how to enable passwordless ssh on windows 2012 r2Jul 27, 22
With a newer windows server, ssh is a bit more turnkey, but there are some steps required to get it going on an older server. Let’s talk about it.
first, on the server, i ran the following commands in a pwsh 7.2.5 admin console. In plain language, i downloaded the latest (at this time) openssh port for powershell, ran the install, added a firewall rule, set the sshd to auto start, created a new user (real info removed), and set the default shell to powershell. It seemed to default to cmd which caused some of my original script to fail since it expected powershell. after all that, i restarted the service.
PS C:\Windows\System32> iwr https://github.com/PowerShell/Win32-OpenSSH/releases /download/v188.8.131.52p1-Beta/OpenSSH-Win64-v184.108.40.206.msi -OutFile C:\Users\!rashbroo k\Downloads\OpenSSH-Win32-v220.127.116.11.msi PS C:\Windows\System32> C:\Users\!rashbrook\Downloads\OpenSSH-Win32-v18.104.22.168.msi PS C:\Windows\System32> get-service | findstr ssh Running ssh-agent OpenSSH Authentication Agent Running sshd OpenSSH SSH Server PS C:\Windows\System32> netsh advfirewall firewall add rule name=SSHPort dir=in action=allow protocol=TCP localport=22 Ok. PS C:\Windows\System32> Set-Service -Name sshd -StartupType "Automatic" PS C:\Windows\System32> net user SSHUSERNAME SSHPASSWORD /add PS C:\Windows\System32> New-ItemProperty -Path "HKLM:\SOFTWARE\OpenSSH" -Name De faultShell -Value "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -P ropertyType String -Force DefaultShell : C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe PSPath : Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SOFTWARE\ OpenSSH PSParentPath : Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SOFTWARE PSChildName : OpenSSH PSDrive : HKLM PSProvider : Microsoft.PowerShell.Core\Registry PS C:\Windows\System32> get-service sshd | Stop-Service PS C:\Windows\System32> get-service sshd | Start-Service
after all that, on the client, i ran
ssh-keygen to make the keys. then ran ssh SSHUSERNAME@myserver to connect with a password. this let me know things were working, and i created the folder and file to hold the key with
cd .ssh, and
then i opened up authorized_keys and pasted the contents from id_rsa.pub on the client. we could copy this file using scp as well, but i did it in the ui. because i needed to be on there anyway to fix the permissions.
i didn’t check to see if this worked without the permissions fix since there were references to this on all the pages i checked, so next i went to the .ssh/authorized_keys file on the server (via rdp) and went into permissions, turned off inheritance, let it copy the existing permissions, then removed everything except system and my SSHUSERNAME account.
after this, i went to remove the match group admins line in the sshd_config file.
notepad C:\ProgramData\ssh\sshd_config and then comment out the last two lines. so they’ll look like this:
# Match Group administrators # AuthorizedKeysFile __PROGRAMDATA__/ssh/administrators_authorized_keys
after this, i added the key on my client machine using
ssh-add id_rsa and all was right with the world. =)
Some helpful resources I found that almost got me there:
in a previous life, i connected to this server with a mapped drive. i switched to a mac a year or so ago and had some jobs on a 2019 server that i setup deployment using some relatively straightforward microsoft documentation. now i’m moving some jobs to this older server and needed to set it up. i have a script that can be used to deploy jobs, but this didn’t work on the older server since no ssh. i was hoping there was a pretty easy way to get ssh on here rather than look for some other retrofit. jobs can be copy deployed, but why not use the script since it’s there?
the setup for this isn’t too bad, but all of the permission things and setting a different default shell, etc, makes things a little weird. i’m guessing there is a cacls line that matches with the chmod lines you can find for setting up on non-windows, but alas. if i have to do this a second time in 10 years, maybe i’ll research that and just make this into a script, but for now this hopefully this helps someone else, or future me, out as a reference. i like to hope in the future, no one will need to install ssh on a 10 year old operating system.