Built-in SSH server and client in Windows 10 and Windows Server 1709

Not many people know that both Windows 10 Fall Creators Update and Windows Server 1709 come with two very interesting Feature-on-Demand packages.

Namely, OpenSSH Client and OpenSSH Server.

To install them (through the UI), open Settings -> Apps -> Manage optional features -> Add a feature and select OpenSSH Client and/or OpenSSH Server. The server is trickier: there is no UI there. However, this can be done with PowerShell. Let's make sure the features are available:

Get-WindowsCapability -Online | ? Name -like 'OpenSSH*'

As a result we should see something like this:

Name  : OpenSSH.Client~~~~0.0.1.0
State : NotPresent

Name  : OpenSSH.Server~~~~0.0.1.0
State : NotPresent

To install the client or the server, use the following commands:

# Install the OpenSSH Client
Add-WindowsCapability -Online -Name OpenSSH.Client~~~~0.0.1.0

# Install the OpenSSH Server
Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0

Both should return this result:

Path          :
Online        : True
RestartNeeded : False

Great! SSH is installed.

Configuring OpenSSH Server (sshd)

To enable authentication on an SSH server on Windows, you have to generate host keys. Run PowerShell as administrator and do the following:

Start-Service ssh-agent

cd C:\Windows\System32\OpenSSH
.\ssh-keygen -A
.\ssh-add ssh_host_***something***_key

Install-Module -Force OpenSSHUtils
Repair-SshdHostKeyPermission -FilePath C:\Windows\System32\OpenSSH\ssh_host_***something***_key

Now we can start the SSH Server service.

Start-Service sshd

# This should return a Status of Running
Get-Service sshd

All that's left is to open port 22/tcp:

New-NetFirewallRule -Name sshd -DisplayName 'OpenSSH Server (sshd)' \
	-Service sshd -Enabled True -Direction Inbound -Protocol TCP \
	-Action Allow -Profile Domain

That's it! OpenSSH on Windows is ready to accept connections. But remember that it's still a beta, so be careful.