Get-WindowsCapability -online -name openssh.server* | Add-WindowsCapability -online<\/code><\/pre>\n\n\n\nI'm using Get-WindowsCapability with a wildcard just in case the version number changes at some point. I can see this worked.<\/p>\n\n\n\n![\"OpenSSH.Server](\"https:\/\/jdhitsolutions.com\/blog\/wp-content\/uploads\/2020\/12\/sshserver-installed-1024x306.png\")
<\/a><\/figure>\n\n\n\nThis will setup the sshd service which is not running and configured to start manually. I want to configure the service to start and start automatically.<\/p>\n\n\n\n
Set-Service -Name sshd -StartupType Automatic\nStart-Service -Name sshd<\/code><\/pre>\n\n\n\nOne thing I have learned about ssh, especially if you want to use it with PowerShell remoting, and that is to verify ssh works outside of PowerShell. <\/p>\n\n\n\n
ssh localhost<\/code><\/pre>\n\n\n\nYou might get prompted about accepting keys and for a password. If you're setup is like mine, you'll end up in a CMD prompt. But maybe you'd like a different shell when connecting over ssh. Note that I am not <\/strong>talking about PowerShell remoting over ssh yet. You can modify the registry on your computer.<\/p>\n\n\n\n$regPath = \"HKLM:\\SOFTWARE\\OpenSSH\\\"\n$regProperty = \"DefaultShell\"\n$regValue = (Get-Command powershell.exe).source\nSet-ItemProperty -Path $regPath -Name $regProperty -Value $regValue<\/code><\/pre>\n\n\n\nThe change should be immediate and not require restarting the sshd service. Using ssh to connect to localhost now gives me a Windows PowerShell session. It wouldn't take much to assemble a simple PowerShell script to run these commands interactively.<\/p>\n\n\n\n
Remote Installation<\/h2>\n\n\n\n
But I want to do this remotely. I have some Windows 10 VMs that I'd like to connect to with ssh. I will need to use traditional PowerShell remoting. Yes, you could use a third-party tool like psexec.exe or something like Desired State Configuration, but I want to stick with tools and skills you likely already have.<\/p>\n\n\n\n
As I was working on this I had a simple PowerShell script that ran the steps I just showed you. I figured all I needed to do was run the script using Invoke-Command. Nope. Turns out the Add-WindowsCapability command will not work in a remoting session. This is apparently a known limitation with feature-on-demand installation. But I wasn't going to let that stop me. My eventual workaround was to create a temporary scheduled task that would add OpenSSH.Server as SYSTEM.<\/p>\n\n\n\n
$Time = New-ScheduledTaskTrigger -At 23:59 -Once\n$User = New-ScheduledTaskPrincipal System\n$action = New-ScheduledTaskAction -Execute \"PowerShell.exe\" -Argument '-noprofile -command \"& { Get-WindowsCapability -online -name openssh.server* | Add-WindowsCapability -online}\"'\n$tmpTask = Register-ScheduledTask -taskpath \\ -TaskName \"AddTask\" -Trigger $Time -Principal $user -Action $Action\nStart-ScheduledTask -TaskName AddTask\n\n#give the task a chance to finish<\/em>\nStart-Sleep -Seconds 20\n\n$tmpTask | Unregister-ScheduledTask -confirm:$false<\/code><\/pre>\n\n\n\nThe trigger time is irrelevant because I'm going to manually start the task and then remove it As long as I'm not running this close to midnight, I should be fine.<\/p>\n\n\n\n
I also wanted my script to support -WhatIf and offer Verbose output, even though the code was running remotely. Here's the script I came up with.<\/p>\n\n\n\n
#requires -version 5.1<\/em>\n\n<#<\/em>\nThis is used to setup SSHD on a Windows 10 Client through PowerShell remoting<\/em>\n\nSample usage<\/em>\nVerbose and Whatif<\/em>\ninvoke-command -FilePath .\\Setup-SSHServer.ps1 -ComputerName win10 -cred $artd -ArgumentList @(\"Continue\",$True)<\/em>\n\nVerbose<\/em>\ninvoke-command -FilePath .\\Setup-SSHServer.ps1 -ComputerName win10 -cred $artd -ArgumentList @(\"Continue\")<\/em>\n#><\/em>\n\n[cmdletbinding(SupportsShouldProcess<\/em>)]\nparam ([string]$VerboseOption = \"SilentlyContinue\", [bool]$WhatIfOption = $False)\n\n$VerbosePreference = $VerboseOption\n$WhatIfPreference = $WhatIfOption\n\nWrite-Verbose \"Starting SSHD setup process\"\nTry {\n Write-Verbose \"Testing for sshd service\"\n $svc = Get-Service -Name sshd -ErrorAction Stop\n if ($svc.status -eq 'Running') {\n Write-Verbose \"sshd service appears to be installed and running\"\n }\n else {\n Write-Warning \"sshd service found but it isn't running\"\n }\n #take no further action<\/em>\n Return \"OpenSSH Server installation appears to be complete.\"\n}\nCatch {\n Write-Verbose \"sshd service not found. Continuing with installation\"\n}\n\nWrite-Verbose \"Testing OpenSSH.Server Windows capability\"\nif (-Not $svc) {\n Try {\n $cap = Get-WindowsCapability -Name OpenSSH.Server* -Online -ErrorAction Stop\n $cap | Out-String | Write-Verbose\n }\n Catch {\n Throw $_\n }\n}\n\nif ($cap.State -eq 'NotPresent' -And $cap.name -match \"OpenSSH\") {\n #install capability<\/em>\n Try {\n Write-Verbose \"Adding $($cap.name)\"\n if ($pscmdlet.ShouldProcess($cap.Name)) {\n #installing with a Scheduledtask as System to get around the limitation<\/em>\n #with Add-WindowsCapability in a PowerShell remoting session<\/em>\n $Time = New-ScheduledTaskTrigger -At 23:59 -Once\n $User = New-ScheduledTaskPrincipal System\n $action = New-ScheduledTaskAction -Execute \"PowerShell.exe\" -Argument '-noprofile -command \"& { Get-WindowsCapability -online -name openssh.server* | Add-WindowsCapability -online}\"'\n $tmpTask = Register-ScheduledTask -taskpath \\ -TaskName \"AddTask\" -Trigger $Time -Principal $user -Action $Action\n Start-ScheduledTask -TaskName AddTask\n\n #give the task a chance to finish<\/em>\n Start-Sleep -Seconds 20\n\n $tmpTask | Unregister-ScheduledTask -confirm:$false\n } #Whatif<\/em>\n }\n Catch {\n Throw $_\n }\n}\n\nWrite-Verbose \"Set sshd to auto start\"\nTry {\n if ($pscmdlet.ShouldProcess(\"sshd\", \"Configure service\")) {\n Set-Service -Name sshd -StartupType Automatic -ErrorAction stop\n Write-Verbose \"Start the sshd service\"\n Start-Service -Name sshd -ErrorAction Stop\n Get-Service sshd | Select-Object -Property * | Out-String | Write-Verbose\n }\n}\nCatch {\n Write-Warning \"There was a problem configuring the sshd service.\"\n}\n\nif (-Not $WhatIfOption) {\n #only display the summary if not using -WhatIf<\/em>\n $msg = @\"\nSSH setup complete. Edit $ENV:ProgramData\\ssh\\sshd_config for additional configurations options\nor to enable remoting under PowerShell 7.\n\nYou will need to restart the sshd service for changes to take effect.\n\n\"@\n Write-Host $msg -ForegroundColor green\n}\n\nWrite-Verbose \"Ending SSHD setup process.\"\n<\/code><\/pre>\n\n\n\nThe code is a bit different than what you would run interactively. When you run Invoke-Command and specify a file, PowerShell treats the contents of the file as a scriptblock and runs it in a remote runspace. That is why the parameters are not typical function parameters. I'm passing the Verbose and WhatIf preferences from the original command to the script.<\/p>\n\n\n\n
Invoke-Command -FilePath .\\Setup-SSHServer.ps1 -ComputerName win10 -cred $artd -ArgumentList @(\"Continue\", $True)<\/code><\/pre>\n\n\n\nThis gives me Verbose and Whatif output from the remote Windows 10 machine. Running the script with default values works just fine. If you want, you can add in the registry lines to set the default shell. But ultimately I want to configure for PowerShell remoting over ssh so I don't need them.<\/p>\n\n\n\n
PowerShell 7 SSH Remoting<\/h2>\n\n\n\n
There's one last step to configure remoting to use ssh and that happens on the remote machine. You need to edit the sshd_config file that is found in $env:ProgramData\\ssh. Here's my copy that has been edited with the necessary PowerShell requirements.<\/p>\n\n\n\n
# This is the sshd server system-wide configuration file. See\n# sshd_config(5) for more information.\n\n# The strategy used for options in the default sshd_config shipped with\n# OpenSSH is to specify options with their default value where\n# possible, but leave them commented. Uncommented options override the\n# default value.\n\n#Port 22\n#AddressFamily any\n#ListenAddress 0.0.0.0\n#ListenAddress ::\n\n#HostKey __PROGRAMDATA__\/ssh\/ssh_host_rsa_key\n#HostKey __PROGRAMDATA__\/ssh\/ssh_host_dsa_key\n#HostKey __PROGRAMDATA__\/ssh\/ssh_host_ecdsa_key\n#HostKey __PROGRAMDATA__\/ssh\/ssh_host_ed25519_key\n\n# Ciphers and keying\n#RekeyLimit default none\n\n# Logging\n#SyslogFacility AUTH\n#LogLevel INFO\n\n# Authentication:\n\n#LoginGraceTime 2m\n#PermitRootLogin prohibit-password\n#StrictModes yes\n#MaxAuthTries 6\n#MaxSessions 10\n\n#ENABLED\nPubkeyAuthentication yes\n\n# The default is to check both .ssh\/authorized_keys and .ssh\/authorized_keys2\n# but this is overridden so installations will only check .ssh\/authorized_keys\nAuthorizedKeysFile\t.ssh\/authorized_keys\n\n#AuthorizedPrincipalsFile none\n\n# For this to work you will also need host keys in %programData%\/ssh\/ssh_known_hosts\n#HostbasedAuthentication no\n# Change to yes if you don't trust ~\/.ssh\/known_hosts for\n# HostbasedAuthentication\n#IgnoreUserKnownHosts no\n# Don't read the user's ~\/.rhosts and ~\/.shosts files\n#IgnoreRhosts yes\n\n# To disable tunneled clear text passwords, change to no here!\n# ENABLED: Set this to YES for PowerShell remoting\nPasswordAuthentication yes\n\n#PermitEmptyPasswords no\n\n#AllowAgentForwarding yes\n#AllowTcpForwarding yes\n#GatewayPorts no\n#PermitTTY yes\n#PrintMotd yes\n#PrintLastLog yes\n#TCPKeepAlive yes\n#UseLogin no\n#PermitUserEnvironment no\n#ClientAliveInterval 0\n#ClientAliveCountMax 3\n#UseDNS no\n#PidFile \/var\/run\/sshd.pid\n#MaxStartups 10:30:100\n#PermitTunnel no\n#ChrootDirectory none\n#VersionAddendum none\n\n# no default banner path\n#Banner none\n\n# override default of no subsystems\nSubsystem\tsftp\tsftp-server.exe\n#ADDED\nSubsystem powershell c:\\progra~1\\powershell\\7\\pwsh.exe -sshs -NoLogo\n\n# Example of overriding settings on a per-user basis\n#Match User anoncvs\n#\tAllowTcpForwarding no\n#\tPermitTTY no\n#\tForceCommand cvs server\n\nMatch Group administrators\n AuthorizedKeysFile __PROGRAMDATA__\/ssh\/administrators_authorized_keys<\/code><\/pre>\n\n\n\nYou might need additional changes depending on your organization. I can use PowerShell to copy this file to the remote computer, assuming OpenSSH.Server and PowerShell 7 have been installed.<\/p>\n\n\n\n
Copy-Item -Path .\\sshd_config_default -Destination $env:ProgramData\\ssh\\sshd_config -ToSession $sess<\/code><\/pre>\n\n\n\nThe sshd service should be restarted for the changes to take effect.<\/p>\n\n\n\n
Deployment<\/h2>\n\n\n\n
The last step is to pull all of this together into a master control script. I decided to add code to also install PowerShell 7 using my PSReleaseTools <\/a>module.<\/p>\n\n\n\n#requires -version 5.1<\/em>\n\n#Deployment control script to setup SSH server on a remote Windows 10 desktop<\/em>\n#It is assumed PowerShell 7 is, or will be, installed.<\/em>\n\n[cmdletbinding(SupportsShouldProcess<\/em>)]\nParam(\n [Parameter(Position<\/em> = 0, Mandatory<\/em>)]\n [string]$Computername,\n [pscredential]$Credential,\n [switch]$InstallPowerShell\n)\n\n#remove parameters from PSBoundparameter that don't apply to New-PSSession<\/em>\nif ($PSBoundParameters.ContainsKey(\"InstallPowerShell\")) {\n [void]($PSBoundParameters.remove(\"InstallPowerShell\"))\n}\n\nif ($PSBoundParameters.ContainsKey(\"WhatIf\")) {\n [void]($PSBoundParameters.remove(\"WhatIf\"))\n}\n\n#parameters for Write-Progress<\/em>\n$prog = @{\n Activity = \"Deploy SSH Server to Windows 10\"\n Status = $Computername.toUpper()\n CurrentOperation = \"\"\n PercentComplete = 0\n}\n#create the PSSession<\/em>\nTry {\n Write-Verbose \"Creating a PSSession to $Computername\"\n $prog.CurrentOperation = \"Creating a temporary PSSession\"\n $prog.PercentComplete = 10\n Write-Progress @prog\n $sess = New-PSSession @PSBoundParameters -ErrorAction Stop\n}\nCatch {\n Throw $_\n}\n\nif ($sess) {\n if ($InstallPowerShell) {\n $prog.currentOperation = \"Installing PowerShell 7\"\n $prog.percentComplete = 25\n Write-Progress @prog\n #install PowerShell<\/em>\n if ($pscmdlet.ShouldProcess($Computername.toUpper(),\"Install PowerShell 7\")) {\n\n Invoke-Command -ScriptBlock {\n [void](Install-PackageProvider -Name nuget -force -forcebootstrap)\n Install-Module PSReleaseTools -Force\n Install-PowerShell -EnableRemoting -EnableContextMenu -mode Quiet\n } -session $sess\n } #whatif<\/em>\n }\n\n #setup SSH<\/em>\n $prog.currentOperation = \"Installing OpenSSH Server\"\n $prog.percentComplete = 50\n Write-Progress @prog\n Invoke-Command -FilePath .\\Setup-SSHServer.ps1 -Session $sess -ArgumentList @($VerbosePreference, $WhatIfPreference)\n\n #copy the sshd_config file. This assumes you've installed PowerShell 7 on the remote computer<\/em>\n Write-Verbose \"Copying sshd_config to target\"\n $prog.currentOperation = \"Copying default sshd_config to target\"\n $prog.percentcomplete = 60\n Write-Progress @prog\n Copy-Item -Path .\\sshd_config_default -Destination $env:ProgramData\\ssh\\sshd_config -ToSession $sess\n\n #restart the service<\/em>\n Write-Verbose \"Restarting the sshd service on the target\"\n $prog.currentOperation = \"Restarting the ssh service target\"\n $prog.percentComplete = 75\n Write-Progress @prog\n if ($pscmdlet.ShouldProcess(\"sshd\",\"Restart service\")) {\n Invoke-Command { Restart-Service -Name sshd } -Session $sess\n }\n\n Write-Verbose \"Removing the temporary PSSession\"\n $prog.currentOperation = \"Removing temporary PSSession\"\n $prog.percentComplete = 90\n Write-Progress @prog\n $sess | Remove-PSSession\n\n Write-Progress @prog -completed\n $msg = @\"\n\nSSH Server deployment complete for $($Computername.toUpper()).\n\nIf PowerShell 7 is installed remotely, you should be able to test\nwith an expression like:\n\nEnter-PSSession -hostname $Computername -username <user> -sshtransport\n\n\"@\n\n Write-Host $msg -ForegroundColor yellow\n} #if $sess<\/em><\/code><\/pre>\n\n\n\n![\"\"](\"https:\/\/jdhitsolutions.com\/blog\/wp-content\/uploads\/2020\/12\/install-powershell-1024x607.png\")
<\/a><\/figure>\n\n\n\n
![\"OpenSSH.Server](\"https:\/\/jdhitsolutions.com\/blog\/wp-content\/uploads\/2020\/12\/sshserver-installed.png\")
<\/a><\/figure>\n\n\n\n