Install openssh windows server 2016

You might find it useful to install OpenSSH on your Windows server. Running SSH on your Windows server means that you can transfer files using Secure Copy (SCP) or SFTP.  Aside from SCP and SFTP, you can open a secure Powershell shell or a Bash shell if Windows Subsystem for Linux (WSL) is enabled on your Windows server.

By default, you will enter into a Windows CMD shell when you connect to the server using SSH.

This guide will explain the steps to install and configure OpenSSH in Windows Server 2016. It would be best if you were prepared to log in to your Hostwinds Windows Server to continue with this guide.

Step 1: Download and Install OpenSSH

Start by accessing your server via RDP (from Mac), and download the latest release of OpenSSH (OpenSSH-Win64.zip).

Locate the downloaded file, right-click it, and Extract All to C:\Program Files\OpenSSH-Win64.

Optional: To change the default SSH port to something other than 22, select the sshd_config_default file in the OpenSSH folder and open with a text editor:

Uncomment Port 22 and change it to your desired port, then save the file:

End optional step.

Next, search for and right-click Powershell to Run as administrator:

Modify the Path system environment variable by running the command:

setx PATH "$env:path;C:\Program Files\OpenSSH-Win64" -m

You should see the following output:

SUCCESS: Specified value was saved.

Next, change to the OpenSSH directory:

cd "C:\Program Files\OpenSSH-Win64"

Then run the install script:

.\install-sshd.ps1

Next, enable automatic startup and start sshd and ssh-agent:

Set-Service sshd -StartupType Automatic; Set-Service ssh-agent -StartupType Automatic; Start-Service sshd; Start-Service ssh-agent

Step 2: Allow Access in Windows Firewall

Start by opening Control Panel > Windows Firewall:

Select Advanced Settings on the left-hand side, then select Inbound Rules > New Rule…:

Under Rule Type, select Custom > Next.

Under Program, select All programs > Next.

Under Protocols and Ports, enter your desired SSH port with the following selections:

Under Scope, let the rule apply to Any IP address for remote and local IP addresses, then Next.

Under Action, select Allow the connection > Next.

Under Profile, leave Domain, Private, and Public checked > Next.

Lastly, name the rule and select Finish.

Now you can access your Windows server using SSH!

In this tutorial, I will explain how to install the OpenSSH client and Server on Windows Server 2012R2 and 2016.

At the time of writing this tutorial, this feature is native to Windows 10 and Windows Server 2019 and you might also want to have OpenSSH client or server on an earlier version.

Personally, I use the SSH client very regularly through PowerShell or Command Prompt windows, it avoids having to install Putty.

Recover Win32 OpenSSH

The first step is to retrieve from the GitHub repository PowerShell/Win32-OpenSSH: Win32 port of OpenSSH (github.com), the latest version available.

Go to the realeases page and download the latest version available corresponding to the architecture of the Windows installation (32 or 64 bits).

For me, it will be the 64 Bits version.

Once the archive has been downloaded, unzip it.

“Installation” of files on the server

Now, we will copy the folder from the unzipped archive to the C: \ Program Files folder.

The SSH client is now functional, but for ease of use, we will configure its location in the environment variables so as not to have to call the executable by its full path.

Adding the environment variable

Open the system window and click on Advanced system settings 1.

On the Advanced system parameters tab, click on the Environment variables 1 button.

In the System variable part, find the Path 1 variable, once selected, click on the Modify 2 button.

On Windows 2012R2, add at the end; C: \Program Files\OpenSSH-Win64\

On Windows 2016, click on New 1.

Add the location of the OpenSSH folder: C:\Program Files\OpenSSH-Win64\ 1 and click on OK 2.

Close the various windows.

Use the SSH client of Windows Server 2012R2 / 2016

Open a command prompt or PowerShell.

The easiest way to find out if it’s okay is to enter the ssh command. This command should return the various parameters of the SSH utility.

To connect to a server (Linux) enter the command ssh USER @ IP_SERVER

It is also possible to configure an OpenSSH server on Windows Server with Win32 OpenSSH which will allow you to connect to the Windows server in the same way as a Linux OS.

From a PowerShell window, go to the C: \ Program Files \ OpenSSH-Win64 \ folder, in the folder is a PowerShell script that will configure the server part.

Run the install-sshd.ps1 PowerShell script

If the installation is successful, the message is displayed: sshd and ssh-agent services successfully installed.

Open Windows Service Manager and search for OpenSSH SSH Server, by default it is stopped. Start the service.

If necessary, configure the service to start automatically

Depending on your configuration, remember to allow incoming connections on port 22.

The server part is operational.

Connect to Windows on the SSH server

From another computer, use an SSH client to connect, being in an Active Directory environment, I just need to use the ssh IP_SERVER command and then enter my password.

Once connected, enter a command such as ipconfig or hostname to validate that the command has been executed on the remote server.

Conclusion

For the client part, for my part, I find the use in native practical which avoids going through a third-party tool and we quickly get used to when we use Windows 10 and the SSH client I find, missing on Windows 2012R2 and Windows 2016 , the problem is now resolved 🙂

For the server part, I find it useful for non-domain servers, because configuring WinRM and PSSession for connection can quickly become “a headache”.

OpenSSH is an ideal and secure way of performing remote maintenance & administration on your servers. Even on Windows Server! Microsoft have released their OpenSSH port for Windows Server and Windows 10 back in 2015. Here is how to install the OpenSSH Server on Windows Server 2022, 2019 and 2016.

In this small tutorial, I’ll show you how to manually install OpenSSH in Windows Server (all versions). You’ll notice I’m not using PowerShell’s Add-WindowsCapability cmdlet, because it errors out on unsupported platforms. And I want to be able to customize the sshd installation directory. If you follow this post, you can install Microsoft OpenSSH Server on Windows Server 2022 through even Windows Server 2012 R2, in a destination folder of your choosing. Sweet

Please note that a lot has changed in recent years, like Microsoft releasing .msi Windows Installer installation files, and you no longer have to depend on PowerShell Add-WindowsCapability or .zip files. Wherever possible, use the OpenSSH .msi installation option.

Want to know how to extract files from an MSI package file?

Prerequisites

In order to be able to install OpenSSH on Windows, you need the software. Doh!

1. Download the latest release from GitHub: https://github.com/PowerShell/Win32-OpenSSH/releases (OpenSSH-Win64.zip for example).

Install “Windows for OpenSSH” using PowerShell

1. Unblock the downloaded OpenSSH archive if necessary: Unblock-File .\Downloads\OpenSSH-Win64.zip
2. Extract the archive: Expand-Archive .\Downloads\OpenSSH-Win64.zip -DestinationPath .
3. Copy the OpenSSH-Win64 folder to your desired location, e.g c: Copy-Item -Recurse .\OpenSSH-Win64\ 'C:\'
4. The libcrypto.dll file has to be accessible for all users: &icacls C:\OpenSSH-Win64\libcrypto.dll /grant Everyone:RX
5. Run install-sshd.ps1 to create the OpenSSH Authentication Agent and OpenSSH SSH Server services. It also sets some permissions and registers an Event Tracing (ETW) provider.
6. Change the service startup to Automatic. The OpenSSH SSH Server service is set to Manual startup, not automatic: &sc.exe config sshd start= auto, &sc.exe config ssh-agent start= auto
7. Start the OpenSSH Authentication Agent and SSH Server services: &sc.exe start sshd, &sc.exe start ssh-agent
8. Make sure your Windows Defender Firewall is open for port 22, rule OpenSSH-Server-In-TCP must be enabled. If this rule is not available, manually create it:

New-NetFirewallRule
  -Name sshd
  -DisplayName 'OpenSSH SSH Server'
  -Enabled True
  -Direction Inbound
  -Protocol TCP
  -Action Allow
  -LocalPort 22
  -Program "C:\Windows\System32\OpenSSH\sshd.exe"

Replace C:\Windows\System32\OpenSSH\sshd.exe with the actual path to the sshd.exe (C:\OpenSSH\sshd.exe, if you followed this instruction). Or go to Control Panel > System and Security > Windows Firewall > Advanced Settings > Inbound Rules and add a new rule for port 22.

Let’s connect!

PS C:\> ssh -l janreilink localhost

Install Win32-OpenSSH Server using MSI Installer

If you have downloaded the .msi Windows Installer MSI-file of Microsoft OpenSSH (OpenSSH-Win64-v8.9.1.0.msi for example), you can install OpenSSH server and client easily. The following command installs both OpenSSH Server and OpenSSH Client:

msiexec /i path to OpenSSH-Win64-v8.9.1.0.msi

This, however installs OpenSSH in the location C:\Program Files\OpenSSH, and doesn’t update your $env:path environment variable. There are some other caveats. You can follow my guide “install Microsoft OpenSSH Client properly in Windows 11 and Windows 10 to support FIDO/U2F security keys” on Windows Server 2022 / 2019 to install and configure OpenSSH Server and Client using .msi installer files.

sshd_config

Often you not only need to install OpenSSH, you also need to configure it. For this, OpenSSH on Windows uses an mechanism where the default sshd_config (called “sshd_config_default“) is located in the directory to where you’ve unpacked the OpenSSH-Win64.zip archive. When you start the service, the file is copied to C:\ProgramData\ssh\sshd_config.

In Windows, sshd reads configuration data from %programdata%\ssh\sshd_config by default, or a different configuration file may be specified by launching sshd.exe with the -f parameter. If the file is absent, sshd generates one with the default configuration when the service is started.

https://docs.microsoft.com/en-us/windows-server/administration/openssh/openssh_server_configuration#windows-configurations-in-sshd_config

So you can either make you configuration in the sshd_config_default file, that is copied when you start the service for the first time, or you start and stop OpenSSH, edit C:\ProgramData\ssh\sshd_config and restart OpenSSH again.

Install OpenSSH on Windows Server 2012

OpenSSH Server on Windows Server 2012 R2, you said? Yes, you can use the same method to install OpenSSH in Windows Server 2012 R2 (version 6.3.9600). Here is a screenshot of connecting to sshd on Windows version 6.3.9600:

Conclusion and giveaway

In this post I showed you how you can install OpenSSH server in various Windows Server versions, using the downloaded .zip file archive and PowerShell. You can use this approach to customize and streamline your Microsoft OpenSSH Server environment. This goes very well with SSH keys stored in Active Directory. If you want to use FIFO/U2F security keys like YubiKey in Windows OpenSSH, follow that guide.

In an other post I’ll show you how to install OpenSSH Client in Windows 11 and Windows 10. Using the OpenSSH-Win64-v8.9.1.0.msi file.

В данном руководстве посмотрим, как настроить подключение по SSH к виртуальному Windows-серверу. Для работы мы будем использовать VPS, работающий на операционной системе Windows Server 2016. Заказ подобного сервера производится в личном кабинете на сайте UltraVDS.

Загрузка и установка OpenSSH

На первом шаге настройки подключения к Windows-серверу по протоколу SSH необходимо установить на него оболочку OpenSSH. В Windows Server 2016 это удобнее осуществить путём загрузки и инсталляции OpenSSH из репозитория на GitHub.

Для этого подключитесь к вашему VDS через RDP и уже с удалённого рабочего стола вашего виртуального сервера перейдите по ссылке. На момент написания данного мануала последней версией OpenSSH на GitHub была версия v9.1.0.0p1-Beta. Поэтому на ресурсе последней версии необходимо найти и загрузить оттуда архив дистрибутива — файл OpenSSH-Win64.zip.

После того, как загрузка файла будет завершена, папку OpenSSH-Win64 скопируйте из архива OpenSSH-Win64.zip в каталог Program Files.

Далее перейдите в папку OpenSSH-Win64 и при помощи текстового редактора Notepad отредактируйте файл sshd_config_default. А именно, в нём необходимо снять комментарии (удалить символ #) в строке:

#Port 22

И в строке:

#PasswordAuthentication yes

После чего закройте файл sshd_config_default с сохранением внесённых изменений.

Теперь можно перейти непосредственно к установке OpenSSH. Для этого от имени администратора запустите оболочку PowerShell.

Далее в командной строке PowerShell наберите следующую команду:

setx PATH "$env:path;C:\Program Files\OpenSSH-Win64" -m

При её успешном выполнении вывод команды должен выглядеть как на скриншоте ниже:

Следующая команда осуществляет переход в папку C:\Program Files\OpenSSH-Win64 и запускает скрипт install-sshd.ps1.

cd "C:\Program Files\OpenSSH-Win64"; .\install-sshd.ps1

В процессе выполнения своих инструкций скрипт дважды запросит разрешение на их запуск. Для проведения успешной установки OpenSSH нажмите R при каждом запросе.

Первоначальная настройка OpenSSH

Для того, чтобы оболочка OpenSSH была доступна всегда и самостоятельно запускалась при перезагрузке сервера, необходимо запустить службы sshd и ssh-agent, а также включить их автоматический старт. Производится это при помощи следующей команды:

Set-Service sshd -StartupType Automatic; Set-Service ssh-agent -StartupType Automatic; Start-Service sshd; Start-Service ssh-agent

На заключительном этапе установки OpenSSH необходимо разрешить в брандмауэре Windows доступ к серверу по протоколу SSH. По умолчанию SSH использует TCP-порт 22. Таким образом, следующей командой нужно будет открыть доступ к данному порту в Windows Firewall.

New-NetFirewallRule -DisplayName "OpenSSH-Server-In-TCP" -Direction Inbound -LocalPort 22 -Protocol TCP -Action Allow

Подключение к VPS по SSH

Теперь можно попробовать подключиться к вашему VPS с использованием протокола SSH. С компьютера, работающего под управлением как Windows, так и одной из операционных систем Linux, подключение производится из командной строки или терминала при помощи команды:

$ ssh your_user_name@your_server_IP

Здесь:

• your_user_name — имя учётной записи, под которой производится подключение к VDS;
• your_server_IP — IP-адрес вашего виртуального Windows-сервера.

При первом подключении система предупредит вас о невозможности установления подлинности удалённого хоста. Для того, чтобы рабочая станция, с которой производится подключение получила отпечаток ключа для проверки, необходимо ответить на предупреждение набрав yes.

При каждом повторном подключении к тому же удалённому серверу SSH будет проверять принятый вами фингерпринт для подтверждения его легитимности.