Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support. Most authentication in Windows environments is done with a username-password pair, which works well for systems that share a common domain. When working across domains, such as between on-premises and cloud-hosted systems, it becomes vulnerable to brute force intrusions. OpenSSH includes tools to help support key based authentication, specifically:.

This document provides an overview of how to use these tools on Windows to begin using key-based authentication with SSH. Key pairs refer to the public and private key files that are used by certain authentication protocols. SSH public key authentication uses asymmetric cryptographic algorithms to generate two key files — one "private" and the other "public". The private key files are the equivalent of windowws password, and should stay protected under all circumstances.

If someone acquires your private key, they can sign in as you to any SSH server you have access to. The public key is what is placed on the SSH server, and may be shared without compromising the private key. Key based authentication enables the SSH server and client to compare the public key for a user name provided against openssj private key. If the server-side public key can't be openssh for windows 10 against the client-side private key, authentication fails.

Multi-factor authentication may be implemented with key pairs by entering a passphrase when the key pair is generated openssh for windows 10 user key generation below. The user will be prompted for the passphrase during authentication. The passphrase is used along with the presence of the private key on the SSH client to authenticate the user. A remote session opened via key based authentication does not have associated user credentials and hence is not capable of outbound authentication as the user, this is by design.

Public keys opejssh specific Openssh for windows 10 requirements that, on Windows, equate to only allowing access to administrators and System. On first use of sshd, the key pair for the host will be automatically generated. By default the sshd service openssh for windows 10 set to start openxsh.

To openssh for windows 10 it each time the server is rebooted, run the following commands from an elevated PowerShell prompt on your server:. If no algorithm is specified, RSA is used. A strong algorithm and key length should be used, such as Ed in this example. To generate key files using the Ed algorithm, run the following command from a PowerShell or cmd prompt on your client:. The output from the command should display the following output where "username" is replaced by your username :.

At this point, you'll openssh for windows 10 prompted to use a passphrase to encrypt your private key files. The passphrase can be empty but it's not recommended. The passphrase works with the key file to provide two-factor authentication. For this example, we're leaving the passphrase empty. Remember that private key files are the equivalent of a password should be protected the same way you protect your password.

Use ssh-agent to securely store the openss keys within a Windows security context, associated with your Windows account. To start the ssh-agent service each time your computer is rebooted, and use ssh-add to store the private key run the following commands from an elevated PowerShell prompt on your server:. Opnssh you've added the key to the ssh-agent on your client, the openssh for windows 10 will automatically retrieve the local private key and pass it to your SSH client. It is strongly openssh for windows 10 that you back up your private key to a secure location, then delete it from the openssh for windows 10 system, after adding it to ssh-agent.

The private key cannot be retrieved from the agent providing a strong algorithm has been used, such as Ed in this example. If you lose access openssh for windows 10 the private key, you will have to create a new key pair and update the public key on all systems you interact with. The name and location of the file depends on whether the user account is a member of the local administrators group or a standard user account. The following sections cover both standard and administrative users.

You can copy your public key using the OpenSSH scp secure file-transfer utility, or using a PowerShell to write the widnows to the file. The openash below copies the public key to the server where "username" is replaced by your username. You'll need to use openssh for windows 10 password for the user account for the server initially.

The ACL on this file needs to be configured to only allow access to administrators and System. The example below copies the public key to the server and configures the ACL where "username" is replaced by your user name. This only applies to administrator accounts and must be user instead of the per user file within the user's profile location. These steps complete the configuration required to use key-based authentication with OpenSSH on Windows.

Once the example PowerShell commands have been run, the user can connect to the sshd host from any client that has the private key. Skip to main content.

This browser is no longer supported. Download Microsoft Edge More info. Openssh for windows 10 of contents Exit focus mode. Wihdows of contents. Important A remote session opened via key based authentication does not have associated user credentials and hence is not capable of outbound authentication as the user, this is by design.

Important It is strongly recommended that you back up your private key to a secure location, then delete it from the local system, after adding it to ssh-agent. Submit and view feedback for This product This page. View all page feedback.

In this article.

How to Enable OpenSSH Server in Windows 10

Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support. OpenSSH has configuration files for both server and client settings. As a result, open-source documentation for OpenSSH configuration files isn't repeated here.

If the file is absent, sshd generates one with the default configuration when the service is started. The default command shell provides the experience a user sees when connecting to the server using SSH. The initial default Windows is the Windows Command shell cmd. Windows also includes PowerShell, and third-party command shells are also available for Windows and may be configured as the default shell for a server.

To set the default command shell, first confirm that the OpenSSH installation folder is on the system path. The following command shows the current path setting, and adds the default OpenSSH installation folder to it. As an example, the following elevated PowerShell command sets the default shell to be powershell. There are other configuration settings possible that aren't listed here, as they're covered in detail in the online Win32 OpenSSH documentation.

Any changes to the configuration file requires the service to be restarted. All account names must be specified in lower case. Windows allows multiple formats for specifying domain principals, but many conflict with standard Linux patterns. Also, this approach uses "?

The example below allow the user localusers to sign-in from the host The default is. To grant permissions you can open an elevated PowerShell prompt, and running the command icacls. This directive is only supported with sftp sessions. A remote session into cmd. To set up a sftp-only chroot server, set ForceCommand to internal-sftp. You may also set up scp with chroot, by implementing a custom shell that would only allow scp and sftp. Alternatively, you can create a corresponding entry in the SSH client configuration.

Matches conditions using one or more criteria. Upon a match, the subsequent configuration arguments are applied. User and group names should be in lower case. Not applicable in Windows. To prevent administrators signing in, use Administrators with DenyGroups directive.

For more info, see Logging Facilities in Windows. The following configuration argument is available starting in Windows Server , Windows 11, and Windows 10 xxxx:. Skip to main content. This browser is no longer supported. Download Microsoft Edge More info. Table of contents Exit focus mode. Table of contents.

Important Authentication using an Azure AD account is not currently supported. Submit and view feedback for This product This page. View all page feedback. In this article.

Here's How to Enable the Built-In Windows 10 OpenSSH Client.

Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support. It encrypts all traffic between client and server to eliminate eavesdropping, connection hijacking, and other attacks.

Some information in the WinOpenSSH repository relates to prerelease product that may be substantially modified before it's released. Microsoft makes no warranties, express or implied, with respect to the information provided there. Verify your major version is at least 5, and your minor version at least 1.

Learn more about installing PowerShell on Windows. Run the command below. The output will show True when you're a member of the built-in Administrators group. Open Settings , select Apps , then select Optional Features. Scan the list to see if the OpenSSH is already installed.

If not, at the top of the page, select Add a feature , then:. This allows inbound SSH traffic on port If this rule is not enabled and this port is not open, connections will be refused or reset.

To make sure that OpenSSH is available, run the following cmdlet:. To start and configure OpenSSH Server for initial use, open an elevated PowerShell prompt right click, Run as an administrator , then run the following commands to start the sshd service :.

From a PowerShell prompt, run the following command. At this point, you'll be prompted for your password. As a security precaution, your password won't be displayed as you type. You may need to restart Windows afterwards if the service was in use at the time it was uninstalled. Skip to main content. This browser is no longer supported. Download Microsoft Edge More info. Table of contents Exit focus mode. Table of contents. Go to Optional Features. Select Uninstall. Submit and view feedback for This product This page.

View all page feedback. In this article.