Installing SFTP/SSH Server on Windows using OpenSSH

Description

Purpose of this document to enable Support Team or the Consultant to be able to Install sftp/ssh server on their local machine.

This document is for those who are working over Windows Machine. For MAC the article will be published shortly.

Resolution

Installing SFTP/SSH Server:

On Windows 10:

  • In the Settings app, go to Apps Apps & features Manage optional features.
  • Locate the “OpenSSH server” feature, expand it, and select Install.

Binaries are installed to %WINDIR%\System32\OpenSSH. Configuration file (sshd_config) and host keys are installed to %ProgramData%\ssh (only after the server is started for the first time).

You may still want to use the following manual installation to install a newer version of OpenSSH than the one built into Windows 10.

On earlier versions of Windows:

  • Download the latest OpenSSH for Windows binaries (package OpenSSH-Win64.zip or OpenSSH-Win32.zip)
  • As the Administrator, extract the package to C:\Program Files\OpenSSH
  • As the Administrator, install sshd and ssh-agent services:

powershell.exe -ExecutionPolicy Bypass -File install-sshd.ps1

Configuring SSH server

Top of Form

Bottom of Form

  • Allow incoming connections to SSH server in Windows Firewall:

    • Either run the following PowerShell command (Windows 8 and 2012 or newer only) as the Administrator:

      New-NetFirewallRule -Name sshd -DisplayName 'OpenSSH SSH Server' -Enabled True -Direction Inbound -Protocol TCP -Action Allow -LocalPort 22

    • or go to Control Panel System and Security Windows Firewall1Advanced Settings Inbound Rules and add a new rule for port 22.

  • Start the service and configure automatic start:

    • Go to Control Panel System and Security Administrative Tools and open Services. Locate OpenSSH SSH Server service.
    • If you want the server to start automatically when your machine is started: Go to Action Properties. In the Properties dialog, change the Startup type to Automatic and confirm.
    • Start the OpenSSH SSH Server service by clicking the Start the service.

NOTE: You can refer to this video tutorial for enabling and executing the OpenSSH server: https://www.youtube.com/watch?v=0G1Qh-_jBTQ

Setting up SSH public key authentication


 


Follow a generic guide for Setting up SSH public key authentication in *nix OpenSSH server, with the following difference:

  • Create the .ssh folder (for the authorized_keys file) in your Windows account profile folder (typically in C:\Users\username\.ssh).
  • For permissions to the .ssh folder and authorized_keys file, what matters are Windows ACL permissions, not simple *nix permissions. Set the ACL so that only a respective Windows account has to write access to the folder and the file (what is the default access level if you create the folder and the file while logged in using the respective account).

Connecting to the server


 

Finding Host Key
Before the first connection, find out the fingerprint of the server’s host key by using ssh-keygen.exe for each file.

In Windows command-prompt, use: 

for %f in (%ProgramData%\ssh\ssh_host_*_key) do @%WINDIR%\System32\OpenSSH\ssh-keygen.exe -l -f "%f"

Replace %WINDIR%\System32 with %ProgramFiles%, if appropriate.

In PowerShell, use: 

Get-ChildItem $env:ProgramData\ssh\ssh_host_*_key | ForEach-Object { . $env:WINDIR\System32\OpenSSH\ssh-keygen.exe -l -f $_ }

Replace$env:WINDIR\System32with$env:ProgramFiles, if appropriate.

You will get an output like this:

C:\Windows\System32\OpenSSHfor %f in (%ProgramData%\ssh\ssh_host_*_key) do @%WINDIR%\System32\OpenSSH\ssh-keygen.exe -l -f "%f"

1024 SHA256:K1kYcE7GHAqHLNPBaGVLOYBQif04VLOQN9kDbiLW/eE martin@example (DSA)

256 SHA256:7pFXY/Ad3itb6+fLlNwU3zc6X6o/ZmV3/mfyRnE46xg martin@example (ECDSA)

256 SHA256:KFi18tCRGsQmxMPioKvg0flaFI9aI/ebXfIDIOgIVGU martin@example (ED25519)

2048 SHA256:z6YYzqGiAb1FN55jOf/f4fqR1IJvpXlKxaZXRtP2mX8 martin@example (RSA)

Connecting


 


Start WinSCP. A login dialog will appear. On the dialog:

  • Make sure the New site node is selected.

  • On the New site node, ensure the SFTP protocol is selected.

  • Enter your machine/server IP address (or a hostname) into the Hostname box.

  • Enter your Windows account name into the User name box. If running on a domain, it might have to be entered in the format user@domain.

  • For a public key authentication:

  • For a password authentication:

    • Enter your Windows account password into the Password box.
    • If your Windows account does not have a password, you cannot authenticate with the password authentication (i.e., with an empty password); you need to use the public key authentication.

  • Save your site settings using the Save button.

  • Login using the Login button.

  • Verify the host key by comparing fingerprints with those collected before (see above).

On this page