Windows/SSH

Enable SSH

Check installed (powershell):

Get-WindowsCapability -Online | Where-Object Name -like 'OpenSSH.Server*'
Get-WindowsCapability -Online | Where-Object Name -like 'OpenSSH.Client*'

Install service (powershell):

Add-WindowsCapability -Online -Name OpenSSH.Server*
Add-WindowsCapability -Online -Name OpenSSH.Client*

# Windows Server 2022:
Add-WindowsCapability -Online -Name OpenSSH.ServerKenneth (talk) 18:35, 17 July 2026 (UTC)0.0.1.0
Add-WindowsCapability -Online -Name OpenSSH.ClientKenneth (talk) 18:35, 17 July 2026 (UTC)0.0.1.0

Verify Service:

Get-Service sshd

Check if is set to auto start: (does not by default)

Get-Service sshd | Select-Object Name, Status, StartType

Set SSH Service to Start Automatically: (Optional)

Set-Service -Name sshd -StartupType 'Automatic'

Start service (powershell): (as needed)

Start-Service sshd

Stop-Service sshd

Restart-Service sshd

Enable Firewall Rule (powershell): (as needed)

# check firewall rule - should have been auto created
Get-NetFirewallRule -Name "OpenSSH-Server-In-TCP"

# if need to create a new one:
New-NetFirewallRule -Name sshd -DisplayName 'OpenSSH Server (sshd)' -Enabled True -Direction Inbound -Protocol TCP -Action Allow -LocalPort 22

References:

• How to SSH into Windows 10 or 11? - https://gist.github.com/teocci/5a96568ab9bf93a592d7a1a237ebb6ea
• Setting Up SSH Server and Opening Port 22 on Windows | by Liliane Konissi | Medium - https://medium.com/@lilnya79/setting-up-ssh-server-and-opening-port-22-on-windows-ff9f324823b7

Chocolatey

Set-ExecutionPolicy Bypass -Scope Process -Force
[System.Net.ServicePointManager]::SecurityProtocol = 3072
iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1'))


$env:chocolateyUseWindowsCompression = 'true'
choco install -y openssh -params '"/SSHServerFeature"'

Config

C:\ProgramData\ssh

C:\ProgramData\ssh\sshd_config ::
 AuthorizedKeysFile	.ssh/authorized_keys

This line causes the user's .ssh/authorized_keys file to be ignored, if they are in the Administrators group:

Match Group administrators
       AuthorizedKeysFile __PROGRAMDATA__/ssh/administrators_authorized_keys

To fix this, comment out these "Matched" lines, then run:

Restart-Service sshd

SSH Keys

For standard users:

%USERPROFILE%/.ssh/authorized_keys

For users who are administrators, they must put their keys in

C:\ProgramData\ssh\administrators_authorized_keys

%PROGRAMDATA%\ssh\administrators_authorized_keys
%ALLUSERSPROFILE%\ssh\administrators_authorized_keys

Fix the permissions with Powershell:

$acl = Get-Acl C:\ProgramData\ssh\administrators_authorized_keys
$acl.SetAccessRuleProtection($true, $false)
$administratorsRule = New-Object system.security.accesscontrol.filesystemaccessrule("Administrators","FullControl","Allow")
$systemRule = New-Object system.security.accesscontrol.filesystemaccessrule("SYSTEM","FullControl","Allow")
$acl.SetAccessRule($administratorsRule)
$acl.SetAccessRule($systemRule)
$acl | Set-Acl

ref: https://www.concurrency.com/blog/may-2019/key-based-authentication-for-openssh-on-windows

Ansible

- name: Install openssh
  win_chocolatey:
    name: openssh
    package_params: /SSHServerFeature
    state: present
  tags: openssh

ref: https://curiousdba.netlify.app/post/windowsopenssh/