Setting Up OpenSSH Server on Windows

Several Plakar Control Plane integrations, including Microsoft SQL Server and Microsoft Active Directory, connect to Windows hosts over SSH. This guide explains how to install and configure OpenSSH Server on Windows and authorize an SSH key for the account used by Plakar Control Plane.

Check whether OpenSSH Server is already installed. If it is not, install it using the following commands:

Get-WindowsCapability -Online | Where-Object Name -like 'OpenSSH*'
Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0

Start the sshd service and configure it to start automatically whenever the system boots:

Start-Service sshd
Set-Service -Name sshd -StartupType 'Automatic'

OpenSSH Server listens on TCP port 22. Windows normally creates a firewall rule automatically when the capability is installed. Verify that the rule exists, or create it if its missing:

Get-NetFirewallRule -Name *ssh*
New-NetFirewallRule -Name sshd -DisplayName 'OpenSSH Server (sshd)' -Enabled True -Direction Inbound -Protocol TCP -Action Allow -LocalPort 22

The auto-created rule is normally scoped to the Domain and Private firewall profiles only. If the host is reached over its public IP, Windows classifies that interface as the Public profile, and the rule will silently not apply. Check the rule’s profile and add Public if needed:

Get-NetFirewallRule -Name sshd | Select-Object Profile
Set-NetFirewallRule -Name sshd -Profile Any

Also open port 22 at the network/firewall level (cloud security group, VPC firewall, etc.), in addition to the Windows Firewall rule above.

Generate a dedicated SSH keypair for PCP rather than relying on password authentication. For accounts that are members of the local Administrators group, keys are read from a dedicated file rather than the user’s own .ssh folder:

notepad C:\ProgramData\ssh\administrators_authorized_keys

Add the public key on its own line, save, then restrict the file’s permissions. SSH will silently ignore the file if permissions are too permissive:

icacls "C:\ProgramData\ssh\administrators_authorized_keys" /inheritance:r
icacls "C:\ProgramData\ssh\administrators_authorized_keys" /grant "Administrators:F"
icacls "C:\ProgramData\ssh\administrators_authorized_keys" /grant "SYSTEM:F"

Before pasting the private key into Plakar Control Plane, confirm the key and network path both work:

eval `ssh-agent`
ssh-add /path/to/private_key
ssh Administrator@<host>

A successful, passwordless login confirms the key is authorized correctly and that the network path (firewall, security group, sshd) is open.

If this is the first time connecting to this host over SSH, you will be prompted to accept its host key. This is expected; type yes to continue. To skip the prompt, connect with:

ssh -o StrictHostKeyChecking=accept-new Administrator@<host>

To verify the fingerprint instead of trusting it blindly, retrieve it directly from the Windows host, where OpenSSH Server stores its host keys under C:\ProgramData\ssh:

ssh-keygen -lf C:\ProgramData\ssh\ssh_host_ed25519_key.pub

Compare its output against the fingerprint shown in the SSH prompt before accepting.