. Select SSH under Protocol;
6. Along the left-hand side of the window, select the Data sub-category, under Connection;
7. Specify the username that you plan on using, when logging in to the SSH server, and whose profile you’re saving, in the Auto-login username field;
8. Expand the SSH sub-category, under Connection;
9. Highlight the Auth sub-category and click the Browse button, on the right-hand side of the PuTTY window;
10. Browse your file system and select your previously-created private key;
11. Return to the Session Category and enter a name for this profile in theSaved Sessions field, e.g. user@12.34.56.78 or user@hostname;
12. Click the Save button for the Load, Save or Delete a stored session

Now you can log in to user@12.34.56.78 and you will not be prompted for a password. However, if you had set a passphrase on your public key, you will be asked to enter the passphrase at that time (and every time you log in, in the future).

Step 5 (Optional): Disable the Password for Root Login via SSH

Once you have copied your SSH keys unto your server and ensured that you can log in with the SSH keys alone, you can restrict the root login to only be permitted via SSH keys.

In order to do this, open up the /etc/ssh/sshd_config file:

Within that file, find the line that includes PermitRootLogin and modify it to ensure that users can only connect with their SSH key:

Alternatively, if you have configured sudo on your server and are configuring SSH keys for a sudo user, you can disable direct root access altogether: