Installing OpenSSH on Windows 10 (1803 and higher) and Server 2019

Windows Server 2019 includes OpenSSH as an optional feature for the first time, thus simplifying installation and configuration. However, errors in earlier builds of the operating system prevent a successful activation of the Secure Shell (SSH) server. In Windows Server Update Services (WSUS) environments, OpenSSH has the same problems as Remote Server Administration Tools (RSAT).
Latest posts by Wolfgang Sommergut (see all)

By porting OpenSSH to Windows, Microsoft made it easier to manage heterogeneous environments. You can remotely administer Linux computers via SSH from Windows, and thanks to the new OpenSSH server, the reverse is now also possible. In addition, PowerShell Core supports remoting via SSH, even between different OSes.

OpenSSH server is not included in the operating system ^

One would expect that a system component with such strategic importance is delivered as part of the operating system and can be installed as a feature via the Server Manager or PowerShell.

However, Microsoft has decided to provide OpenSSH as an optional feature (also called a "Feature on Demand"). This unifies the installation between the client and server OSes. The following description therefore also applies to Windows 10 from release 1803 onwards.

Installation via the GUI ^

To install OpenSSH server, start Settings and then go to Apps > Apps and Features > Manage Optional Features. As you can see from the list of installed components, the SSH client is already installed by default. The server, on the other hand, you need to add using the Add Features option.

Installing the OpenSSH server via the Settings app

Installing the OpenSSH server via the Settings app

In the list above, select OpenSSH server and click on the Install button that appears. Windows will now download the required files over the internet. If an error occurs, you will not receive a message from the Settings app, but it will simply jump back to the list of features.

Adding an OpenSSH server via PowerShell ^

In contrast, PowerShell provides more transparency. To find the exact name of the required package, enter the following command:

Finally, add the name shown to Add-WindowsCapability:

Adding an OpenSSH Server via PowerShell

Adding an OpenSSH Server via PowerShell

Alternatively, you can pass on the output via a pipe:

Faulty builds ^

There are at least two reasons why you may encounter problems here. If the build of the system is older than 17763.194, you will see this error:

The installation of OpenSSH server fails on earlier builds of Windows Server 2019.

The installation of OpenSSH server fails on earlier builds of Windows Server 2019.

In this case, you need a current cumulative update to fix the problem (documented here).

Problems with WSUS ^

A further hurdle arises if the server, which is usually the case, is updated via WSUS. Microsoft delivers features on demand bypassing WSUS, so you don't get them via the internal update server.

Therefore, it is not unlikely that PowerShell will present the following error here:

Error while installing OpenSSH as an optional feature in WSUS environments

Error while installing OpenSSH as an optional feature in WSUS environments

In the eventlog, you will then find an entry with ID 1001 stating that the OpenSSH-Server-Package is not available.

Eventlog entry when adding OpenSSH server as optional component in a WSUS environment

Eventlog entry when adding OpenSSH server as optional component in a WSUS environment

As with the RSAT, a remedy is to allow Windows to load optional features directly from Microsoft Update via group policy. This setting is "Specify settings for optional component installation and component repair," and you can find it under Computer Configuration > Policies > Administrative Templates > System.

Allowing WSUS clients to access Windows Update using Group Policy

Allowing WSUS clients to access Windows Update using Group Policy

At the same time, you must ensure that neither the setting "Do not connect to Windows Update Internet locations" nor "Remove access to use all Windows Update features" is in effect.

The latter may have been enabled to prevent users from manually downloading feature updates. This primarily affects Windows 10 rather than the server.

Activating SSH-Server ^

OpenSSH Server installs two services that are not yet running and whose startup type is manual and disabled. If you want to use SSH regularly, you will want to start the services automatically.

Displaying the startup type and status of SSH services with PowerShell

Displaying the startup type and status of SSH services with PowerShell

You can configure this via the GUI services, but the fastest way is by using PowerShell:

To put the SSH server into operation immediately, you must also start the two services manually:

This command:

checks if the settings for the two services are correct and whether they were started successfully. Now you can verify if the firewall rule for incoming SSH connections has been properly activated:

Checking the firewall rule for SSH

Checking the firewall rule for SSH

Testing the connection ^

If this condition is also fulfilled, the connection test is good to go. From a Windows 10 PC or a Linux computer, you can connect to the freshly configured server:

This will direct you at the old command prompt, but you can also start PowerShell there.

Establish a connection to a freshly installed SSH server

Establish a connection to a freshly installed SSH server

Finally, you should consider whether you would like to use public key authentication for security reasons. This also increases user comfort because you no longer have to enter a password. This guide describes how to do this.

Join the 4sysops PowerShell group!

Your question was not answered? Ask in the forum!

3+
avataravatar
Share
2 Comments
  1. Jorge 1 year ago

    No working on Windows 10 1809 offline os build 17763.404

    Error 0x8024402c

    No matter what I do. Its an offline pc. I wish not have it connected.

    Tried everything, and openssh.client is installed correctly

    Any clue?

    0

  2. Jorge 1 year ago

    It works online.

    I just find out that 1809 wont come with OpenSSH.Server as it its now a "Feature on Demand"

    Have to grab it from Windows 10 FOD ISO in MSDN.

    Sad.

    2+
    avatar

Leave a reply

Your email address will not be published. Required fields are marked *

*

© 4sysops 2006 - 2020

CONTACT US

Please ask IT administration questions in the forums. Any other messages are welcome.

Sending

Log in with your credentials

or    

Forgot your details?

Create Account