Differences
This shows you the differences between the selected revisions of the page.
| guide_windows_openssh_server 2021-04-21 | guide_windows_openssh_server 2024-10-08 (current) | ||
| Line 1: | Line 1: | ||
| ====== Installing SFTP/SSH Server on Windows using OpenSSH ====== | ====== Installing SFTP/SSH Server on Windows using OpenSSH ====== | ||
| - | Recently, [[https://devblogs.microsoft.com/powershell/openssh-for-windows-update/|Microsoft has released]] a port of [[https://github.com/PowerShell/Win32-OpenSSH|OpenSSH for Windows]]. You can use the package to set up an SFTP/SSH server on Windows. | + | Microsoft maintains a port of [[https://github.com/PowerShell/Win32-OpenSSH|OpenSSH for Windows]]. You can use the package to set up an SFTP/SSH server on Windows. |
| ===== Installing SFTP/SSH Server ===== | ===== Installing SFTP/SSH Server ===== | ||
| - | ==== [[win10]] On Windows 10 version 1803 and newer ==== | + | ==== [[win10]] On Windows 11 and Windows 10 ==== |
| - | * In //Settings// app, go to //Apps > Apps & features > Manage optional features//. | + | * On Windows 11: &win11 |
| - | * Locate //"OpenSSH server"// feature, expand it, and select //Install//. | + | * Go to //Settings > Apps > Optional features// and click on //View features//. |
| + | * Locate //"OpenSSH server"// feature, select it, click //Next//, and then click //Install//. | ||
| + | * On Windows 10 (version 1803 and newer): &win10 | ||
| + | * Go to //Settings > Apps > Apps & features > Optional features// and click on //Add a feature//. | ||
| + | ···* Locate //"OpenSSH server"// feature, expand it, and select //Install//. | ||
| Binaries are installed to ''%WINDIR%\System32\OpenSSH''. Configuration file (''sshd_config'') and host keys are installed to ''%ProgramData%\ssh'' (only after the server is started for the first time). | Binaries are installed to ''%WINDIR%\System32\OpenSSH''. Configuration file (''sshd_config'') and host keys are installed to ''%ProgramData%\ssh'' (only after the server is started for the first time). | ||
| - | You may still want to use the following manual installation if you want to install a newer version of OpenSSH than the one built into Windows 10. | + | You may still want to use the following manual installation if you want to install a newer version of OpenSSH than the one built into Windows. |
| ==== [[windows_older]] On earlier versions of Windows ==== | ==== [[windows_older]] On earlier versions of Windows ==== | ||
| Line 24: | Line 28: | ||
| * Allow incoming connections to %%SSH%% server in Windows Firewall: | * Allow incoming connections to %%SSH%% server in Windows Firewall: | ||
| * When installed as an optional feature, the firewall rule //"OpenSSH SSH Server (sshd)"// should have been created automatically. If not, proceed to create and enable the rule as follows. | * When installed as an optional feature, the firewall rule //"OpenSSH SSH Server (sshd)"// should have been created automatically. If not, proceed to create and enable the rule as follows. | ||
| - | * Either run the following PowerShell command as the Administrator: \\ <code powershell>New-NetFirewallRule -Name sshd -DisplayName 'OpenSSH SSH Server' -Enabled True -Direction Inbound -Protocol TCP -Action Allow -LocalPort 22 -Program "C:\System32\OpenSSH\sshd.exe"</code> Replace ''C:\System32\OpenSSH\sshd.exe'' with the actual path to the ''sshd.exe'' (''C:\Program Files\OpenSSH\ssh.exe'', had you followed the manual installation instructions above). | + | * Either run the following PowerShell command as the Administrator: \\ <code powershell>New-NetFirewallRule -Name sshd -DisplayName 'OpenSSH SSH Server' -Enabled True -Direction Inbound -Protocol TCP -Action Allow -LocalPort 22 -Program "C:\Windows\System32\OpenSSH\sshd.exe"</code> Replace ''C:\Windows\System32\OpenSSH\sshd.exe'' with the actual path to the ''sshd.exe'' (''C:\Program Files\OpenSSH\ssh.exe'', had you followed the manual installation instructions above). |
| - | * or go to //Control Panel > System and Security > Windows Defender Firewall//((//Windows Firewall// on older versions of Windows.))// > Advanced Settings > Inbound Rules// and add a new rule for port 22. &wincp | + | * or go to //Windows Security > Firewall & network protection//((//Control Panel > Windows Defender Firewall//·(or //Windows Firewall//) on older versions of Windows.))// > Advanced Settings > Inbound Rules// and add a new rule for port 22. &wincp |
| * Start the service and/or configure automatic start: | * Start the service and/or configure automatic start: | ||
| * Go to //Control Panel > System and Security > Administrative Tools// and open //Services//. Locate //%%OpenSSH SSH Server%%// service. &wincp | * Go to //Control Panel > System and Security > Administrative Tools// and open //Services//. Locate //%%OpenSSH SSH Server%%// service. &wincp | ||
| - | * If you want the server to start automatically when your machine is started: Go to //Action > Properties//. In the Properties dialog, change //Startup type// to //Automatic// and confirm. | + | * If you want the server to start automatically when your machine is started: Go to //Action > Properties// (or just double-click the service). In the Properties dialog, change //Startup type// to //Automatic// and confirm. |
| - | * Start the //%%OpenSSH SSH Server%%// service by clicking the //Start the service//. | + | * Start the //%%OpenSSH SSH Server%%// service by clicking the //Start the service// link or //Action > Start// in the menu. |
| //These instructions are partially based on [[https://github.com/PowerShell/Win32-OpenSSH/wiki/Install-Win32-OpenSSH|the official deployment instructions]].// | //These instructions are partially based on [[https://github.com/PowerShell/Win32-OpenSSH/wiki/Install-Win32-OpenSSH|the official deployment instructions]].// | ||
| Line 38: | Line 42: | ||
| * Create the ''.ssh'' folder (for the ''authorized_keys'' file) in your Windows account profile folder (typically in ''C:\Users\username\.ssh'').((Windows File Explorer does not allow you to create a folder starting with a dot directly. As a workaround, use ''.ssh.'', the trailing dot will allow you to bypass the restriction, but will not be included in the name.)) &winpath | * Create the ''.ssh'' folder (for the ''authorized_keys'' file) in your Windows account profile folder (typically in ''C:\Users\username\.ssh'').((Windows File Explorer does not allow you to create a folder starting with a dot directly. As a workaround, use ''.ssh.'', the trailing dot will allow you to bypass the restriction, but will not be included in the name.)) &winpath | ||
| - | * For permissions to the ''.ssh'' folder and the ''authorized_keys'' file, what matters are Windows ACL permissions, not simple *nix permissions. Set the %%ACL%% so that the respective Windows account is the owner of the folder and the file and is the only account that has to write access to them. The account that runs //OpenSSH %%SSH%% Server// service (typically ''SYSTEM'' or ''sshd'') needs to have read access to the file. | + | * For permissions to the ''.ssh'' folder and the ''authorized_keys'' file, what matters are Windows ACL permissions, not simple *nix permissions. Set the %%ACL%% so that the respective Windows account is the owner of the folder and the file and is the only account that has a write access to them. The account that runs //OpenSSH %%SSH%% Server// service (typically ''SYSTEM'' or ''sshd'') needs to have read access to the file. |
| * Though, with the default Win32-OpenSSH configuration there is an exception set in ''sshd_config'' for accounts in ''Administrators'' group. For these, the server uses a different location for the authorized keys file: ''%ALLUSERSPROFILE%\ssh\administrators_authorized_keys'' (i.e. typically ''C:\ProgramData\ssh\administrators_authorized_keys''). &winpath | * Though, with the default Win32-OpenSSH configuration there is an exception set in ''sshd_config'' for accounts in ''Administrators'' group. For these, the server uses a different location for the authorized keys file: ''%ALLUSERSPROFILE%\ssh\administrators_authorized_keys'' (i.e. typically ''C:\ProgramData\ssh\administrators_authorized_keys''). &winpath | ||
| Line 47: | Line 51: | ||
| Before the first connection, find out the fingerprint of the server's host key by using ''%%ssh-keygen.exe%%'' for each file. | Before the first connection, find out the fingerprint of the server's host key by using ''%%ssh-keygen.exe%%'' for each file. | ||
| - | In Windows command-prompt, use: | + | In Windows command-prompt (run as Administrator), use: |
| <code batch> | <code batch> | ||
| Line 55: | Line 59: | ||
| //Replace ''%WINDIR%\System32'' with ''%ProgramFiles%'', if appropriate.// | //Replace ''%WINDIR%\System32'' with ''%ProgramFiles%'', if appropriate.// | ||
| - | In PowerShell, use: | + | In PowerShell (run as Administrator), use: |
| <code powershell> | <code powershell> | ||
| Line 73: | Line 77: | ||
| </code> | </code> | ||
| - | ==== Connecting ==== | + | ==== [[connecting2]] Connecting ==== |
| Start WinSCP. [[ui_login|Login dialog]] will appear. On the dialog: | Start WinSCP. [[ui_login|Login dialog]] will appear. On the dialog: | ||