Login to Windows server using SSH

Sometimes it can be extremely useful to login to a Windows server using SSH. This is a procedure to achieve this.

First, download and install Bitvise WinSSHD on the Windows server. If needed, you can read the documentation first. After installation, you have to start the WinSSHD service in order to activate SSH.

Download and install Bitvise Tunnelier on another Windows computer. Try if you can connect to the Windows server. Use the credentials for the existing Windows account on the server.

Next, create a keypair with Tunnelier. If needed, you can read the documentation first.

 

Next, export the public key

 

I select the OpenSSH format.

Now, upload the public key to the Windows server (you can use standard FTP, SFTP etc. to do so). Open the WinSSHD Control Panel on the Windows server, edit the settings , go to Access Control > Windows Accounts and  select the specific user entry.

If an entry for the user you are configuring is not already present, you can add it. Now, click on the 'Keys' link and a key management window will open. Use the key management window to import the public key you have just uploaded to the Windows server.

Click OK (twice).

Now, try to connect to the Windows server again with Tunnelier (use "public key" as the initial method). You have to enter the password for the user account on the Windows server when it's asked.

If that works, you can try to connect to the Windows server using Linux. Use Tunnelier to export the private key (OpenSSH format) and upload the private key to the .ssh directory, which you can find in the user's home directory on the Linux computer. Chmod 600 this key !

Of course, OpenSSH has to be installed on the Linux computer first.

Try to connect to the Windows server using this command:

ssh -i ~/.ssh/name_of_private_key [email protected] -p portnumber (for example 22)

Hopefully this works ;-)

Login without password

It can be very neat (but risky) if you can login to the Windows server without using a password.

First, use Tunnelier to generate a new keypair. Keep the passphrase fields empty. Export the public key and upload it to the Windows server. Edit the settings in the WinSSHD Control Panel on the Windows server. Go to Access Control > Windows Accounts and select the specific user entry. Click on the "Public keys" link and import the newly created public key. Now, select "Disabled" at Password authentication and "Required" at Public key authentication. 

 
Click OK (twice) and try to login using the other computer (use "public key" as the initial method).  If everything went well, you can now login without entering a password.

If you want to login using a Linux computer, you have to export the newly created private key with Tunnelier. Don't enter any passphrase while exporting the private key! Upload the private key to the .ssh directory, which you can find in the user's home directory on the Linux computer. Chmod 600 this key ! 

Connect to the Windows server using this command:

ssh -i ~/.ssh/name_of_new_private_key [email protected] -p portnumber (for example 22)

Now, you can login to the Windows server without a password. Please, please remember to keep your keys safe !!!!

Virtual account

It's also possible to use a virtual account, so you don't have to use your Windows user account to login to SSH.

Go to WinSSHD control panel > Edit settings > Access control > Virtual accounts

Choose a new name for your virtual account and use the Virtual Users group. Afterwards, click OK (twice) and you're ready to login to SSH with this newly created username.

You can use "map remote home directory" and "Permit remote administration" (no) to jail to user account to it's own directories and keep directories of other users out of his reach, which is like a kind of chroot.