23 ms·

Windows Server 2019 Includes OpenSSH

431 points by taspeotis 8y ago

mscasts 8y ago
That is really something, before as a dev coming from linux when I first was about to login on a Windows Server I didn't understand how to do it since it were no SSH. Administrating the server via a GUI always felt backwards somehow. Why waste CPU cycles on rendering a UI when the CLI is so great (on linux)?
- ocdtrekkie 8y ago
  Microsoft has come a really long way recently towards moving to CLI-based management. Starting with Server 2016, the default installation method of Windows Server no longer includes most of the GUI (called the Desktop Experience), leaving you with a command prompt window in the middle of the screen instead. An even thinner version of Windows Server, Nano Server, is also available, and includes even less GUI, being much more like a Linux terminal UI, though it is a bit less intuitive to get started with as you can't even install it, you have to image it to deploy. Most Windows admins still prefer a lot of GUI management (I've gotten some groans in response to my statement new servers would tend not to have it), but remote desktop to the server is no longer the preferred way to do that: Remote Server Administration Tools effectively installs all of the server GUI on your desktop PC. Due to the number of legacy applications Windows Server folks tend to support, it's unlikely server GUIs are going away entirely anytime soon, but for a lot of basic server functions supported directly by Microsoft, it's doable. And in addition to not wasting processor and memory pushing pixels, Windows Servers without the GUI are susceptible to less attacks, require less changes during Windows updates, and reboot faster, all on account of just having "less" onboard.
  - scarface74 8y ago
    I’ve been developing on and for Windows for 20 years and just started doing anything with Linux earlier this year. If you told me I had to do anything advanced with Windows using only a CLI, I wouldn’t know where to start. On the other hand, I could maneuver my way around a bash shell. I haven’t thought about that before now.....
    - TimTheTinker 8y ago
      I think it's time for MS to develop a new ANSI/VT-compliant, text-oriented shell (to complement PowerShell, which is largely object- and API-oriented). There ought to be a default shell worth using on the other end when you ssh into a Windows server :) cmd.exe and DOS were both text-oriented but extremely buggy and inconsistent. Perhaps MS could just focus on providing a very bash-like language (perhaps even include gnu utilities) while supporting the major interactive use cases for cmd.
      - ocdtrekkie 8y ago
        I doubt you'd see Microsoft reinvent the wheel here. They'd more likely work to give WSL more ability to interact with Windows, and then let you just use that shell if you want to.
        TimTheTinker 8y ago
        How likely is it that MS will include and enable WSL by default on Windows Server just to provide a better default shell for terminal and ssh users? If I were a server admin, I’d probably turn all of that off because it’s more attack surface area. And cripple myself in the process. For that reason alone, I think a new shell is probably more likely to be helpful.
      - jackfraser 8y ago
        Why would they do that when Powershell is literally that, but refined beyond what's commonly available on Linux? I'm not great with it yet, but it feels intuitively like a step forward to be able to pass objects around instead of spending so much of my time using awk-ward 40 year old tools to tease text out of various fields.
        grumpydba 8y ago
        However it is far too verbose and without aliasing everything it's a big pain in the a to use.
        8y ago
  - slededit 8y ago
    They started on this in the late 2000s when I was an intern there. But there was a lot to untangle. It’s the biggest refactoring job you can imagine. A decade long effort. Back then they didn’t really understand the point of ssh though. They had a vision of remote management via .net RPC and powershell.
    - TimTheTinker 8y ago
      > Back then they didn’t really understand the point of ssh though. As an outside observer, it really looked to me like Microsoft had their head in the clouds up until about 2011. It's like the whole decade between 2005-2015 for MS was about recognizing and coming to terms with the multiple "whole worlds out there" and getting past NIH syndrome.
      - kwccoin 8y ago
        To be fair to Kodak, it is very hard to invent digital photography but fail greatly to use it. Or Xerox, ... or IBM who is the largest PC seller exactly the time when it was overwhelmed by Microsoft. An organisation large enough would have middle management and people who promote from within. And they are successful in one culture and it worked even for customers. Then ...
      - slededit 8y ago
        They understood the GUI couldn’t be everything but NIH was definitely in full swing at that time. It was enforced from the top: If you wanted to use an external product and MSFT had a competitor you needed VP approval. Same went for Open Source. Only the most senior people would even attempt it, and it was understood they were spending political capital. The one place this didn’t apply was your choice of code editor. You could use whatever you wanted and that had long been tradition. I spent a lot of effort getting VIM to work only to realize it didn’t scale well to multi-million LOC code bases.
        killjoywashere 8y ago
        As someone who uses Vim on relatively large files daily (500k - 1.5M lines), where were the hangups?
  - usrusr 8y ago
    I think it's more a compatibility thing than an original desire for more CLI. All that deployment tooling built on top of scp, protocols like git over ssh. Without ssh, Microsoft would forever be out of that game. Those things are definitely not "not CLI", but the CLI question is not in focus.
  - Silfen 8y ago
    Shameless plug: There's also remote GUI support through Windows Admin Center. You can manage your headless server through the browser on your workstation. It's also a good way to learn CLI-based management (the implementation is almost all powershell scripts, and there is a "show script" feature) https://docs.microsoft.com/en-us/windows-server/manage/windows-admin-center/overview https://docs.microsoft.com/en-us/windows-server/manage/windo...
    - amaccuish 8y ago
      Still doesn't do AD and DNS etc. So I'm still RDPing from my Mac to get access to RSAT.
  - cm2187 8y ago
    I am not aware that windows is rendering any pixel while no active desktop session is launched. You have less binaries and probably a smaller memory footprint without desktop but I would be surprised if the performance difference was material.
  - mycall 8y ago
    How does RSAT compare to the new Windows Admin Center?
    - snuxoll 8y ago
      The Windows Admin Center currently doesn't cover everything that the RSAT does, notable omissions include anything related to Active Directory. Personally, the Windows Admin Center is a nice-to-have tool for quick tasks by inexperienced or occasional admins - but you really should just learn Powershell.
    - AnIdiotOnTheNet 8y ago
      WAC is a lot like the new settings panels Microsoft keeps pushing. Bloated and with half the functionality of their predecessor.
- alkonaut 8y ago
  There were multiple ways to get non-GUI shells on remote machines before too. WinRm/WinRs and PowerShell are included out of the box.
  - mscasts 8y ago
    Yeah sure, but this was before Powershell was available afaik.
  - minxomat 8y ago
    Not to mention SSH via cygwin, which worked pretty well even back on Windows XP.
  - tacticus 8y ago
    Winrm stopped being usable if the machine was overly remote.
  - new12345 8y ago
    Most of these alternatives are not installed on windows server for security/maintenance overhead reasons by IT administrators and developers are forced to live with slow and cumbersome RDP(not to mention zero capability for scripting) for accessing machines. Now that Microsoft has finally realized the importance of remote shell access for servers and has included it in OS by default, it will become convenient alternative to RDP.
    - jodrellblank 8y ago
      WinRM / PS Remoting has been installed and enabled by default since Server 2012, and RDP disabled by default.
  - deleted 8y ago
    [deleted]
- sixothree 8y ago
  Most of those GUIs are just wrappers for the CLI to begin with. Heck, the default installation of windows does not even have a GUI. People ahem really need to update their thinking of what it means to be Windows.
  - zbentley 8y ago
    That's misleading at best (GUI windows apps that technically can be emulated from the commandline often practically cannot be--CLI tools or the registry/config-file interactions required to perform actions that are clearly exposed and well-documented in the GUI often have nonexistent or terrible documentation. In even marginally complex apps, this puts the effort required to script the functionality of the GUI on par with the effort of reverse engineering it--and that's Microsoft-authored tools and Windows functionality, which is worlds ahead of most third-party software in scriptability) and just plain false at worst (huge swaths of stuff just don't have APIs that are accessible without writing and compiling code--PowerShell and very aggressive pushes by Microsoft for WMI/CMI and WinRM more recently have only just begun to erode that).
    - sixothree 8y ago
      How is it misleading at all? Hyper-V Manager for example is literally a wrapper for Powershell commands. Virtually all Windows administration can be done entirely in Powershell. And like I said, the literal default installation of Windows does not even include a GUI.
      - icedchai 8y ago
        What do you consider the "literal default installation"?
        kivikakk 8y ago
        Something very, very different to everyone else, it would seem.
- EPress1970 8y ago
  Because you can't see My Pictures and open Office docs via CLI
- AnIdiotOnTheNet 8y ago
  Microsoft's GUI management tools were really good and generally very discoverable. IMO they were a much better way to manage an OS than cryptically named CLI programs and text files. And most of them worked remotely. And by comparison to modern software they can not even remotely be considered bloated. Every electron application ever made is larger than all of RSAT. Now of course they suck ass because MS has no idea what it's doing anymore.
  - amazingman 8y ago
    Those cryptically named programs are scriptable, and those text files (including scripts) are easy to version and backup.
    - TomMarius 8y ago
      Windows was and is scriptable as well (but it must be said that you mostly had to discover it yourself, documentation was lacking) Backup is done the other way around, you backup your configuration scripts
    - AnIdiotOnTheNet 8y ago
      Windows servers used to have a NTBackup, which could just back up all the settings ("system state") if that was what you wanted for some reason.
      - brian_herman__ 8y ago
        Windows Server Backup doesn't do this on 2016 or 2019?
  - bayindirh 8y ago
    It's almost 2019. Are we still fighting over this? OTOH, purely from my experience, MS's tools are good for managing a domain, or some computers. When you start to administer hundreds or thousands of servers, scriptability of CLI tools and pliability of text files trumps all computer automation. xCAT and Salt are two tools (that I use regularly) which are built on these properties and can manage thousands of servers with a "flick of a finger".
- jimmaswell 8y ago
  For just one thing, I find it a lot nicer being able to edit config files in Notepad++ or something instead of vim or nano. In my case I mount the remote Linux server as a drive on Windows.
  - godzilla82 8y ago
    Mounting requires other ports to be opened, which no sysadmin will do on the internet. Ssh on the other hand can be started on a non standard port.
    - cpach 8y ago
      IME most Windows servers are not directly exposed to the Internet, instead one would reach them via VPN.
      - yrro 8y ago
        It's a shame you can't use the Common Internet File System over the Internet. ️
        arethuza 8y ago
        But you can use SMB e.g. Azure File Storage
        amaccuish 8y ago
        FYI, CIFS refers specifically to the version of SMB1 that was submitted as an RFC. You should absolutely not be using "CIFS" these days.
        yrro 8y ago
        Wait, they renamed it back?
    - jimmaswell 8y ago
      I do it over SFTP with a program called SFTP Net Drive. No additional ports besides the existing SSH.
- dijit 8y ago
  So, I am not a big fan of windows- so do not take this for defence of windows. But my understanding is that windows fleets are just administered drastically differently than Linux fleets. On Linux we have a lot of config management tools and commandline remote administration kits. In windows they have SCCM and remote access GUIs which do not get rendered on the target server. It’s very common to see a GUI program which does something pretty basic but over 500+ windows machines in windows heavy shops. In fact when I explained that I do all my scripting with a local target (because I use salt stack which is essentially a remote execution framework before it is a config management system) I was told in no uncertain terms that I was doing things the “old way”.
  - voltagex_ 8y ago
    This is changing: * Desired State Configuration: https://docs.microsoft.com/en-us/powershell/dsc/overview https://docs.microsoft.com/en-us/powershell/dsc/overview * Powershell Remoting (please, please let SSH replace this) * Microsoft's new command line push - cmd and the underlying console have had big updates recently * https://github.com/microsoft/console https://github.com/microsoft/console * https://blogs.msdn.microsoft.com/commandline/2018/07/20/windows-command-line-inside-the-windows-console/ https://blogs.msdn.microsoft.com/commandline/2018/07/20/wind...
    - orra 8y ago
      Desired State Configuration is not supported by PowerShell Core v6, even on Windows. DSC is only supported by PowerShell v5 and earlier. This suggests to me that DSC has been abandoned In contrast, .NET Core supports various old Windows-only features, such as COM and soon WinForms.
    - setquk 8y ago
      Yes and no. Having used DSC and powershell remoting extensively, these create as many problems as they solve. Nothing works smoothly. Not a thing. The saving grace here will be SSH because then at least we can drive all our kit across both platforms from Ansible and be done with the entire MSFT management stack. At the moment we use Ansible but it runs over WinRM which is completely unreliable due to some architectural problems with how WinRM works. Really, automation on Windows is extremely costly compared to Linux. I've got to the point I never want to run Windows infrastructure again. Before anyone says "it's getting better". That has been the case from 10 years and it only got different.
- h1d 8y ago
  It's not the CPU cycle but lag that makes me feel like I'm on a laptop from 15 years ago.
deleted 8y ago
[deleted]
sashavingardt2 8y ago
Party like it's 1999!
- hk__2 8y ago
  I know it’s a joke, but OpenSSH is not that old: its initial release was in December, 1999.
  - flukus 8y ago
    Looks like it was forked from some predecessors ( https://en.wikipedia.org/wiki/Secure_Shell#OSSH https://en.wikipedia.org/wiki/Secure_Shell#OSSH) but doesn't go into the history much more than that. I remember telnet, where there any encrypted predecessors before the ssh family?
    - deleted 8y ago
      [deleted]
    - Diederich 8y ago
      > where there any encrypted predecessors before the ssh family? None that were mainstream/widely used.
    - jamieson-becker 8y ago
      OpenSSH was forked from the original SSH (version 1) code by Tatu Ylönen after it went closed source in the mid-1990's IIRC. https://www.openssh.com/history.html https://www.openssh.com/history.html
    - jabl 8y ago
      There was/is kerberized telnet/rsh/rlogin, with optional encryption.
    - Fnoord 8y ago
      Telnet over SSL.
  - rauhl 8y ago
taf2 8y ago
So now I’m just waiting to hear Microsoft is switching its kernel to Linux. Especially after the switch to chromium.
- eriken 8y ago
  I would terminate my apple dependency in a heart beat.
- axaxs 8y ago
  Not sure if a joke, but I'd absolutely love this. I, as a consumer, would gladly pay good money to be able to use Outlook and the MS Office suite. Regardless of what anyone claims, the linux alternatives are useable but not nearly as good. I used to use Windows with Cygwin, but found I spent way more time doing linux-y things than Windows-y things...so switched away.
  - tmh88j 8y ago
    Why not Mac? Best of both worlds.
    - copperx 8y ago
      I would have said the same thing a year ago. Today not so much because Apple hardware prices have skyrocketed. It used to be that a Mac cost 2x the PC equivalent, but now the cost is reaching 3x. For many, especially considering engineering salaries, that's justified. To me, having the familiar GNU toolchain and Linux configuration available at any moment without having to use a VM or Homebrew is worth the downgrade in eye candy.
      - tmh88j 8y ago
        >Today not so much because Apple hardware prices have skyrocketed. He said >I, as a consumer, would gladly pay good money to be able to use Outlook and the MS Office suite. You can do that on a Mac.
      - lostlogin 8y ago
dfabulich 8y ago
It's available out of the box in Windows 10 April 2018 Update, as well. Just pop open a Command Prompt and type "ssh."
- ocdtrekkie 8y ago
  Actually, note that Windows 10 has the OpenSSH client, "ssh", but to my knowledge, does not include the ability to be an OpenSSH server. EDIT: 1803 build appparently can get OpenSSH Server running, but it's "a bit of work": https://www.bleepingcomputer.com/news/microsoft/how-to-install-the-built-in-windows-10-openssh-server/ https://www.bleepingcomputer.com/news/microsoft/how-to-insta...
  - mgamache 8y ago
    I am running this on AWS. It was a 30 minute exercise and it's only available on the 'core' AMI. This means there is no GUI even if you wanted one. I do like the ability to run regular CMD or PowerShell. I am experimenting with using SSH to automate deployments to Windows Server.
    - alexeldeib 8y ago
      TIL there's an AWS Windows AMI that comes without a GUI. Another user in the thread was talking about the "default install" of Windows not containing a GUI; wonder if this is what they meant.
      - vetinari 8y ago
        If you install Windows 2016 RTM without changing a single option, you will end up without GUI. You have to choose "desktop experience" during install to get the traditional desktop installed.
  - mams 8y ago
    Looks like the latest version is a lot simple to use... Just install the optional server feature and start sshd service. https://docs.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse https://docs.microsoft.com/en-us/windows-server/administrati...
npmaile 8y ago
Now all they have to do is switch their kernel to linux, their gui to kde and get their office suite to LibreOffice, and Windows will be the perfect computer.
- briandear 8y ago
  I don’t use LibreOffice or Office anymore, but is Libre actually a better product?
  - maxxxxx 8y ago
    It's not. Office is much better. Unfortunately :-(
  - snazz 8y ago
    It has a lot more UI options, so you can remove the Ribbon and other controversial UI elements. It’s also scriptable in JavaScript and Python [0], which is an improvement over VBA for the HN crowd. [0]: https://help.libreoffice.org/Common/Scripting https://help.libreoffice.org/Common/Scripting
    - freehunter 8y ago
      Office 2016 lets you replace VBA with Javascript, for what it's worth.
- emilfihlman 8y ago
  Windows ux is better out of the box than on any Linux so far, it's really polished. The office suite is also much better than alternatives. So just switching the kernel to Linux would be enough and super winrar.
  - aaaaaaaaaab 8y ago
    Windows UX is really polished? Are you on Win7 by any chance?
ericseppanen 8y ago
It's interesting that their ssh-agent runs as a service under an Administrator account. I'd guess this is an attempt to better protect the private key against theft during a local compromise (i.e. unlocked computer left running on your desk). I haven't seen this done on Linux. Has this trick been implemented on other systems?
- ericseppanen 8y ago
  Useful reading: https://blog.netspi.com/stealing-unencrypted-ssh-agent-keys-from-memory/ https://blog.netspi.com/stealing-unencrypted-ssh-agent-keys-... https://blog.ropnop.com/extracting-ssh-private-keys-from-windows-10-ssh-agent/ https://blog.ropnop.com/extracting-ssh-private-keys-from-win...
deleted 8y ago
[deleted]
ratsbane 8y ago
That's really nice that they've finally decided to add something that a lot of people needed in 2005.
- mixmastamyk 8y ago
  The Ballmer barrier.
- baroffoos 8y ago
  They also got notepad to not blow everything up when opening a file with normal line endings. It still fucks everything up when creating new files though.
  - guardian5x 8y ago
    I guess, with "normal" line endings, you mean <LF> instead of <CR><LF>.
    - aerique 8y ago
      He means the defacto standard, yes.
      - boomlinde 8y ago
        Not the defacto standard, but plain POSIX. Carriage return + line feed to enter a new line starting at the left margin makes perfect sense mechanically, though, and a lot of systems with ASCII/ASCII-like encodings use some variation of this sequence (e.g. <cr><lf> or <lf><cr>) for "newlines". Of course, in the interest of compatibility I'd prefer if it was one way or another, but I don't think it's fair to say that POSIX is the defacto standard. Lines in network protocols, for example, typically use <cr><lf> as well.
tachion 8y ago
The only thing that’s now left for them to do is to donate to the OpenSSH project :)
- deleted 8y ago
  [deleted]
- _rs 8y ago
  Actually Microsoft has donated every year since 2015 to the OpenBSD Foundation, with 2018 listed as $25-50k (https://www.openbsdfoundation.org/contributors.html https://www.openbsdfoundation.org/contributors.html).
- ghewgill 8y ago
  Microsoft is a frequent contributor to the OpenBSD Foundation: https://www.openbsdfoundation.org/contributors.html https://www.openbsdfoundation.org/contributors.html
dana321 8y ago
Thats nice. How about adding it to Windows 10?
- polar 8y ago
  https://blogs.msdn.microsoft.com/powershell/2017/12/15/using-the-openssh-beta-in-windows-10-fall-creators-update-and-windows-server-1709/ https://blogs.msdn.microsoft.com/powershell/2017/12/15/using...
- sandyarmstrong 8y ago
  The very first sentence of the article is: > The OpenSSH client and server are now available as a supported Feature-on-Demand in Windows Server 2019 and Windows 10 1809!
  - dana321 8y ago
    I know that, i've tried it and its really laggy. It might as well not be there at all.
    - mams 8y ago
      you might want to create an issue for their devs to look into. https://github.com/PowerShell/Win32-OpenSSH/issues https://github.com/PowerShell/Win32-OpenSSH/issues
- deleted 8y ago
  [deleted]
sys_64738 8y ago
Microsoft is becoming the defacto leader in open source.
- nwah1 8y ago
  This is almost undeniable. Seems like everyone and their mother are using vscode, typescript is huge, .NET Core is FOSS, PowerShell is now open source, etc etc. The Language Server Protocol has revolutionized IDEs in general. And now that they own GitHub (and their projects like Atom), it seems like the entire FOSS developer workflow is likely to be from MS-derived projects. Which I'm sure they are hoping will translate into more cloud service revenue and online software subscriptions. If you are starting a new company, BizSpark is a really attractive offering. Could run a whole business on it, and yet none of your devs need to be running windows on their machines.
  - sleet 8y ago
    Unfortunately Bizspark is only available though accelerators, incubators, and VCs now.
    - manigandham 8y ago
      Bizspark doesn't exist anymore, it's a single program called Microsoft for Startups now, and it does allow you to apply directly: https://startups.microsoft.com/en-us/faq/ https://startups.microsoft.com/en-us/faq/
      - morpheuskafka 8y ago
        But it's only for those developing an "innovative, technical solution unique in the market with a B2B focus that will benefit from access to enterprise customers," according to that link. IIRC the old BizSpark didn't have as strict of a B2B focus.
  - manigandham 8y ago
    The old Bizspark (and Bizspark Plus) programs have changed into a single Startups program which is more selective. Still great value if you can get it.
lukeh 8y ago
Does it support SSPI (GSS) authentication?
- harmath 8y ago
  just saw this pull req https://github.com/PowerShell/openssh-portable/pull/360 https://github.com/PowerShell/openssh-portable/pull/360
  - mams 8y ago
    its in the making....
jamieson-becker 8y ago
This is pretty awesome news.. for the last few months, we've been working on porting the Userify shim (but not currently the server) to Windows. This will work exactly as it does on Linux (and the shim will continue to be open source): local admin (or user) accounts will be created and keys deployed, and the user will be able to choose PowerShell as their shell of choice. (FWIW, Userify is both a cloud/SaaS and on-premise/self-hosted SSH key management solution designed for modern clouds like AWS and Azure that creates local accounts, deploys keys, and then keeps everything in sync using just outbound HTTPS connections.)
andrewmackrodt 8y ago
If it's similar to SSH in Windows 10 (developer feature) it behaves quite strangely with user account privileges. I tried to `vagrant up` a project configured to use VirtualBox but it was not successful and caused a whole load of file system permission errors in thr project directory mixed between SYSTEM and Andrew (my user account). Additionally, VirtualBox had trouble deleting the VM until a reboot. This is the Vagrantfile: https://github.com/andrewmackrodt/boot2lxd/blob/develop/Vagrantfile.dist#L32 https://github.com/andrewmackrodt/boot2lxd/blob/develop/Vagr... - it creates and attaches an extra virtualdisk in the project directory which was owned by SYSTEM IIRC. TL;DR the VM which should have worked did not work, my FS had weird permissions and a reboot was required to clean up VirtualBox.
qaq 8y ago
So windows at some point will be a bunch of services running on top of Linux :0
adzm 8y ago
Even right now, you can install sshd and/or use the client by adding them as a feature, or by installing manually. https://github.com/PowerShell/Win32-OpenSSH https://github.com/PowerShell/Win32-OpenSSH and https://github.com/PowerShell/openssh-portable https://github.com/PowerShell/openssh-portable
emit_time 8y ago
As someone who just started working as a developer and is using windows for the first time in 4.5 years, I can't believe how much I miss ssh and command line tools for everything... ssh keys would solve so much trouble with scripting and credentials... Also sudo...
- adventured 8y ago
  As a developer do you have to use the Windows GUI or can you use eg the Ubuntu Windows Subsystem for Linux? I highly recommend it. https://en.wikipedia.org/wiki/Windows_Subsystem_for_Linux https://en.wikipedia.org/wiki/Windows_Subsystem_for_Linux
  - shaklee3 8y ago
    Seconded. WSL on Windows 10 has a basic ubuntu CLI install that you can run any CLI program on it works great.
- _hao 8y ago
  As other comments mentioned, just use the Linux sub-system + I would add Cmder as an alternative to the horrible native console. Edit: Cmder - http://cmder.net/ http://cmder.net/
  - Jaruzel 8y ago
    I have zero issues with the native cmd.exe. However, I have changed the following: * Set the default font to Droid Sans Mono (Slashed) [1] * Set the scroll back to 9000 lines, and the default width/height to 132x50. * Used ANSI to colour code the prompt. * created a small tool called su.exe that re-launches cmd.exe as Administrator (it can't be done inline unfortunately) And then I use openSSH (the Windows 10 bundled version) to remote to linux boxes. It's all fine. I really don't understand the hate. --- [1] my own edited copy of Droid Sans Mono where the Zero has a 'slash' added.
    - mixmastamyk 8y ago
nwrk 8y ago
Oh no, now we need to train all winIT how to use command line instead of mouse. Always, laughed while configuring/managing MS products. Great news anyway. Congrats on launch (2018)
- h1d 8y ago
  Now we need to train UNIX admins how to do it without bash. SSH alone doesn't seem any good without all the UNIX tools.
  - nwrk 8y ago
    Agree. Sorry for flame fueled post. Still, old but vivid MS memories. The key point (for me) ie. 8 years ago was really hard to efficiently and error-prone to do most of the task on MS platform. Hope the UNIX tools will ported soon too.
tom_ 8y ago
Always a bit of a mystery to me that POSIX users couldn't figure out Windows until they added a bunch of Unix stuff to it. Here was me thinking that Unix fans were the clever ones, able to learn whatever they put their mind to, unlike the shit-flinging Windows monkeys, able to acquire new skills only through heroic amounts of rote memorization.
- JoshTriplett 8y ago
  This type of attitude isn't particularly helpful. And in any case: it's easy enough to learn Windows, but it gets a lot better when you put decent command-line tools on it. (Yes, I already know about PowerShell and don't need twelve replies advocating it as a revolutionary concept.)
  - brazzledazzle 8y ago
    This type of attitude isn’t terribly helpful either. Sorry if that came off as snarky but this one is near and dear to my heart. The reason you get twelve replies is because PowerShell is the answer to wanting a good shell and decent command line tools. Not perfect but it runs circles around typical ‘nix shells. It would be a bit like having a decent Ruby or Python-based shell on Linux and bemoaning the lack of a Windows cmd port. That said there’s a great case to be made for familiarity and experience and any bourne-like is going to do just fine without PowerShell’s bells and whistles. Powershell is also far from perfect and has warts and limitations like anything else.
    - JoshTriplett 8y ago
      > The reason you get twelve replies is because PowerShell is the answer ...to a question not asked. No, really, I want Linux tools, and don't want PowerShell. When I want more than a shell, I want a real programming language, not a more powerful shell. I appreciate that some people like PowerShell. But the answer to "no, not PowerShell" is not "let me tell you about why you want PowerShell anyway, you just don't understand". > That said there’s a great case to be made for familiarity and experience And simplicity. Here's a closely related example. Back when there was more than one competing distributed version control system, there was "tla" (a predecessor to baz, which was a predecessor to bzr). tla had commands like "init-tree" (not "init"), "file-diffs" (not "diff"), "apply-changeset" (not "apply"), "make-branch" (not "branch"), a dozen commands for logs (not "log"), and so on. Perforce has similar problems. And PowerShell has "Expand-Archive" (not "unzip" or "tar"), "Invoke-WebRequest" (not "wget" or "curl"), "Get-Unique" (aliased as "gu" but not "uniq" or "unique"), and so on. Brevity is a virtue in a tool used so frequently, and brevity is not lack of clarity. Unnecessary verbosity is often an obfuscation.
conanthe 8y ago
I would be more interested about spying. Does it spy? Call home? How safe is corporate data on that system? Can I audit the source code?
- morpheuskafka 8y ago
  https://github.com/PowerShell/openssh-portable https://github.com/PowerShell/openssh-portable
  - conanthe 8y ago
    I was referring to this Windows in general.
- guilhas 8y ago
  Interesting comment actually. A lot of people already install ssh on windows, and it has been like this forever. And spying the user is more on their business agenda. Also people claiming that it does not spy because it open source should read [1]. Source availability does not mean the binary was built from it. 1. You Think the Visual Studio Code Binary You Use Is Open Source? Think Again | Hacker News – https://news.ycombinator.com/item?id=18012301 https://news.ycombinator.com/item?id=18012301
morpheuskafka 8y ago
I really like the idea, but if you're going to administer production Windows servers, it seems like you may as well learn PowerShell which already has a nice remoting framework.
- jackfraser 8y ago
  My understanding is that I'm going to SSH into a Powershell session.
- ulzeraj 8y ago
  > nice remoting framework Hell no. I’ve tried to use that thing on Windows 2012 and it was awful compared to what OpenSSH brings to the table.
scurvy 8y ago
Back when I was a sysadmin at Microsoft, we installed F-Secure's SSH server on every server we built (Messenger/Hotmail). The Windows team thought we were nuts. Well, what do you expect if you ask a bunch of Solaris admins to run Windows? There were no real alternatives. I remember when they got all excited about showing off remote Powershell to us circa 2004, and we collectively rolled our eyes.
- znpy 8y ago
  Could you write more stories about that job you had? I always wondered what messenger/hotmail was ran on, and such stories would be really really interesting imho.
  - scurvy 8y ago
    Hotmail was FreeBSD on the front end until it switched to Windows IIS in an ISAPI filter. The back end was Sun E4500 with T3 purple storage. Then they switched to HP with some terrible RAID crap. Messenger was borne from the Net Meeting team in an informal weekend hackathon (before that was a thing). Backend stored the buddy lists and was 3 Hotmail ustores (Sun E4500 with EMC clariion storage). Front ends started out as Sun 420R then switched to Windows bit by bit (DP, SB, and then CS and PS). The Messenger HTTP gateway always ran in IIS.
    - scurvy 8y ago
      Hotmail and Messenger used a lot of rdist in the early days. Until one of the managers rdisted /dev/null to /etc/passwd. Just one of many lolz in the day.
      - znpy 8y ago
        Glorious stories. You should write your memories about that somewhere in a blog or something. Thank you for sharing that!
riffic 8y ago
This reminds me of that old quotation: "Those who don't understand Unix are condemned to reinvent it, poorly."
- oblio 8y ago
  Well, if you're going to trot out quotes from the 80s (more precisely, 1987, Henry Spencer), you should be aware that Microsoft made and sold one of the first commercial Unixes: Xenix. And they made it in 1980, long before your quote. https://en.wikipedia.org/wiki/Xenix https://en.wikipedia.org/wiki/Xenix -> "In the mid-to-late 1980s, Xenix was the most common Unix variant, measured according to the number of machines on which it was installed.[1][2] Microsoft chairman Bill Gates said in 1996 that for a long time that company had the highest-volume AT&T Unix license" Microsoft definitely understood Unix and figured out there was no market for it for close to 2 decades.
  - Fnoord 8y ago
    Apple successfully leveraged UNIX to develop macOS (officially UNIX) from which they developed iOS. Google successfully managed to leverage the Linux kernel (Unix-like) and Java to develop Android. Windows Phone, on the other hand, flopped.
    - oblio 8y ago
      My original comment said: "there was no market for Unix for close to 2 decades". That was hyperbole, but: 1. 1980 to 1998 for Google, 18 years -> that's awfully close to 2 decades. 2.1980 to 2001 for Apple, 21 years -> that's more than 2 decades. So your counter examples confirm what I said. 3. Windows Phone and family failed because of marketing blunders, not because of tech. MS-DOS and Windows succeeded because of marketing prowess, not because of tech. 4. The mainstream market just wasn't ready for Unix for a long time. The biggest Unix success was Sun, for a long time, and Microsoft absolutely dwarfed Sun for most of their existence. Further proof that my statement was right.
      - Fnoord 8y ago
xedarius 8y ago
Yes! More than two users connected to a server at any one time.
nojvek 8y ago
OpenSSH with powershell is such a great combo. I was very skeptical about powershell, but after writing many scripts I’m a convert. Powershell does so many things nicer than bash. It feels like a real programming language but still not loosing its scripting roots. For running tests for a GUI application which requires us to spin thousands of Machines in parallel, manage job queues, interact with Windows UI automation, do some html result dumping, shell buffer streaming, and a whole bunch of crazy things, powershell interfaces with things really nicely. I absolutely love that powershell pipes streams of objects rather than just streams of bytes. So much more expressive.
- nailer 8y ago
  Yep. I've been using bash since the 90s, and really got into Powershell a couple of years ago (I now run it on macOS too). The amount of people who try and explain bash basics to me when I say I use Powershell is staggering. I'm quite good at regexs thanks, I just like my scripts picking keys 'select' and 'where' rather than scraping with grep / awk etc. The amount of (poor) pwsh clones on Linux is a good testament to the solidness of this approach.
  - mixmastamyk 8y ago
    Scripts over say, 10 lines or so shouldn't be written in bash. That's when moving up to Python or Ruby makes sense.
- h1d 8y ago
  I just can't get over the verbosity of PowerShell. With all the "do 1 thing well" utilities glued by bash, it just feels real effective.
switch007 8y ago
Does anyone know — sorry if I forget the correct terms — whether you can SSH with pub key auth and perform operations that require elevated permissions, such as disk resizing? I have some vague memory of limitations in earlier versions, with distinct differences between password auth and key auth.
- mams 8y ago
  If logging in as one of the adminstrators, you will be in an elevated session - so yes, you can do things like disk resizing. The difference between password auth and key auth is that using password auth you can access network shares that need authentication from within the remote session. With key auth, you wont be able to.
eshizhan 8y ago
Microsoft changed more and more!
tylerapplebaum 8y ago
It would be great if openssh integrated into Windows properly. I can't ssh in as a user with any real permissions. https://github.com/PowerShell/Win32-OpenSSH/issues/139 https://github.com/PowerShell/Win32-OpenSSH/issues/139

431 points by taspeotis 8y ago

That is really something, before as a dev coming from linux when I first was about to login on a Windows Server I didn't understand how to do it since it were no SSH. Administrating the server via a GUI always felt backwards somehow. Why waste CPU cycles on rendering a UI when the CLI is so great (on linux)?

ocdtrekkie 8y ago
Microsoft has come a really long way recently towards moving to CLI-based management. Starting with Server 2016, the default installation method of Windows Server no longer includes most of the GUI (called the Desktop Experience), leaving you with a command prompt window in the middle of the screen instead. An even thinner version of Windows Server, Nano Server, is also available, and includes even less GUI, being much more like a Linux terminal UI, though it is a bit less intuitive to get started with as you can't even install it, you have to image it to deploy. Most Windows admins still prefer a lot of GUI management (I've gotten some groans in response to my statement new servers would tend not to have it), but remote desktop to the server is no longer the preferred way to do that: Remote Server Administration Tools effectively installs all of the server GUI on your desktop PC. Due to the number of legacy applications Windows Server folks tend to support, it's unlikely server GUIs are going away entirely anytime soon, but for a lot of basic server functions supported directly by Microsoft, it's doable. And in addition to not wasting processor and memory pushing pixels, Windows Servers without the GUI are susceptible to less attacks, require less changes during Windows updates, and reboot faster, all on account of just having "less" onboard.
- scarface74 8y ago
  I’ve been developing on and for Windows for 20 years and just started doing anything with Linux earlier this year. If you told me I had to do anything advanced with Windows using only a CLI, I wouldn’t know where to start. On the other hand, I could maneuver my way around a bash shell. I haven’t thought about that before now.....
  - TimTheTinker 8y ago
    I think it's time for MS to develop a new ANSI/VT-compliant, text-oriented shell (to complement PowerShell, which is largely object- and API-oriented). There ought to be a default shell worth using on the other end when you ssh into a Windows server :) cmd.exe and DOS were both text-oriented but extremely buggy and inconsistent. Perhaps MS could just focus on providing a very bash-like language (perhaps even include gnu utilities) while supporting the major interactive use cases for cmd.
    - ocdtrekkie 8y ago
      I doubt you'd see Microsoft reinvent the wheel here. They'd more likely work to give WSL more ability to interact with Windows, and then let you just use that shell if you want to.
      - TimTheTinker 8y ago
        How likely is it that MS will include and enable WSL by default on Windows Server just to provide a better default shell for terminal and ssh users? If I were a server admin, I’d probably turn all of that off because it’s more attack surface area. And cripple myself in the process. For that reason alone, I think a new shell is probably more likely to be helpful.
    - jackfraser 8y ago
      Why would they do that when Powershell is literally that, but refined beyond what's commonly available on Linux? I'm not great with it yet, but it feels intuitively like a step forward to be able to pass objects around instead of spending so much of my time using awk-ward 40 year old tools to tease text out of various fields.
      - grumpydba 8y ago
        However it is far too verbose and without aliasing everything it's a big pain in the a to use.
      - 8y ago
- slededit 8y ago
  They started on this in the late 2000s when I was an intern there. But there was a lot to untangle. It’s the biggest refactoring job you can imagine. A decade long effort. Back then they didn’t really understand the point of ssh though. They had a vision of remote management via .net RPC and powershell.
  - TimTheTinker 8y ago
    > Back then they didn’t really understand the point of ssh though. As an outside observer, it really looked to me like Microsoft had their head in the clouds up until about 2011. It's like the whole decade between 2005-2015 for MS was about recognizing and coming to terms with the multiple "whole worlds out there" and getting past NIH syndrome.
    - kwccoin 8y ago
      To be fair to Kodak, it is very hard to invent digital photography but fail greatly to use it. Or Xerox, ... or IBM who is the largest PC seller exactly the time when it was overwhelmed by Microsoft. An organisation large enough would have middle management and people who promote from within. And they are successful in one culture and it worked even for customers. Then ...
    - slededit 8y ago
      They understood the GUI couldn’t be everything but NIH was definitely in full swing at that time. It was enforced from the top: If you wanted to use an external product and MSFT had a competitor you needed VP approval. Same went for Open Source. Only the most senior people would even attempt it, and it was understood they were spending political capital. The one place this didn’t apply was your choice of code editor. You could use whatever you wanted and that had long been tradition. I spent a lot of effort getting VIM to work only to realize it didn’t scale well to multi-million LOC code bases.
      - killjoywashere 8y ago
        As someone who uses Vim on relatively large files daily (500k - 1.5M lines), where were the hangups?
- usrusr 8y ago
  I think it's more a compatibility thing than an original desire for more CLI. All that deployment tooling built on top of scp, protocols like git over ssh. Without ssh, Microsoft would forever be out of that game. Those things are definitely not "not CLI", but the CLI question is not in focus.
- Silfen 8y ago
  Shameless plug: There's also remote GUI support through Windows Admin Center. You can manage your headless server through the browser on your workstation. It's also a good way to learn CLI-based management (the implementation is almost all powershell scripts, and there is a "show script" feature) https://docs.microsoft.com/en-us/windows-server/manage/windows-admin-center/overview https://docs.microsoft.com/en-us/windows-server/manage/windo...
  - amaccuish 8y ago
    Still doesn't do AD and DNS etc. So I'm still RDPing from my Mac to get access to RSAT.
- cm2187 8y ago
  I am not aware that windows is rendering any pixel while no active desktop session is launched. You have less binaries and probably a smaller memory footprint without desktop but I would be surprised if the performance difference was material.
- mycall 8y ago
  How does RSAT compare to the new Windows Admin Center?
  - snuxoll 8y ago
    The Windows Admin Center currently doesn't cover everything that the RSAT does, notable omissions include anything related to Active Directory. Personally, the Windows Admin Center is a nice-to-have tool for quick tasks by inexperienced or occasional admins - but you really should just learn Powershell.
  - AnIdiotOnTheNet 8y ago
    WAC is a lot like the new settings panels Microsoft keeps pushing. Bloated and with half the functionality of their predecessor.
alkonaut 8y ago
There were multiple ways to get non-GUI shells on remote machines before too. WinRm/WinRs and PowerShell are included out of the box.
- mscasts 8y ago
  Yeah sure, but this was before Powershell was available afaik.
- minxomat 8y ago
  Not to mention SSH via cygwin, which worked pretty well even back on Windows XP.
- tacticus 8y ago
  Winrm stopped being usable if the machine was overly remote.
- new12345 8y ago
  Most of these alternatives are not installed on windows server for security/maintenance overhead reasons by IT administrators and developers are forced to live with slow and cumbersome RDP(not to mention zero capability for scripting) for accessing machines. Now that Microsoft has finally realized the importance of remote shell access for servers and has included it in OS by default, it will become convenient alternative to RDP.
  - jodrellblank 8y ago
    WinRM / PS Remoting has been installed and enabled by default since Server 2012, and RDP disabled by default.
- deleted 8y ago
  [deleted]
sixothree 8y ago
Most of those GUIs are just wrappers for the CLI to begin with. Heck, the default installation of windows does not even have a GUI. People ahem really need to update their thinking of what it means to be Windows.
- zbentley 8y ago
  That's misleading at best (GUI windows apps that technically can be emulated from the commandline often practically cannot be--CLI tools or the registry/config-file interactions required to perform actions that are clearly exposed and well-documented in the GUI often have nonexistent or terrible documentation. In even marginally complex apps, this puts the effort required to script the functionality of the GUI on par with the effort of reverse engineering it--and that's Microsoft-authored tools and Windows functionality, which is worlds ahead of most third-party software in scriptability) and just plain false at worst (huge swaths of stuff just don't have APIs that are accessible without writing and compiling code--PowerShell and very aggressive pushes by Microsoft for WMI/CMI and WinRM more recently have only just begun to erode that).
  - sixothree 8y ago
    How is it misleading at all? Hyper-V Manager for example is literally a wrapper for Powershell commands. Virtually all Windows administration can be done entirely in Powershell. And like I said, the literal default installation of Windows does not even include a GUI.
    - icedchai 8y ago
      What do you consider the "literal default installation"?
      - kivikakk 8y ago
        Something very, very different to everyone else, it would seem.
EPress1970 8y ago
Because you can't see My Pictures and open Office docs via CLI
AnIdiotOnTheNet 8y ago
Microsoft's GUI management tools were really good and generally very discoverable. IMO they were a much better way to manage an OS than cryptically named CLI programs and text files. And most of them worked remotely. And by comparison to modern software they can not even remotely be considered bloated. Every electron application ever made is larger than all of RSAT. Now of course they suck ass because MS has no idea what it's doing anymore.
- amazingman 8y ago
  Those cryptically named programs are scriptable, and those text files (including scripts) are easy to version and backup.
  - TomMarius 8y ago
    Windows was and is scriptable as well (but it must be said that you mostly had to discover it yourself, documentation was lacking) Backup is done the other way around, you backup your configuration scripts
  - AnIdiotOnTheNet 8y ago
    Windows servers used to have a NTBackup, which could just back up all the settings ("system state") if that was what you wanted for some reason.
    - brian_herman__ 8y ago
      Windows Server Backup doesn't do this on 2016 or 2019?
- bayindirh 8y ago
  It's almost 2019. Are we still fighting over this? OTOH, purely from my experience, MS's tools are good for managing a domain, or some computers. When you start to administer hundreds or thousands of servers, scriptability of CLI tools and pliability of text files trumps all computer automation. xCAT and Salt are two tools (that I use regularly) which are built on these properties and can manage thousands of servers with a "flick of a finger".
jimmaswell 8y ago
For just one thing, I find it a lot nicer being able to edit config files in Notepad++ or something instead of vim or nano. In my case I mount the remote Linux server as a drive on Windows.
- godzilla82 8y ago
  Mounting requires other ports to be opened, which no sysadmin will do on the internet. Ssh on the other hand can be started on a non standard port.
  - cpach 8y ago
    IME most Windows servers are not directly exposed to the Internet, instead one would reach them via VPN.
    - yrro 8y ago
      It's a shame you can't use the Common Internet File System over the Internet. ️
      - arethuza 8y ago
        But you can use SMB e.g. Azure File Storage
      - amaccuish 8y ago
        FYI, CIFS refers specifically to the version of SMB1 that was submitted as an RFC. You should absolutely not be using "CIFS" these days.
        yrro 8y ago
        Wait, they renamed it back?
  - jimmaswell 8y ago
    I do it over SFTP with a program called SFTP Net Drive. No additional ports besides the existing SSH.
dijit 8y ago
So, I am not a big fan of windows- so do not take this for defence of windows. But my understanding is that windows fleets are just administered drastically differently than Linux fleets. On Linux we have a lot of config management tools and commandline remote administration kits. In windows they have SCCM and remote access GUIs which do not get rendered on the target server. It’s very common to see a GUI program which does something pretty basic but over 500+ windows machines in windows heavy shops. In fact when I explained that I do all my scripting with a local target (because I use salt stack which is essentially a remote execution framework before it is a config management system) I was told in no uncertain terms that I was doing things the “old way”.
- voltagex_ 8y ago
  This is changing: * Desired State Configuration: https://docs.microsoft.com/en-us/powershell/dsc/overview https://docs.microsoft.com/en-us/powershell/dsc/overview * Powershell Remoting (please, please let SSH replace this) * Microsoft's new command line push - cmd and the underlying console have had big updates recently * https://github.com/microsoft/console https://github.com/microsoft/console * https://blogs.msdn.microsoft.com/commandline/2018/07/20/windows-command-line-inside-the-windows-console/ https://blogs.msdn.microsoft.com/commandline/2018/07/20/wind...
  - orra 8y ago
    Desired State Configuration is not supported by PowerShell Core v6, even on Windows. DSC is only supported by PowerShell v5 and earlier. This suggests to me that DSC has been abandoned In contrast, .NET Core supports various old Windows-only features, such as COM and soon WinForms.
  - setquk 8y ago
    Yes and no. Having used DSC and powershell remoting extensively, these create as many problems as they solve. Nothing works smoothly. Not a thing. The saving grace here will be SSH because then at least we can drive all our kit across both platforms from Ansible and be done with the entire MSFT management stack. At the moment we use Ansible but it runs over WinRM which is completely unreliable due to some architectural problems with how WinRM works. Really, automation on Windows is extremely costly compared to Linux. I've got to the point I never want to run Windows infrastructure again. Before anyone says "it's getting better". That has been the case from 10 years and it only got different.
h1d 8y ago
It's not the CPU cycle but lag that makes me feel like I'm on a laptop from 15 years ago.

deleted 8y ago

[deleted]

sashavingardt2 8y ago

Party like it's 1999!

hk__2 8y ago
I know it’s a joke, but OpenSSH is not that old: its initial release was in December, 1999.
- flukus 8y ago
  Looks like it was forked from some predecessors ( https://en.wikipedia.org/wiki/Secure_Shell#OSSH https://en.wikipedia.org/wiki/Secure_Shell#OSSH) but doesn't go into the history much more than that. I remember telnet, where there any encrypted predecessors before the ssh family?
  - deleted 8y ago
    [deleted]
  - Diederich 8y ago
    > where there any encrypted predecessors before the ssh family? None that were mainstream/widely used.
  - jamieson-becker 8y ago
    OpenSSH was forked from the original SSH (version 1) code by Tatu Ylönen after it went closed source in the mid-1990's IIRC. https://www.openssh.com/history.html https://www.openssh.com/history.html
  - jabl 8y ago
    There was/is kerberized telnet/rsh/rlogin, with optional encryption.
  - Fnoord 8y ago
    Telnet over SSL.
- rauhl 8y ago

taf2 8y ago

So now I’m just waiting to hear Microsoft is switching its kernel to Linux. Especially after the switch to chromium.

eriken 8y ago
I would terminate my apple dependency in a heart beat.
axaxs 8y ago
Not sure if a joke, but I'd absolutely love this. I, as a consumer, would gladly pay good money to be able to use Outlook and the MS Office suite. Regardless of what anyone claims, the linux alternatives are useable but not nearly as good. I used to use Windows with Cygwin, but found I spent way more time doing linux-y things than Windows-y things...so switched away.
- tmh88j 8y ago
  Why not Mac? Best of both worlds.
  - copperx 8y ago
    I would have said the same thing a year ago. Today not so much because Apple hardware prices have skyrocketed. It used to be that a Mac cost 2x the PC equivalent, but now the cost is reaching 3x. For many, especially considering engineering salaries, that's justified. To me, having the familiar GNU toolchain and Linux configuration available at any moment without having to use a VM or Homebrew is worth the downgrade in eye candy.
    - tmh88j 8y ago
      >Today not so much because Apple hardware prices have skyrocketed. He said >I, as a consumer, would gladly pay good money to be able to use Outlook and the MS Office suite. You can do that on a Mac.
    - lostlogin 8y ago

dfabulich 8y ago

It's available out of the box in Windows 10 April 2018 Update, as well. Just pop open a Command Prompt and type "ssh."

ocdtrekkie 8y ago
Actually, note that Windows 10 has the OpenSSH client, "ssh", but to my knowledge, does not include the ability to be an OpenSSH server. EDIT: 1803 build appparently can get OpenSSH Server running, but it's "a bit of work": https://www.bleepingcomputer.com/news/microsoft/how-to-install-the-built-in-windows-10-openssh-server/ https://www.bleepingcomputer.com/news/microsoft/how-to-insta...
- mgamache 8y ago
  I am running this on AWS. It was a 30 minute exercise and it's only available on the 'core' AMI. This means there is no GUI even if you wanted one. I do like the ability to run regular CMD or PowerShell. I am experimenting with using SSH to automate deployments to Windows Server.
  - alexeldeib 8y ago
    TIL there's an AWS Windows AMI that comes without a GUI. Another user in the thread was talking about the "default install" of Windows not containing a GUI; wonder if this is what they meant.
    - vetinari 8y ago
      If you install Windows 2016 RTM without changing a single option, you will end up without GUI. You have to choose "desktop experience" during install to get the traditional desktop installed.
- mams 8y ago
  Looks like the latest version is a lot simple to use... Just install the optional server feature and start sshd service. https://docs.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse https://docs.microsoft.com/en-us/windows-server/administrati...

npmaile 8y ago

Now all they have to do is switch their kernel to linux, their gui to kde and get their office suite to LibreOffice, and Windows will be the perfect computer.

briandear 8y ago
I don’t use LibreOffice or Office anymore, but is Libre actually a better product?
- maxxxxx 8y ago
  It's not. Office is much better. Unfortunately :-(
- snazz 8y ago
  It has a lot more UI options, so you can remove the Ribbon and other controversial UI elements. It’s also scriptable in JavaScript and Python [0], which is an improvement over VBA for the HN crowd. [0]: https://help.libreoffice.org/Common/Scripting https://help.libreoffice.org/Common/Scripting
  - freehunter 8y ago
    Office 2016 lets you replace VBA with Javascript, for what it's worth.
emilfihlman 8y ago
Windows ux is better out of the box than on any Linux so far, it's really polished. The office suite is also much better than alternatives. So just switching the kernel to Linux would be enough and super winrar.
- aaaaaaaaaab 8y ago
  Windows UX is really polished? Are you on Win7 by any chance?

ericseppanen 8y ago

It's interesting that their ssh-agent runs as a service under an Administrator account. I'd guess this is an attempt to better protect the private key against theft during a local compromise (i.e. unlocked computer left running on your desk). I haven't seen this done on Linux. Has this trick been implemented on other systems?

ericseppanen 8y ago
Useful reading: https://blog.netspi.com/stealing-unencrypted-ssh-agent-keys-from-memory/ https://blog.netspi.com/stealing-unencrypted-ssh-agent-keys-... https://blog.ropnop.com/extracting-ssh-private-keys-from-windows-10-ssh-agent/ https://blog.ropnop.com/extracting-ssh-private-keys-from-win...

deleted 8y ago

[deleted]

ratsbane 8y ago

That's really nice that they've finally decided to add something that a lot of people needed in 2005.

mixmastamyk 8y ago
The Ballmer barrier.
baroffoos 8y ago
They also got notepad to not blow everything up when opening a file with normal line endings. It still fucks everything up when creating new files though.
- guardian5x 8y ago
  I guess, with "normal" line endings, you mean <LF> instead of <CR><LF>.
  - aerique 8y ago
    He means the defacto standard, yes.
    - boomlinde 8y ago
      Not the defacto standard, but plain POSIX. Carriage return + line feed to enter a new line starting at the left margin makes perfect sense mechanically, though, and a lot of systems with ASCII/ASCII-like encodings use some variation of this sequence (e.g. <cr><lf> or <lf><cr>) for "newlines". Of course, in the interest of compatibility I'd prefer if it was one way or another, but I don't think it's fair to say that POSIX is the defacto standard. Lines in network protocols, for example, typically use <cr><lf> as well.

tachion 8y ago

The only thing that’s now left for them to do is to donate to the OpenSSH project :)

deleted 8y ago
[deleted]
_rs 8y ago
Actually Microsoft has donated every year since 2015 to the OpenBSD Foundation, with 2018 listed as $25-50k (https://www.openbsdfoundation.org/contributors.html https://www.openbsdfoundation.org/contributors.html).
ghewgill 8y ago
Microsoft is a frequent contributor to the OpenBSD Foundation: https://www.openbsdfoundation.org/contributors.html https://www.openbsdfoundation.org/contributors.html

dana321 8y ago

Thats nice. How about adding it to Windows 10?

polar 8y ago
https://blogs.msdn.microsoft.com/powershell/2017/12/15/using-the-openssh-beta-in-windows-10-fall-creators-update-and-windows-server-1709/ https://blogs.msdn.microsoft.com/powershell/2017/12/15/using...
sandyarmstrong 8y ago
The very first sentence of the article is: > The OpenSSH client and server are now available as a supported Feature-on-Demand in Windows Server 2019 and Windows 10 1809!
- dana321 8y ago
  I know that, i've tried it and its really laggy. It might as well not be there at all.
  - mams 8y ago
    you might want to create an issue for their devs to look into. https://github.com/PowerShell/Win32-OpenSSH/issues https://github.com/PowerShell/Win32-OpenSSH/issues
deleted 8y ago
[deleted]

sys_64738 8y ago

Microsoft is becoming the defacto leader in open source.

nwah1 8y ago
This is almost undeniable. Seems like everyone and their mother are using vscode, typescript is huge, .NET Core is FOSS, PowerShell is now open source, etc etc. The Language Server Protocol has revolutionized IDEs in general. And now that they own GitHub (and their projects like Atom), it seems like the entire FOSS developer workflow is likely to be from MS-derived projects. Which I'm sure they are hoping will translate into more cloud service revenue and online software subscriptions. If you are starting a new company, BizSpark is a really attractive offering. Could run a whole business on it, and yet none of your devs need to be running windows on their machines.
- sleet 8y ago
  Unfortunately Bizspark is only available though accelerators, incubators, and VCs now.
  - manigandham 8y ago
    Bizspark doesn't exist anymore, it's a single program called Microsoft for Startups now, and it does allow you to apply directly: https://startups.microsoft.com/en-us/faq/ https://startups.microsoft.com/en-us/faq/
    - morpheuskafka 8y ago
      But it's only for those developing an "innovative, technical solution unique in the market with a B2B focus that will benefit from access to enterprise customers," according to that link. IIRC the old BizSpark didn't have as strict of a B2B focus.
- manigandham 8y ago
  The old Bizspark (and Bizspark Plus) programs have changed into a single Startups program which is more selective. Still great value if you can get it.

lukeh 8y ago

Does it support SSPI (GSS) authentication?

harmath 8y ago
just saw this pull req https://github.com/PowerShell/openssh-portable/pull/360 https://github.com/PowerShell/openssh-portable/pull/360
- mams 8y ago
  its in the making....

jamieson-becker 8y ago

This is pretty awesome news.. for the last few months, we've been working on porting the Userify shim (but not currently the server) to Windows. This will work exactly as it does on Linux (and the shim will continue to be open source): local admin (or user) accounts will be created and keys deployed, and the user will be able to choose PowerShell as their shell of choice. (FWIW, Userify is both a cloud/SaaS and on-premise/self-hosted SSH key management solution designed for modern clouds like AWS and Azure that creates local accounts, deploys keys, and then keeps everything in sync using just outbound HTTPS connections.)

andrewmackrodt 8y ago

If it's similar to SSH in Windows 10 (developer feature) it behaves quite strangely with user account privileges. I tried to `vagrant up` a project configured to use VirtualBox but it was not successful and caused a whole load of file system permission errors in thr project directory mixed between SYSTEM and Andrew (my user account). Additionally, VirtualBox had trouble deleting the VM until a reboot. This is the Vagrantfile: https://github.com/andrewmackrodt/boot2lxd/blob/develop/Vagrantfile.dist#L32 https://github.com/andrewmackrodt/boot2lxd/blob/develop/Vagr... - it creates and attaches an extra virtualdisk in the project directory which was owned by SYSTEM IIRC. TL;DR the VM which should have worked did not work, my FS had weird permissions and a reboot was required to clean up VirtualBox.

qaq 8y ago

So windows at some point will be a bunch of services running on top of Linux :0

adzm 8y ago

Even right now, you can install sshd and/or use the client by adding them as a feature, or by installing manually. https://github.com/PowerShell/Win32-OpenSSH https://github.com/PowerShell/Win32-OpenSSH and https://github.com/PowerShell/openssh-portable https://github.com/PowerShell/openssh-portable

emit_time 8y ago

As someone who just started working as a developer and is using windows for the first time in 4.5 years, I can't believe how much I miss ssh and command line tools for everything... ssh keys would solve so much trouble with scripting and credentials... Also sudo...

adventured 8y ago
As a developer do you have to use the Windows GUI or can you use eg the Ubuntu Windows Subsystem for Linux? I highly recommend it. https://en.wikipedia.org/wiki/Windows_Subsystem_for_Linux https://en.wikipedia.org/wiki/Windows_Subsystem_for_Linux
- shaklee3 8y ago
  Seconded. WSL on Windows 10 has a basic ubuntu CLI install that you can run any CLI program on it works great.
_hao 8y ago
As other comments mentioned, just use the Linux sub-system + I would add Cmder as an alternative to the horrible native console. Edit: Cmder - http://cmder.net/ http://cmder.net/
- Jaruzel 8y ago
  I have zero issues with the native cmd.exe. However, I have changed the following: * Set the default font to Droid Sans Mono (Slashed) [1] * Set the scroll back to 9000 lines, and the default width/height to 132x50. * Used ANSI to colour code the prompt. * created a small tool called su.exe that re-launches cmd.exe as Administrator (it can't be done inline unfortunately) And then I use openSSH (the Windows 10 bundled version) to remote to linux boxes. It's all fine. I really don't understand the hate. --- [1] my own edited copy of Droid Sans Mono where the Zero has a 'slash' added.
  - mixmastamyk 8y ago

nwrk 8y ago

Oh no, now we need to train all winIT how to use command line instead of mouse. Always, laughed while configuring/managing MS products. Great news anyway. Congrats on launch (2018)

h1d 8y ago
Now we need to train UNIX admins how to do it without bash. SSH alone doesn't seem any good without all the UNIX tools.
- nwrk 8y ago
  Agree. Sorry for flame fueled post. Still, old but vivid MS memories. The key point (for me) ie. 8 years ago was really hard to efficiently and error-prone to do most of the task on MS platform. Hope the UNIX tools will ported soon too.

tom_ 8y ago

Always a bit of a mystery to me that POSIX users couldn't figure out Windows until they added a bunch of Unix stuff to it. Here was me thinking that Unix fans were the clever ones, able to learn whatever they put their mind to, unlike the shit-flinging Windows monkeys, able to acquire new skills only through heroic amounts of rote memorization.

JoshTriplett 8y ago
This type of attitude isn't particularly helpful. And in any case: it's easy enough to learn Windows, but it gets a lot better when you put decent command-line tools on it. (Yes, I already know about PowerShell and don't need twelve replies advocating it as a revolutionary concept.)
- brazzledazzle 8y ago
  This type of attitude isn’t terribly helpful either. Sorry if that came off as snarky but this one is near and dear to my heart. The reason you get twelve replies is because PowerShell is the answer to wanting a good shell and decent command line tools. Not perfect but it runs circles around typical ‘nix shells. It would be a bit like having a decent Ruby or Python-based shell on Linux and bemoaning the lack of a Windows cmd port. That said there’s a great case to be made for familiarity and experience and any bourne-like is going to do just fine without PowerShell’s bells and whistles. Powershell is also far from perfect and has warts and limitations like anything else.
  - JoshTriplett 8y ago
    > The reason you get twelve replies is because PowerShell is the answer ...to a question not asked. No, really, I want Linux tools, and don't want PowerShell. When I want more than a shell, I want a real programming language, not a more powerful shell. I appreciate that some people like PowerShell. But the answer to "no, not PowerShell" is not "let me tell you about why you want PowerShell anyway, you just don't understand". > That said there’s a great case to be made for familiarity and experience And simplicity. Here's a closely related example. Back when there was more than one competing distributed version control system, there was "tla" (a predecessor to baz, which was a predecessor to bzr). tla had commands like "init-tree" (not "init"), "file-diffs" (not "diff"), "apply-changeset" (not "apply"), "make-branch" (not "branch"), a dozen commands for logs (not "log"), and so on. Perforce has similar problems. And PowerShell has "Expand-Archive" (not "unzip" or "tar"), "Invoke-WebRequest" (not "wget" or "curl"), "Get-Unique" (aliased as "gu" but not "uniq" or "unique"), and so on. Brevity is a virtue in a tool used so frequently, and brevity is not lack of clarity. Unnecessary verbosity is often an obfuscation.

conanthe 8y ago

I would be more interested about spying. Does it spy? Call home? How safe is corporate data on that system? Can I audit the source code?

morpheuskafka 8y ago
https://github.com/PowerShell/openssh-portable https://github.com/PowerShell/openssh-portable
- conanthe 8y ago
  I was referring to this Windows in general.
guilhas 8y ago
Interesting comment actually. A lot of people already install ssh on windows, and it has been like this forever. And spying the user is more on their business agenda. Also people claiming that it does not spy because it open source should read [1]. Source availability does not mean the binary was built from it. 1. You Think the Visual Studio Code Binary You Use Is Open Source? Think Again | Hacker News – https://news.ycombinator.com/item?id=18012301 https://news.ycombinator.com/item?id=18012301

morpheuskafka 8y ago

I really like the idea, but if you're going to administer production Windows servers, it seems like you may as well learn PowerShell which already has a nice remoting framework.

jackfraser 8y ago
My understanding is that I'm going to SSH into a Powershell session.
ulzeraj 8y ago
> nice remoting framework Hell no. I’ve tried to use that thing on Windows 2012 and it was awful compared to what OpenSSH brings to the table.

scurvy 8y ago

Back when I was a sysadmin at Microsoft, we installed F-Secure's SSH server on every server we built (Messenger/Hotmail). The Windows team thought we were nuts. Well, what do you expect if you ask a bunch of Solaris admins to run Windows? There were no real alternatives. I remember when they got all excited about showing off remote Powershell to us circa 2004, and we collectively rolled our eyes.

znpy 8y ago
Could you write more stories about that job you had? I always wondered what messenger/hotmail was ran on, and such stories would be really really interesting imho.
- scurvy 8y ago
  Hotmail was FreeBSD on the front end until it switched to Windows IIS in an ISAPI filter. The back end was Sun E4500 with T3 purple storage. Then they switched to HP with some terrible RAID crap. Messenger was borne from the Net Meeting team in an informal weekend hackathon (before that was a thing). Backend stored the buddy lists and was 3 Hotmail ustores (Sun E4500 with EMC clariion storage). Front ends started out as Sun 420R then switched to Windows bit by bit (DP, SB, and then CS and PS). The Messenger HTTP gateway always ran in IIS.
  - scurvy 8y ago
    Hotmail and Messenger used a lot of rdist in the early days. Until one of the managers rdisted /dev/null to /etc/passwd. Just one of many lolz in the day.
    - znpy 8y ago
      Glorious stories. You should write your memories about that somewhere in a blog or something. Thank you for sharing that!

riffic 8y ago

This reminds me of that old quotation: "Those who don't understand Unix are condemned to reinvent it, poorly."

oblio 8y ago
Well, if you're going to trot out quotes from the 80s (more precisely, 1987, Henry Spencer), you should be aware that Microsoft made and sold one of the first commercial Unixes: Xenix. And they made it in 1980, long before your quote. https://en.wikipedia.org/wiki/Xenix https://en.wikipedia.org/wiki/Xenix -> "In the mid-to-late 1980s, Xenix was the most common Unix variant, measured according to the number of machines on which it was installed.[1][2] Microsoft chairman Bill Gates said in 1996 that for a long time that company had the highest-volume AT&T Unix license" Microsoft definitely understood Unix and figured out there was no market for it for close to 2 decades.
- Fnoord 8y ago
  Apple successfully leveraged UNIX to develop macOS (officially UNIX) from which they developed iOS. Google successfully managed to leverage the Linux kernel (Unix-like) and Java to develop Android. Windows Phone, on the other hand, flopped.
  - oblio 8y ago
    My original comment said: "there was no market for Unix for close to 2 decades". That was hyperbole, but: 1. 1980 to 1998 for Google, 18 years -> that's awfully close to 2 decades. 2.1980 to 2001 for Apple, 21 years -> that's more than 2 decades. So your counter examples confirm what I said. 3. Windows Phone and family failed because of marketing blunders, not because of tech. MS-DOS and Windows succeeded because of marketing prowess, not because of tech. 4. The mainstream market just wasn't ready for Unix for a long time. The biggest Unix success was Sun, for a long time, and Microsoft absolutely dwarfed Sun for most of their existence. Further proof that my statement was right.
    - Fnoord 8y ago

xedarius 8y ago

Yes! More than two users connected to a server at any one time.

nojvek 8y ago

OpenSSH with powershell is such a great combo. I was very skeptical about powershell, but after writing many scripts I’m a convert. Powershell does so many things nicer than bash. It feels like a real programming language but still not loosing its scripting roots. For running tests for a GUI application which requires us to spin thousands of Machines in parallel, manage job queues, interact with Windows UI automation, do some html result dumping, shell buffer streaming, and a whole bunch of crazy things, powershell interfaces with things really nicely. I absolutely love that powershell pipes streams of objects rather than just streams of bytes. So much more expressive.

nailer 8y ago
Yep. I've been using bash since the 90s, and really got into Powershell a couple of years ago (I now run it on macOS too). The amount of people who try and explain bash basics to me when I say I use Powershell is staggering. I'm quite good at regexs thanks, I just like my scripts picking keys 'select' and 'where' rather than scraping with grep / awk etc. The amount of (poor) pwsh clones on Linux is a good testament to the solidness of this approach.
- mixmastamyk 8y ago
  Scripts over say, 10 lines or so shouldn't be written in bash. That's when moving up to Python or Ruby makes sense.
h1d 8y ago
I just can't get over the verbosity of PowerShell. With all the "do 1 thing well" utilities glued by bash, it just feels real effective.

switch007 8y ago

Does anyone know — sorry if I forget the correct terms — whether you can SSH with pub key auth and perform operations that require elevated permissions, such as disk resizing? I have some vague memory of limitations in earlier versions, with distinct differences between password auth and key auth.

mams 8y ago
If logging in as one of the adminstrators, you will be in an elevated session - so yes, you can do things like disk resizing. The difference between password auth and key auth is that using password auth you can access network shares that need authentication from within the remote session. With key auth, you wont be able to.

eshizhan 8y ago

Microsoft changed more and more!

tylerapplebaum 8y ago

It would be great if openssh integrated into Windows properly. I can't ssh in as a user with any real permissions. https://github.com/PowerShell/Win32-OpenSSH/issues/139 https://github.com/PowerShell/Win32-OpenSSH/issues/139