Following are setup steps for OpenSSH shipped with Windows 10 v.1803 (April 2018 update. See comments to this post, it might not work with 1809).
Server setup (elevated powershell):
- Install OpenSSH server:
Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0.
- Start agent and sshd services:
Start-Service ssh-agent; Start-Service sshd(this will generate host keys and default configuration automatically in
- [Optional] Install OpenSSHUtils powershell module:
Install-Module -Force OpenSSHUtils
Client setup (non-elevated powershell):
- Generate user key:
cd $env:USERPROFILE\.ssh; ssh-keygen.exe, follow prompts, agree to the default suggested file location. This will create 2 files:
- [Optional] add key to authentication agent, so you don’t have to enter password each time you use it:
ssh-add .\id_rsa(or whatever file was generated);
Server setup continued (non-elevated powershell):
- Log in as a user, for which public key auth to be used
cd $env:USERPROFILE; mkdir .ssh; cd .ssh; New-Item authorized_keys;
- Paste the contents of the
id_rsa.pubfile from the client to the
.ssh\authorized_keysfile from the previous step.
- Setup permissions properly (important!!!):
start .to open explorer with the current folder (
- Right click
authorized_keys, go to
Properties -> Security -> Advanced
- Click «Disable inheritance»;
- Choose «Convert inherited permissions into explicit permissions on this object» when prompted;
- (really, really important) Remove all permissions on file except for the
SYSTEMand yourself. There must be exactly two permission entries on the file. Some guides suggest running the
Repair-AuthorizedKeyPermission $env:USERPROFILE\.ssh\authorized_keys– this will try to add the
sshduser to the permission list and it will break the authentication, so, don’t do that, or at least do not agree on adding the
SYSTEMand yourself should have full control over the file.
- If your Windows build is 1809 or later, it is required to comment out the following lines in
C:\ProgramData\ssh\sshd_configfile. Then restart the
# Match Group administrators # AuthorizedKeysFile __PROGRAMDATA__/ssh/administrators_authorized_keys
ssh <serverusername>@<serverhostname>. It should work at this point.
Tried that with Windows 10 as server and both itself and a Debian Linux as a client.