11 ms·
OpenSSH for Windows update
- andrewstuart 11y agoIt would be good if there was a good free terminal for Windows. The only option is putty.
- hetman 11y agomintty is excellent. I also find ConsoleZ works well for running cmd.exe but it's not fully xterm compatible like mintty.
- teh_klev 11y agoCheck out MobaXTerm: http://mobaxterm.mobatek.net/ http://mobaxterm.mobatek.net/ I don't work for them, I just think it's a nice tool, so much so I paid for the Pro version.
- 8draco8 11y agoIt's not the best butt it's better than the others. You can always enhance putty features using MTPuTTY http://ttyplus.com/multi-tabbed-putty/ http://ttyplus.com/multi-tabbed-putty/ worth trying
- deleted 11y ago[deleted]
- nailer 11y ago> Leverage Windows crypto api’s instead of OpenSSL/LibreSSL and run as Windows Service Was wondering about that. I'm surprised the OpenBSD team is accepting the commits - something so fundamental and Windows specific doesn't seem like their kind of thing - but great! PS. If you're coming from a Unix background and interested in learning posh: https://certsimple.com/rosetta-stone https://certsimple.com/rosetta-stone
- daguava 11y agoWas just coming here to voice my concerns over this choice as well, wondering what their reasoning is for changing crypto systems.
- scott_karana 11y agoDuplication of effort and attack surface. Now, instead of worrying about just keeping Windows' crypto api secure, Microsoft would have to worry about libressl as well? Long term, if this is truly a first-party supported SSHd, it makes sense.
- thristian 11y agoA crypto system is a big and complex thing, subtle and quick to anger, and I can't blame Microsoft for wanting to concentrate on the one they're already supporting, instead of having to support two. On the other hand, for the exact same reason, I expect OpenSSH probably isn't interested in supporting anything besides LibreSSL and maybe OpenSSL, at least while they're so closely related.
- nailer 11y agoSo you think it'll remain a fork, rather than a platform for OpenSSH? If they implemented a good openssl to cryptoAPI shim it could be usable by other projects linked against OpenSSL.
- 11y ago
- mavhc 11y agoI suggest making Update update, ie lower case, I was confused as to why Windows Update was getting ssh
- epistasis 11y agoOr perhaps even "Update on OpenSSH for Windows", which eliminates that ambiguous structure and maintains headline capitalization.
- mhurron 11y agoI thought standard title rules were every word other than words like 'and' and 'is' were capitalized.
- bradjohnson 11y agoI don't believe there is a hard rule for titles that should take precedence over clarity.
- gionn 11y agoI am waiting the moment when I can throw away WinRM and SSH to all the servers.
- togusa 11y agoHell yes. Watching packer shit a brick 5 times a day trying to upload virtualbox guest additions via WinRM makes me want this yesterday. Also I had to up the memory ceiling on WinRM to 800Mb (WTF!) to even get it to complete.
- MichaelGG 11y agoIt really is surprisingly bad, isn't it? I recently was involved in a continuous deployment system targeting Windows. We simply couldn't get WinRM to reliably upload fast and ended up installing SSH everywhere.
- togusa 11y agoYep definitely the worst thing ever. Not just that though; everything. I've lost so much hair in the last few months over trying to get a CD environment up on windows.
- switch007 11y agoThis. Everything about Windows and automation just feels like Bill & co really hates you personally, hates your company, and even the air you breath
- kasabali 11y ago> Address POSIX compatibility concerns Best way to address POSIX compatibility concerns is implementing a proper POSIX layer in Windows (and not in a half-baked manner like the now deprecated SUA). I can't imagine how it would hurt anybody.
- togusa 11y agoBecause people would build for that instead of Win32.
- shmerl 11y agoSo how would it hurt anybody exactly?
- kasabali 11y agoThat is a valid concern. On the other hand, win32 has a strong developer community with 20+ years of legacy as the primary API of Windows. Now only if Microsoft hadn't try to screw its own developers by trying to push a new framework every 5 years.
- togusa 11y ago
- alpb 11y agoFor those interested the source code is here: https://github.com/PowerShell/Win32-OpenSSH/ https://github.com/PowerShell/Win32-OpenSSH/
- deleted 11y ago[deleted]
- csours 11y agoVery off topic - I thought that publically was a mis-spelling, but apparently it may be acceptable now! http://english.stackexchange.com/questions/45136/difference-between-publicly-and-publically http://english.stackexchange.com/questions/45136/difference-...
- phippsbrad 11y agoI have had really good luck with this open source, native windows, ssh server. http://www.kpym.com/2/kpym/index.htm http://www.kpym.com/2/kpym/index.htm I have no affiliation with the project, i just thought i'd mention that it is a nice alternative i found.
- drzaiusapelord 11y agoWhy does this support telnet? Just seems crazy to me. Is it on by default? That would be a violation of any sane security policy pretty much anywhere. Seems like a serious edge case requirement and odd to bundle with SSH. This is like buying a new car but then having the dealer give you a free horse with your purchase.
- mschuster91 11y agoTelnet has the unique advantage of having an implementation for the opposite part on any TCP/IP compatible system without external libraries, crypto etc. and that you can recreate both a server and a client in literally an hour with nothing but a C compiler and an ordinary libc.
- voltagex_ 11y agoBlargh. Another OSS project that doesn't expose any kind of version control (7zip is the worst offender). I know, gift horse etc etc but it does make it hard to track the history / future of the project. Also looks like it hasn't been updated since 2011.
- angersock 11y agoOut of curiosity...why run this as a service? EDIT: I misread this and though it was only a client. Geez. If it's a server, then of course it should be a service.
- daveloyall 11y agoSo that you can ssh into a machine without manually starting sshd (or ssh-service) first.
- duskwuff 11y agoHow else would you expect an SSH server to run? As a desktop application?
- angersock 11y agoOh, I thought this was just a client.
- charonn0 11y agoProbably so that it can keep running even if no user account is logged in.
- barkingcat 11y agosshd on unix runs as a daemon, similar to a windows service.
- deleted 11y ago[deleted]
- cakes 11y agoI'm interested in how this is going to work in PowerShell with the way everything works now, if there happen to be any details about that (whether here, somewhere else, or a past link)?
- daveloyall 11y agoI don't know anything about PowerShell, but I have a similar question, I think: how is this going to work? Will I be able to do something like this command line (from my *nix machine)? ssh user@windows.machine.local dir d: | less
- deleted 11y ago[deleted]
- joosters 11y agoYou should be able to do that just fine. 'dir d:' runs on the windows box and 'less' on the unix box.
- daveloyall 11y agoExcellent. That's very useful!
- roller 11y agoThis is a key thing I'm curious about. How is drive mapping handled? If I "net use d: \\host\share" from one session, it won't nessarily translate and mount D: to all sessions (or will it)?
- voltagex_ 11y agoI can't check right now, but if you have two local users, Delta and Gamma, and Gamma mounts D:\, does Delta see it or is it specific to Gamma's session?
- 11y ago
- switch007 11y agoThe comment submit button doesn't even work in Safari. That must have taken some effort to break.
- callesgg 11y agoThat is great, i have tried some ssh servers for windows they have all been constantly crashing or not working with ssh keys.
- DiabloD3 11y agoThis is very goddamned awesome. All I hope is I can set the default user shell for my account. I already use msys2's zsh for my shell (because I use zsh everywhere, on all OS), and being able to ssh into my Windows machine 'normally' (for me, anyways) would be extremely useful.
- voltagex_ 11y agoInteresting, they're still using MinGW. I wonder if they'll ever get it to build under MSVC?
- int_handler 11y agoThis is exciting to hear. I might be overly nitpicky, but holy inconsistent coding styles Batman: compare https://github.com/PowerShell/Win32-OpenSSH/blob/bafc1df7c5c15dbdd2e0c0112936a74d97d9f327/contrib/win32/win32compat/cng_cipher.c https://github.com/PowerShell/Win32-OpenSSH/blob/bafc1df7c5c... to the other source files.
- lukeh 11y agoUgh. And calling strcpy() with user-supplied data inside a SSP of all places... :-(
- int_handler 11y agoThis is exciting to hear. I might be overly nitpicky, but holy inconsistent coding styles Batman: compare https://github.com/PowerShell/Win32-OpenSSH/blob/bafc1df7c5c15dbdd2e0c0112936a74d97d9f327/contrib/win32/win32compat/cng_cipher.c https://github.com/PowerShell/Win32-OpenSSH/blob/bafc1df7c5c... to the other source files.
- ryanprichard 11y agoWill this OpenSSH server be able to run interactive console programs (like cmd.exe or python.exe), or will it be limited to (say) PowerShell? Windows doesn't have a good API for hosting a console--it's not like Unix, where a pty has a master end and a slave end. Trying to run a console program in mintty.exe (https://github.com/mintty/mintty/issues/56 https://github.com/mintty/mintty/issues/56) or Cygwin SSHD fails for this reason. I wrote a tool, winpty, that makes a best-effort attempt to emulate a Unix pty master by scraping the console buffer, but it has some limitations, so I'm not sure Microsoft would want to use it. Maybe they would expand the console API?
- toyg 11y ago> Will this OpenSSH server be able to run interactive console programs I would think so. Anything less would not be a real SSH server.
- asveikau 11y agoI too was very skeptical. Something about posts from "The Powershell Team" about porting sshd makes me deeply cynical that they would get the integration right from a layering perspective, i.e. as if they would make it support powershell and nothing else. Fortunately this example shows it going straight into cmd and then they invoke powershell as a next step: C:\Master>ssh.exe -l user@127.0.0.1 user@127.0.0.1's password: ********** Microsoft Windows [Version 10.0.10566] (c) 2016 Microsoft Corporation. All rights reserved. user@DEV-10566-829 C:\Users\user>powershell -File - - https://github.com/PowerShell/Win32-OpenSSH/wiki/ssh.exe-examples https://github.com/PowerShell/Win32-OpenSSH/wiki/ssh.exe-exa... That gives me some hope that it's being done right.
- geofft 11y agoThere are these two interesting commits, "Add pty mode support code": https://github.com/PowerShell/Win32-OpenSSH/commit/55f2ec6825e720e1395d77ece55fb411c861bb18 https://github.com/PowerShell/Win32-OpenSSH/commit/55f2ec682... and "Add ANSI parsing engine and console draw support to SSH client": https://github.com/PowerShell/Win32-OpenSSH/commit/7aac59e524e6dc9f1c1faed18340cff7dfd9a47c https://github.com/PowerShell/Win32-OpenSSH/commit/7aac59e52... Something about this reminds me of ANSI.SYS.
- ams6110 11y agoI've been running OpenSSH on Windows servers for years, using Cygwin.
- jamiesonbecker 11y agoCool. Looks like Userify.com (SSH Key management) will support yet another platform sometime next year. (disclaimer: I work there.)
- martin1975 11y agoNever was much of a windows fan, so a (slightly ignorant) question for someone who is a Win admin - can most administrative things nowadays be done via the command line on Windows (like we've been able to do in *nix land) or is there a gap between what can be done via the GUI vs the command line?
- detaro 11y ago(From what I've heard from people using them) On the current server versions, PowerShell should allow to do all that the GUI can do. There is a GUI-less version and I think the GUI actually uses PowerShell underneath, so you can look up in a log how the commands look like for something you only knew how to do graphically before.
- TTPrograms 11y agoThat is so cool. I have to look into this...
- Sanddancer 11y agoYep. Recent windows servers even default to boot straight to console these days, with none of the GUI services running. MS has realized that centralized deployment and maintenance is really useful and is acting accordingly, hence things like openssh for windows.
- tammer 11y agoFrom a sysadmin in the field - it's complicated. New Server features are primarily controllable via PowerShell and now only secondarily expose a bit of control via GUI. So, indeed PowerShell has taken precedence. However, it would be wrong to say that Windows administration is exactly like managing Unix systems. On the contrary, the more one works with it the more one realizes PowerShell is the anti-Bash. Lacking in the aeons of interface legacy built into standard Unices, you won't find standbys like 'grep' readily available or even easily implemented. Rather, PowerShell is built from the ground up for scripting. While the addition of SSH will certainly be helpful for quickly checking statuses, (and possibly more in the future should readline usability of PowerShell improve) right now most PowerShell interactions happen via scripting from a local workstation or web or application inputs rather than directly via the interactive shell.
- j_s 11y agoI'm a fan of Bitvise SSH for a Windows SSH server; it's been enough to replace Terminal Services when each employee has their own work machine to remote desktop into. It's nice that Microsoft recognizes the need for this functionality; I wonder how they will approach the potential per-client licensing issues they like to bring up with their server OS's. https://www.bitvise.com/ssh-server https://www.bitvise.com/ssh-server
- meneses 11y agoThat's a good engineering project. Lucky team working on it!
- e12e 11y agoThe more things change..., from: https://github.com/PowerShell/Win32-OpenSSH/wiki/Deploy-Win32-OpenSSH https://github.com/PowerShell/Win32-OpenSSH/wiki/Deploy-Win3... "If you need key-based authentication: Install key-auth package run setup-ssh-lsa.cmd reboot" Reboot? And this gem: "SSH daemon needs to run as System to support key-based authentication". Which means, either use weak authentication, or run the daemon as system. I don't even understand why, it's not like the public keys are particularly sensitive (certainly much less sensitive than being able to check passwords for validity)?
- Asmod4n 11y agoRegarding System User: https://github.com/PowerShell/Win32-OpenSSH/issues/2 https://github.com/PowerShell/Win32-OpenSSH/issues/2, it needs that right to generate user tokens
- e12e 11y agoThank you for that. It makes a certain kind of sense, that impersonating a user/creating user sessions requires a high privilege. I think I'd still be more happy with it running as a low privilege user allowing log-in as "nobody"/"guest" and then elevating to a user with login/pw via "runas" or equivalent. I can see how the only way to login directly to a certain user id would either require ssh to run as that user id or as System.
- switch007 11y agoThat is the crux of it. Windows is not going to fundamentally change its authentication system to work around SSH. It's going to feel "hacky" compared to SSH on *NIX (also console interactivity). You'll still need to run Windows updates as a scheduled task as the system user because remote connections have a remote token and the Window Update API blocks such connections...
- kohenkatz 11y agoHave you checked what user OpenSSH usually runs as on a linux machine in order to allow key-based authentication? I'll give you a hint: it's root. That's no different than running as SYSTEM on Windows.
- doxcf434 11y agoWhat's the plan for supporting OpenSSH in the long run? Or is this just a one off port that will become stale after a few years?
- rm1999 11y agoA great openssh for windows for the time being. Being using this and it is great, only thing is not able to do powershell from it once connected to host. http://www.mls-software.com/opensshd.html#botpage http://www.mls-software.com/opensshd.html#botpage